Shadow AI is employee use of AI tools outside sanctioned, governed channels: personal accounts on approved products, entirely unapproved tools, and AI features embedded in software that was approved before those features existed.
Three forms
The third is the one most organisations miss.
Personal accounts on approved tools
You have an enterprise tenant with a DPA and no-training terms. An employee is logged into their personal account in another browser profile. Your contract governs the tenant; their session is outside it entirely.
Unapproved tools
A new AI product launches, does one job exceptionally well, and someone starts using it. It is on no list because nobody has heard of it yet.
AI features inside approved software
The subtle one. Your note-taking app, CRM, design tool and helpdesk all shipped AI features after you approved them. The vendor is approved; the data flow to a model provider is new.
And it arrives without a decision
Nobody signed off on the third form. It appeared in a release note.
Not the same as shadow IT
Shadow IT hid where data was stored, not where it went.
Shadow IT was mostly about where data was stored: an unsanctioned sync tool holding documents somewhere unknown. That is bounded and discoverable: find the tool, migrate the data, revoke access.
Shadow AI is about what data was disclosed, once, in a message. There is no repository to discover afterwards. The disclosure has already happened, and deleting the conversation does not undo it.
The discovery techniques differ too. Finding an unsanctioned SaaS app means looking at OAuth grants and DNS. Finding shadow AI means looking at what was typed, which most of the stack cannot see.
Why it resists measurement
The properties that make it hard to find.
- 01
Domain lists go stale
Any list of AI tools is incomplete by the time it ships.
- 02
The interface is generic
A textarea and a send button look identical across every tool, sanctioned or not.
- 03
No artefact is left behind
Nothing appears in a file system, a sync log or an OAuth grant.
- 04
Blocking hides it
Block the domains and usage moves to personal phones where you have no telemetry. Visibility drops; exposure does not.
What actually helps
Mostly, a good sanctioned tool.
Distinguish destinations rather than treating all AI traffic identically: the same card number is a different event depending on where it went. Detect at the composer rather than the network, so you see content and not just connections. Flag submissions to unrecognised hosts that look like AI interfaces, which turns an unbounded unknown into a triage queue.
Above all, give people a sanctioned tool that is genuinely good enough for the work. Most shadow AI is not defiance; it is someone trying to finish a task with the best tool they could find.
Questions
How is shadow AI different from shadow IT?
Shadow IT was mostly about where data was stored: an unsanctioned tool holding documents somewhere unknown. That is bounded and discoverable. Shadow AI is about disclosure: the data has already been handed to a third party, and finding the tool afterwards does not undo it.
Can we just block the AI tools we have not approved?
You can, and the behaviour moves to a personal phone where there is no visibility at all. Blocking is a reasonable control for a small number of genuinely unacceptable destinations and a poor strategy for the category as a whole.
Why do domain lists go stale so quickly?
Because any list of AI tools is incomplete the week it is written. New tools launch constantly, existing products add assistants, and a feature inside a tool you already allow is not a new domain at all.
How do we find out what is actually being used?
Discovery that reports hostnames from the device, rather than a survey or a procurement list. What people say they use and what the fleet shows are usually different, and the second is the one a policy has to be written against.
Is shadow AI always a policy violation?
Usually not. Most of it is somebody doing their job with the fastest tool available, which is why punitive framing fails. The useful question is which uses carry regulated data, not which uses were unapproved.
What is the first thing to do about it?
Find out the scale before deciding the policy. A rule written against a guess is either too strict, in which case it is routed around, or too loose, in which case it changes nothing.
Keep reading
- The answer Does ChatGPT train on pasted company data? What the enterprise agreement actually says, and the five risks that survive a no-training clause. 6 min read
- Product Itzal Lens Finds where sensitive data already lives and which AI tools are already in use. Product page
- Product Surface coverage An honest coverage matrix for AI DLP: which surfaces Itzal inspects, which it doesn't. Product page
- Discovery Finding shadow AI Four ways to find out which AI tools your staff actually use, what each one misses, and why the survey is the least reliable of them. 7 min read