Shadow AI
Definition
Shadow AI is the use of AI tools at work without the company's approval or knowledge, such as staff pasting client documents into a personal chatbot account. It creates data risk, and it also shows where people already find AI useful.
By Ronan Liedmeier, fractional head of growth and course author · Published 17 October 2026 · Last updated 17 October 2026
Also called: unsanctioned AI use, BYOAI
The risk is concrete: confidential data ends up in accounts the company does not control, possibly with settings that allow the provider to train on it. The same behavior is also the clearest evidence of which AI uses employees actually want.
How it works
Shadow AI grows when the approved route is slower than the unapproved one: no company account, a long approval queue, or an outright ban.
A workable approach is to legalize it in steps. Ask people what they already use AI for, framed as an amnesty with no penalty for honest answers. Treat the most common uses as proven demand, since they are already adopted. Then offer an approved version with guardrails that is faster than the workaround, so following the rules is the easy path.
Example
A finance manager learns that three people on her team reformat supplier spreadsheets in their personal chatbot accounts. She runs an anonymous two-question survey and finds that reformatting, email drafting and meeting summaries cover most of the use. She sets up a company workspace with training opt-out switched on, adds a shared prompt library for those three jobs, and runs a one-hour session on what data may go in.
Common mistake
Treating shadow AI as a discipline problem. Disciplinary emails and blocked websites teach people to hide their usage, which leaves the data risk in place and removes the information you needed to fix it.
Learn it in AI Academy
- The Operating Model: Making the Organization LearnExpert · 8 min
- Governance That Enables Instead of StranglesExpert · 8 min
Related terms
- AI governance
- AI governance is the set of rules, owners and checks an organization uses to decide which AI uses are allowed, how their risks are handled, and who answers when something goes wrong. In the US, NIST publishes a voluntary framework for it, the AI Risk Management Framework.
- AI training opt-out
- AI training opt-out is a privacy setting that stops an AI provider from using your conversations to train its future models. In consumer chat apps it is usually a toggle in the account's data or privacy settings.
- Prompt library
- A prompt library is a shared, organized collection of prompts that work well, saved with clear names and version notes so you and your team can reuse them instead of rewriting them in every chat.
- AI guardrails
- AI guardrails are checks and limits placed around an AI system that block or flag unsafe or wrong inputs and outputs before they cause harm. The strongest ones run as code outside the model, so a cleverly worded request can't talk its way past them.