A support agent pastes a customer's account details into ChatGPT to draft a faster reply. A finance analyst runs quarterly numbers through a browser extension that summarises spreadsheets. A developer connects an AI coding assistant to a repository that was never scoped for it. None of these people are doing anything malicious. They are solving a problem the fastest way available to them, and in most companies, nobody signed off on any of it.
That pattern now has a name: shadow AI.
Shadow AI is the use of AI tools, models, and agents inside an organisation without the knowledge, approval, or oversight of IT or security. It is an extension of shadow IT, the older and more familiar problem of employees adopting SaaS tools without going through procurement, but with a wider blast radius. A shadow IT tool mostly stores data. A shadow AI tool reads it, processes it, and in some cases retains it to improve a model that has nothing to do with your business.
The scale of it tends to surprise people once they actually look. Research from Reco AI, cited in a 2026 research note from the Cloud Security Alliance, found the average enterprise manages around 490 SaaS applications, of which only 47% are formally authorised, alongside roughly 1,200 unauthorised applications overall. Unauthorised AI tools, the same research found, stay active inside a company for a median of 403 days before anyone notices them.
This is not an edge case affecting a handful of careless employees. A Gartner survey of 302 cybersecurity leaders, conducted between March and May 2025 and cited in the same Cloud Security Alliance note, found that 69% of organisations either suspect or have direct evidence of staff using prohibited public generative AI tools. Separate 2026 research from Netskope puts the figure even more starkly: nearly 47% of generative AI users access these tools through personal accounts, which sidesteps enterprise controls entirely. And the reason most companies have no answer to any of this is straightforward. IBM's 2025 research found that only 37% of organisations have an AI governance policy at all. Most of the exposure described above is not a failure to enforce a rule. It is the absence of a rule to enforce.
The instinctive response, when a company discovers shadow AI use, is to block it. That response is understandable and usually short lived. In 2023, three semiconductor engineers at Samsung pasted proprietary source code, internal meeting transcripts, and chip yield test data into ChatGPT within the space of a single month. Samsung's first move was an outright ban. It later reversed that decision in favour of building an approved internal alternative, because the underlying need the engineers were solving for had not gone away.
The data backs up what Samsung learned the hard way. Research cited by Vectra AI found that nearly half of employees say they would keep using personal AI accounts even after their company bans them. The more useful number sits on the other side of that finding: when organisations provision a sanctioned AI tool instead of simply prohibiting the unsanctioned ones, unauthorised use drops by around 89%, according to the Cloud Security Alliance's 2026 research note. People are not trying to create risk. They are choosing the fastest tool available to them, and the fix is giving them a faster, approved one, not taking the only option away.
For a European business, this stops being purely an internal risk question on 2 August 2026, when binding enforcement of the EU AI Act's obligations for high-risk AI systems takes effect. At that point, a company with no current inventory of what AI is actually running against its data is not carrying an IT gap. It is carrying a compliance exposure, with penalties running up to €15 million or 3% of global annual turnover. Most companies we work with are not close to a high-risk AI use case in the Act's own terms, but the underlying requirement, being able to say with confidence what AI is touching your data and on what basis, applies well before you get anywhere near that threshold.
We have written before about what belongs inside the application layer once you are building AI features deliberately: access control at the level of individual data fields, an audit trail that records what an agent read and decided, and a human checkpoint before anything consequential happens. All of that still holds. But shadow AI is a different starting point, because the tools in question were never designed into anything. The first question is not what controls to build. It is who is actually accountable for knowing what AI is running inside the company and who decides when a new tool gets approved.
In the organisations where this gets resolved without an incident forcing the issue, that ownership question was answered in advance, not during the aftermath of a data exposure. It rarely needs to be a large platform decision or a dedicated new hire. It usually starts as a named responsibility, sometimes a fractional one layered onto an existing role, paired with a simple way for someone to request a new tool without going around the process entirely.
Start with an honest inventory rather than a policy document.
Ask a handful of people across different departments what they actually use day to day, not what is officially sanctioned, because the gap between those two answers is usually where the risk sits. Where you find a tool people have adopted on their own, treat it as a signal about a real need rather than only a problem to shut down, and look for an approved equivalent before removing the unapproved one. And put one name against the ongoing decision of what gets approved next, so the inventory stays current instead of becoming another document nobody revisits.
Shadow AI is not really a story about employees making poor choices. It is a story about adoption moving faster than the ownership structure around it, which is exactly what happens whenever a genuinely useful technology arrives faster than a company's usual approval process can absorb it. The businesses handling this well are not the ones with the strictest tools. They are the ones who decided, early, who was responsible for the answer to a simple question: what AI is actually running inside our company right now, and who approved it.
If that question does not have a clear answer inside your business yet, Runbaze runs a mini course built specifically for that gap.
Five days, one blueprint. Ten minutes a day. You leave with a one-page blueprint for your first governed process, for access https://runbaze.com
.jpeg)
Shadow AI is the use of AI tools, models, and agents inside a company without the knowledge, approval, or oversight of IT or security. It extends the older problem of shadow IT, employees adopting SaaS tools outside procurement, but with more exposure, because an AI tool doesn't just store data, it reads and processes it.
Because the underlying need doesn't disappear when a tool is blocked. Research cited by Vectra AI found nearly half of employees say they'd keep using personal AI accounts even after a ban. The more useful fix is provisioning an approved alternative: the Cloud Security Alliance found that unauthorised use drops by around 89% once companies do that.
Start with an honest inventory of what people are already using, not a new policy document. From there, the practical fix is giving people an approved equivalent and putting one name against the ongoing decision of what gets approved next, so the inventory stays current instead of going stale.
