Shadow AI governance: control risk without banning useful AI

What counts as Shadow AI?

Shadow AI is AI use outside the organisation’s approved governance path. It can include consumer chatbots used with business data, browser extensions, meeting assistants, unapproved coding tools, embedded AI in SaaS products, personal accounts used for work, or workflows built by teams without security and risk review.

Why blanket bans underperform

When the productivity benefit is obvious and the approved alternative is weak, employees often continue using the tool through personal accounts or copy/paste workflows. That reduces visibility and makes data protection, incident investigation and training harder. A better control strategy distinguishes between low-impact experimentation and higher-risk use.

A four-tier Shadow AI model

Discovery: find the use without creating fear

• Run a short anonymous survey on tools, use cases and blockers.
• Review procurement and expense data for AI subscriptions.
• Use browser/SaaS telemetry where lawful and proportionate.
• Ask managers which AI workflows teams already depend on.
• Review embedded AI features in existing SaaS platforms.
• Create a low-friction route for employees to register a use case without triggering a months-long project.

Build an approved path

The approved path should answer five employee questions quickly: Which tools may I use? What data may I enter? What uses require review? Who owns the output? What do I do if something goes wrong? Keep the first version short and operational. A policy that requires interpretation from Legal for every prompt will not become a working control.

Minimum acceptable-use controls

• No confidential, personal or regulated data in unapproved consumer AI tools.
• No autonomous consequential decisions without defined human review.
• No credentials, secrets, private keys or production data in prompts unless the architecture is explicitly approved.
• Verify material facts, calculations, legal claims and cited sources before external use.
• Respect copyright, confidentiality and contractual restrictions on source material.
• Report suspected data exposure, harmful output or unusual system behaviour through the normal incident route.

Measure whether governance is working

Connect Shadow AI to the EU AI Act

Shadow AI governance is not itself a specific AI Act category, but it supports the organisation’s ability to know what AI is being used, determine roles and intended purposes, apply transparency where relevant, identify potentially higher-risk systems and maintain evidence. You cannot classify what you cannot see.