What is shadow AI? How to see which AI tools your people actually use

What is shadow AI?

Shadow AI is any AI tool, feature or agent that people use for work without their company’s knowledge or approval. It is the AI form of shadow IT, and it usually starts with good intentions: someone finds a tool that saves them an hour and keeps using it.

It shows up in four main forms:

• Personal accounts on public AI tools. Someone pastes a contract into a free chatbot account to get a summary.
• Browser extensions and plugins. Someone adds a writing or meeting helper to a work browser, often with permission to read every page.
• AI features inside approved apps. Software the company already uses adds an AI assistant, and someone switches it on before anyone has reviewed it.
• Agents and skills connected to company systems. Someone connects an AI agent to the CRM or a shared drive, or installs an AI skill from a public registry.

What defines shadow AI is the missing knowledge or approval. The same chatbot can be approved on a company account and shadow AI on a personal one, because the terms differ. OpenAI, for example, says it doesn’t use inputs from its business plans to train its models by default, while its personal plans share data for training unless the user opts out.

A related idea is bring your own AI, or BYOAI, the term Microsoft and LinkedIn use for AI tools people bring to work that their employer didn’t provide. BYOAI isn’t always against the rules. It becomes shadow AI when the company doesn’t know about it.

How common is shadow AI?

Very common. Exact figures depend on who was asked and how, but four recent studies point the same way.

Check how each figure was measured before you repeat it. Most are self-reported, and the questions differ. Microsoft’s figure counts any AI tool an employer didn’t provide, which isn’t always forbidden, and Microsoft sells AI tools to employers. The breach study was run by the Ponemon Institute and sponsored by IBM, which sells security services. KPMG helped fund the Melbourne study, which the university’s researchers ran independently.

The true share is probably higher, because people hide their use. In Microsoft’s survey, 52% of people who use AI at work were reluctant to admit using it for their most important tasks. In the Melbourne study, 57% of employees said they had used AI in non-transparent ways, such as presenting AI-generated work as their own, and the researchers note that their figures may understate such behavior.

Most of it is well-meant. In Microsoft’s survey, 68% of people said they struggle with the pace and volume of their work, and only 39% of AI users had received AI training from their company. In the Melbourne study, 56% of employees said they had used AI tools at work without knowing whether it was allowed. Much of shadow AI is unmet demand and unclear rules.

What are the risks of shadow AI?

Four risks matter most, and each one grows the less you can see.

• Sensitive data leaves the company. In 2023, Samsung found that staff had uploaded sensitive code to ChatGPT, and it banned employees’ use of generative AI tools. Consumer AI services can use what people type to improve their products. Google’s privacy hub for its Gemini apps says human reviewers read some conversations, and asks users not to enter confidential information they wouldn’t want a reviewer to see.
• Tools nobody has checked. An unvetted tool can send data anywhere and hold permissions nobody meant to grant. In December 2025, Ars Technica reported that eight free browser extensions with more than 8 million installs, such as VPNs and ad blockers, were capturing users’ complete conversations with ChatGPT, Claude, Gemini and other assistants. Skills and agents from public sources carry similar risks.
• Uneven quality. When each person uses their own tool in their own way, there is no shared standard for checking the output. In 2023, a New York lawyer turned to ChatGPT for legal research because his firm’s research service had limited access to federal cases. The brief cited six cases that didn’t exist, and a federal judge fined two lawyers and their firm $5,000 in total. In the Melbourne study, 66% of employees said they had relied on AI output without evaluating it.
• Compliance and cost. Privacy law, client contracts and industry rules limit where data may go. A tool nobody approved has no company contract, no security review and no audit trail. In IBM’s 2026 study, breaches involving shadow AI cost an average of $5.39 million, against $4.99 million for all the breaches studied, and in about one in five of these incidents, the organization reported paying a regulatory fine.

One more cost rarely makes the risk register. When a good workflow lives in one person’s private account, nobody else learns from it, and it leaves when they do.

