What is shadow AI?
Also known as: unsanctioned AI, rogue AI tools
Shadow AI is the use of artificial-intelligence tools that an organization's IT and security functions have not sanctioned or are unaware of, from an employee pasting data into an unapproved chatbot to a team wiring its own agent into company systems. It is the AI form of shadow IT, and it carries data-exposure and compliance risk precisely because the usage is invisible and therefore unassessed.
Shadow AI spreads the same way shadow IT did, only faster, because signing up for an AI assistant takes minutes and no procurement conversation. The risk is not that people use AI. It is that this particular usage is invisible, so the data it touches and the exposure it creates are never assessed.
That is why control starts with discovery rather than policy: a tool nobody knows about cannot be governed. Once usage is visible, an organization can decide what earns a place under proper oversight and what should be retired.
