Shadow AI: why it matters and how to bring it under control

An account manager pastes a customer's email thread into a chatbot to draft a reply. A financial controller uploads next quarter's forecast to get a summary for the board. A developer drops a failing log file, access keys included, into an assistant to find the bug.

None of them is doing anything malicious. Each is trying to finish a task faster, with a tool that works. That is what makes shadow AI hard to see, and why it deserves more attention than a line in the acceptable use policy.

Updated on 11 October 2026.

What shadow AI is

Shadow AI is any AI tool, feature or agent that people use for work without the organisation knowing about it or having approved it. It covers the consumer chatbot opened in a browser tab, the assistant a software vendor switched on inside a product you already pay for, and the agent an engineer wired to a model with a personal key.

It is the common case. In a global study of 48,340 people in 47 countries, KPMG and the University of Melbourne found that the generative AI tools people use at work are mostly free public options (70%) rather than tools provided by their employer (42%). In the same study, 57% of employees said they hide their use of AI and present AI-generated work as their own. In the UK, a Microsoft study of 2,003 employees found that 71% have used unapproved consumer AI tools at work, and 51% still do so every week.

Why it needs fixing

Confidential data leaves your control

What goes into these tools is not trivial. Cyberhaven's 2026 analysis found that 39.7% of all data movements into AI tools involve sensitive data. Harmonic Security looked at 22.4 million enterprise prompts sent during 2025 and counted 579,113 exposures of sensitive data. The largest categories were legal content (35%) and technical intellectual property (26.5%).

With a personal account there is no contract between your company and the provider. What happens to the pasted text depends on consumer terms that an employee accepted alone, and that nobody in security or legal has read.

European law applies whether or not you approved the tool

Under the GDPR, personal data that an employee pastes into a consumer AI service while doing their job is still data your organisation is responsible for. There is no data processing agreement with the provider. Depending on the provider, the data may also leave the EU with no transfer mechanism in place. The most serious GDPR infringements can be fined up to 20 million euros or 4% of worldwide annual turnover.

The EU AI Act adds duties that attach to each AI system. A team that quietly starts screening job applicants with an AI tool is running a high-risk use the organisation has not assessed. From 2 December 2027 that use requires human oversight, retained logs and informing the workers concerned.

Incidents cost more

IBM's 2025 Cost of a Data Breach Report, based on 600 breached organisations, found that one in five reported a breach due to shadow AI. Organisations with high levels of shadow AI paid $670,000 more per breach than those with little or none.

Why banning the tools does not work

Blocking AI services on the company network looks like the sensible answer. In practice the work moves to a personal phone, a home connection or a tool you have not heard of yet, and you lose what visibility you had.

The Microsoft study shows why. Among employees using unapproved tools, 28% said their company does not provide an approved option, and 41% said they use the tools they already use in their personal life. Shadow AI is mostly unmet demand. Removing tools without offering an approved route produces more of it.

Asking people does not work either. When more than half of employees say they hide their AI use, a questionnaire will undercount, and it will undercount most where usage is heaviest.

Where shadow AI hides

Personal accounts on company devices. The most common pattern. To the provider this is a private person using a consumer product. To a network proxy it is ordinary encrypted traffic. Cyberhaven found personal-account usage of 32.3% for ChatGPT and 24.9% for Gemini.

AI features inside software you already approved. Your CRM, your ticketing system and your video conferencing tool have all shipped assistants and notetakers. Nobody made an adoption decision. A product update changed a setting.

Agents your own teams built. A scheduled job that calls a model, an internal assistant on a low-code platform, a script with an API key. These have no vendor and often no owner. They do have credentials, and unlike a chatbot they take actions.

How to bring it under control

Shadow AI can be governed. That takes two things most organisations do not have yet: a way to see AI nobody declared, and a way to apply rules to tools nobody approved.

1. Find it from the signals you already produce. Your identity provider knows which AI applications were granted access. Your network and web security tools see which AI services people reach. A browser extension and a desktop agent on company devices see what the network cannot, including use through personal accounts. Qastel merges these sightings into one inventory, with one entry per AI system.

2. Understand each system before deciding. Who uses it, how many people, what data reaches it, whether it can take actions. A tool used by one enthusiast and a tool used by half a department are different problems.

3. Decide for each tool, and record the decision. Approve it, approve it with restrictions, or replace it with an approved alternative. The next person who asks then finds an answer instead of starting a new investigation.

4. Apply your policies where the work happens, on unapproved tools too. This is the step a written charter cannot take. With runtime enforcement, a policy such as "no customer data in consumer AI tools" is checked at the moment someone sends a prompt, in the browser or on the desktop, whether or not the tool was ever approved. Qastel can warn the person, redact the sensitive part or block the request. Every policy starts in monitoring, so you see what it would have done before it stops anything.

5. Train people on the tools they actually use. KPMG found that only 47% of employees say they have received AI training. Knowing which tools are in use lets the training cover those tools, and a warning shown at the moment of use teaches the rule better than a document.

Common questions

Should we ban ChatGPT at work?

A ban can be justified for a specific tool with a specific risk. As a general approach it mostly moves usage to places you cannot see. Pair any restriction with an approved alternative, and apply data rules at the point of use.

Do paid company accounts remove the risk?

They reduce it a great deal, because a contract and a data processing agreement are in place. They do not stop someone pasting data that should not go into any AI tool. That takes a rule on the data itself.

Is using an unapproved AI tool illegal?

Not in itself. The legal exposure comes from what happens in it: personal data processed without an agreement or a valid transfer mechanism under the GDPR, or an AI system used for a high-risk purpose without what the EU AI Act requires.

Sources

• KPMG and University of Melbourne, Trust, attitudes and use of artificial intelligence: a global study 2025, April 2025.
• Microsoft UK and Censuswide, Rise in shadow AI tools raising security concerns for UK, October 2025.
• Cyberhaven Labs, 2026 AI Adoption and Risk Report, February 2026.
• Harmonic Security, What 22 million enterprise AI prompts reveal about shadow AI in 2025, January 2026.
• IBM and Ponemon Institute, Cost of a Data Breach Report 2025, July 2025.
• Regulation (EU) 2016/679, the GDPR, Article 83.
• Regulation (EU) 2024/1689, the EU AI Act, as amended by Regulation (EU) 2026/1744.

This post is context for a governance decision and not legal advice.