Why do bans on AI tools usually fail?

Banning AI tools feels safe, but it rarely stops their use. Mostly, it moves the use out of sight.

The clearest evidence comes from the Melbourne study. Employees whose employers had banned generative AI were the most likely to say they had used AI against policy, for example by uploading company information to public tools.

The researchers’ own reading is that “outright bans may be ineffective.” Gartner’s finding that 69% of organizations suspect or have evidence of prohibited AI use points the same way.

Bans fail for practical reasons. A ban on company devices and networks doesn’t reach personal phones and laptops; Samsung’s memo could only ask staff not to upload sensitive business information from their personal machines. Microsoft’s documentation for its own security tools notes that because employees reach apps from outside the corporate network, firewall rules alone are no longer enough. And a ban teaches people to hide what they use, so you lose sight of both the risk and what is working.

Samsung has since changed course. In June 2026, its Device Experience division began allowing employees to use ChatGPT, Gemini Enterprise and Claude. The company said it wanted to give people more freedom to pick the tools best suited to their work.

Targeted blocks still have a place. Block what is clearly unsafe, such as an extension that can read every page, and point people to an approved tool that does the same job.

How do you detect shadow AI and see which tools people use?

There are six main ways to find out. Each shows part of the picture, and each asks for a different amount of trust from your people.

Ask people. It is the only source that tells you why a tool is used and what for, and the only one people take part in by choice. A short survey or a few conversations with each team can surface tools no log shows, as long as answers are safe to give. Promise no penalty for past use, because people undercount what they think will get them in trouble.

Check the records you already keep. Expense reports and purchasing records show paid tools. Sign-in and app-access logs show which apps people use with work accounts; Google Workspace, for example, lists the apps that have accessed a company’s Google data and what each one can reach. Browser management can list the extensions on company-managed browsers, as Chrome Enterprise does, though not on personal ones.

Network and SaaS management tools match traffic against a catalog of known apps. Microsoft says the catalog in its Defender for Cloud Apps includes more than a thousand generative AI apps, and that by default it can’t discover apps that aren’t in the catalog. Some tools go further and inspect what people type into AI apps to stop sensitive data from leaving. That can catch real leaks, but it reads people’s words, so reserve it for clear risks and tell people it is there.

How do you look for shadow AI without eroding trust?

Run discovery in the open, and agree the approach with your people or their representatives before it starts. Its purpose is to learn what people need, and that only works if they keep telling you.

Data protection regulators expect the same. The UK Information Commissioner’s Office says employers must tell workers about monitoring, except in very exceptional circumstances, and must “select the least intrusive means” to achieve their purpose. It also warns that unfair monitoring damages trust between employers and workers. In Germany, a works council has a right of co-determination over technical devices designed to monitor employees’ behavior or performance. Check the rules wherever you operate.

The last item matters most. When people see that telling you about a tool leads to better tools rather than blame, each round of discovery gets easier.

What should an AI acceptable use policy include?

Keep it short enough that people read it. A good AI acceptable use policy answers four questions: which tools are approved, what data each may handle, how to ask for something new, and who decides.

Sort tools into three tiers, then add a few data rules that anyone can apply without calling a lawyer.

Answer requests fast. The longer a request waits, the more likely people are to find a workaround. Give requests one front door, a named owner and a target answer time measured in days. The plumbing often exists already: Google Workspace, for example, can hold apps people have asked to use for an administrator to review. Gartner advises CIOs to audit regularly for shadow AI and to add AI risk to how they assess software.

Make the approved tools good. People pick the tool that helps them most. Netskope, a security company, found that across its customers the share of AI users on personal accounts fell from 78% to 47% in a year, while the share using company-managed accounts rose from 25% to 62%. Many people use both, so keep checking.

