What Is Shadow AI and How Does It Work?

Shadow AI refers to any AI tool, model, or capability used inside an organisation that sits outside sanctioned procurement, security review, or governance controls. Consumer applications such as ChatGPT, Claude, and Gemini are the most common entry point, but they're only part of the picture.

What Counts as Shadow AI

The category is broader than most organisations initially assume:

1. Consumer AI tools used for work without IT approval, such as ChatGPT, Claude, Perplexity, or Copilot on a personal account
2. AI features embedded in software that was approved before the AI arrived, a project management tool that quietly added generative AI, a CRM with AI-assisted drafting
3. Browser extensions and plugins with AI capabilities installed locally on employee devices
4. Departmental AI purchases made outside central IT, a marketing team's AI content platform or a finance team's forecasting tool, bought on a card and never registered
5. AI used by third parties who process your data, a supplier that has built AI into its service delivery without disclosing it

The common thread is productivity. Employees don't need bad intentions for shadow AI to create exposure; they find a tool that helps them work faster and use it. What's missing is oversight.

Shadow AI accumulates through dozens of individual decisions, each one feeling low-risk on its own, that add up to a large, untracked surface.

The individual workaround

An employee pastes a contract clause into a free AI tool to get a quick summary. A compliance analyst uses a chatbot to draft a policy section. A risk manager asks an AI assistant to reformat a spreadsheet. None of these feel like a security decision in the moment, yet each one may send business data to an external model with no data processing agreement in place.

The departmental purchase

Teams increasingly have their own budgets and the freedom to buy SaaS tools directly. When AI capability comes bundled into a tool procured outside IT, it bypasses the vendor assessment, data classification review, and contractual controls a central procurement process would normally apply. Under UK GDPR, using a third-party processor without a lawful basis and a Data Processing Agreement is a compliance failure, regardless of intent.

The platform update

Approved tools add AI features continuously. Microsoft 365 Copilot, Salesforce Einstein, Slack AI, and Notion AI sit inside your existing governance because you already approved the platform; the AI capabilities layered on top of them, though, can fall outside the scope of the original data processing review. An organisation that approved a collaboration platform in 2022 may be running AI summarisation across internal communications today without ever having updated its records of processing activities.

The governance gap that catches most teams out sits inside tools that were approved once and have quietly changed since.

The risks of shadow AI are real, and the conversation about them is usually too narrow. Data leakage gets most of the attention. The full picture is wider.

Data and privacy exposure

When employees submit prompts containing personal data, confidential business information, or regulated content to external AI models, that data may be retained, used to train the model, or made accessible to third parties. Many free-tier AI tools state directly in their terms of service that user inputs can be used to improve the model. Cisco's 2025 Data Privacy Benchmark Study found that 42% of respondents have entered non-public company information into a generative AI tool. That's a substantial share of a workforce doing this routinely.

Under UK GDPR, that constitutes a transfer of personal data to a third-party processor. Without a Data Processing Agreement, a lawful basis for processing, and a transfer mechanism where the provider sits outside the UK or EEA, the organisation is in breach. That's true regardless of whether any harm results.

Audit and evidence gaps

For compliance and audit functions, shadow AI creates a records problem. If an employee uses an AI tool to draft a risk assessment, summarise a control test, or produce a supplier evaluation, the output survives, but the reasoning behind it usually goes unrecorded.

This matters under frameworks including ISO 27001:2022, DORA (the EU's Digital Operational Resilience Act), and the EU AI Act, all of which require organisations to show how a decision was made and by whom. An AI-assisted decision with no record of the tool used, the prompt submitted, or the human review applied is an audit finding waiting to happen.

Third-party and supply chain risk

Shadow AI extends into your supply chain too. If a supplier uses AI to process data on your behalf without disclosing it, your third-party risk management programme may never have captured that fact. Vendor questionnaires written before AI's mainstream adoption rarely ask whether AI is involved in service delivery at all, and most TPRM programmes are still catching up.

The attack surface

AI tools introduce their own attack vectors. Prompt injection, model poisoning, and data exfiltration through AI interfaces are documented threat categories. Tools that IT hasn't assessed sit outside the security monitoring perimeter by definition, and an organisation can't detect anomalous behaviour in a system it can't see.

The instinctive response to shadow AI is prohibition: block the tools, issue a policy, send the all-staff email. It's an understandable reflex that fails in practice.

KPMG's 2025 global study on AI trust and attitudes found that 44% of employees have used AI in ways that contravene their employer's policies. A written rule rarely changes behaviour that a productivity deadline is already pushing people toward. Employees who rely on AI to hit their targets keep using it; they just move to personal devices, personal accounts, or more obscure tools that are harder to detect. That's the trade-off: the organisation loses visibility rather than gaining it.

The real objective is to bring AI use inside governance.

Visibility, knowing what AI tools are actually in use, by whom, and on what data, usually starts with a discovery exercise: network traffic analysis, employee surveys, procurement reviews, and updated vendor questionnaires. Policy needs to be proportionate: a rule too restrictive gets ignored, and a rule too vague is useless. And controls are what make compliance realistic in practice: an approved-tool register, AI-specific data classification guidance, DPIA templates for AI use cases, and third-party questionnaires that ask directly about AI in service delivery.

The ICO's guidance on AI and data protection makes clear that organisations are responsible for how AI processes personal data, whether or not the tool was formally sanctioned. Ignorance of what employees are using still leaves the organisation accountable.

Addressing shadow AI is an ongoing governance capability that has to keep pace with a market that moves every quarter. Organisations that treat it as a one-time project, audit once, write a policy, file it, tend to find the problem has already moved on by the time the policy gets published.

An AI asset register tracks every AI tool in use: approved, under review, and flagged. It records the tool, the use case, the data it accesses, the vendor's data processing terms, and the review status. Without it, demonstrating compliance, responding to a data subject access request involving AI-processed data, or assessing exposure under the EU AI Act's risk classification framework all become guesswork.

AI-specific risk assessments treat AI use cases as distinct risk items rather than generic software. A DPIA for an AI tool needs to address model training practices, data retention, output accuracy, and human oversight, questions a standard software procurement review never asks.

Continuous monitoring keeps the register current. New tools appear constantly, approved tools add AI features, and suppliers change how they deliver a service. A programme that reviews AI use once a year is already behind by the time the review happens.

Human-in-the-loop requirements define where AI can act on its own and where a person has to review the output first. This matters most for regulated decisions: credit assessments, risk ratings, compliance determinations. The EU AI Act classifies many of these as high-risk AI use cases with mandatory human oversight built in.

That kind of traceability is what regulators are starting to expect by default.

SureCloud's AI Governance product is built to run this shape of work: an AI asset register covering every AI tool in the business, categorised against the EU AI Act's risk classification framework, alongside AI-specific risk assessments and incident capture that surfaces a problem before it becomes a reportable breach. Inside the platform, Gracie AI Agents with Personas and Skills perform the ongoing register maintenance and evidence collection that continuous monitoring actually requires, so a compliance team reviews exceptions and flagged risks instead of chasing an inventory by hand.

The organisations best placed to manage shadow AI are usually the ones that already run a mature governance, risk, and compliance (GRC) programme: they had somewhere to put a new risk category the moment it appeared. Shadow AI keeps expanding faster than most governance programmes are built to track, and it responds to the same governance discipline everything else in the business already runs on.

Choosing the right detection and governance platform is the next decision. See How to Detect and Manage Shadow AI Usage: A Platform Decision Guide for how the four platform categories compare.