Keep the list current. AI tools and features change quickly, so review the list on a schedule. NIST’s AI Risk Management Framework calls for mechanisms to inventory AI systems; keep the list of tools next to your inventory of agents and the way you oversee them. See our guide to AI agent observability and governance.

How do you turn shadow AI into shared skills?

Treat shadow AI as a map of where people need help. Each unapproved tool marks a job the approved tools don’t do yet, and often a person who has already worked out how AI can do it.

The New York law firm took the replace route. The need behind the shadow tool was federal case research. Once the fake cases came to light, the firm expanded its subscription to its research service and added legal training, according to the court.

The bigger prize is the know-how. The person who built a clever workflow around an unapproved tool is often one of your most advanced AI users. Ask them to write it down as an AI skill, run it in an approved tool, test it on past cases, and share it with every team that does the same work. They become the expert others learn from.

Some needs are bigger than a skill. When several teams ask for the same thing, decide whether to build, buy or forego a proper solution. Either way, keep the approved list, the skills library and agent oversight in one system of AI governance, so you can see what people use, what works and what each tool is worth.

Sources

1. “What if I want to keep my history on but disable model training?” OpenAI Help Center, accessed October 4, 2026.
2. “AI at Work Is Here. Now Comes the Hard Part (2024 Work Trend Index Annual Report).” Microsoft and LinkedIn, May 8, 2024.
3. Nicole Gillespie, Steve Lockey, Tabi Ward, Alexandria Macdade and Gerard Hassed. “Trust, attitudes and use of artificial intelligence: A global study 2025.” The University of Melbourne and KPMG, April 2025.
4. “Gartner Identifies Critical GenAI Blind Spots That CIOs Must Urgently Address.” Gartner, November 19, 2025.
5. Ponemon Institute. “Cost of a Data Breach Report 2026.” IBM, July 29, 2026.
6. Mark Gurman. “Samsung Bans Staff’s AI Use After Spotting ChatGPT Data Leak.” Bloomberg, May 1, 2023.
7. “Gemini Apps Privacy Hub.” Gemini Apps Help, Google, accessed October 4, 2026.
8. Dan Goodin. “Browser extensions with 8 million users collect extended AI conversations.” Ars Technica, December 17, 2025.
9. Judge P. Kevin Castel. “Mata v. Avianca, Inc., No. 22-cv-1461 (PKC): Opinion and Order on Sanctions.” U.S. District Court for the Southern District of New York, via Justia, June 22, 2023.
10. Sara Merken. “New York lawyers sanctioned for using fake ChatGPT cases in legal brief.” Reuters, June 22, 2023.
11. Jon Porter. “Samsung tells employees not to use AI tools like ChatGPT, citing security concerns.” The Verge, May 2, 2023.
12. “Discover and manage Shadow IT.” Microsoft Defender for Cloud Apps documentation, Microsoft Learn, accessed October 4, 2026.
13. Nam Hyun-woo. “Samsung Electronics to introduce ChatGPT, Gemini, Claude in operations.” The Korea Times, June 11, 2026.
14. “Control which apps access Google Workspace data.” Google Workspace Admin Help, accessed October 4, 2026.
15. “View app and extension usage details.” Chrome Enterprise and Education Help, Google, accessed October 4, 2026.
16. “How do I discover AI apps and the sensitive data these use in my organization?” Microsoft Learn, accessed October 4, 2026.
17. “Data protection and monitoring workers.” Information Commissioner’s Office (UK), October 3, 2023.
18. “Works Constitution Act (Betriebsverfassungsgesetz), Section 87: Co-determination rights.” Federal Ministry of Labour and Social Affairs, Germany (English translation), via Gesetze im Internet, accessed October 4, 2026.
19. “Cloud and Threat Report: 2026.” Netskope Threat Labs, January 6, 2026.
20. “Artificial Intelligence Risk Management Framework (AI RMF 1.0).” National Institute of Standards and Technology, NIST AI 100-1, January 26, 2023.