Shadow AI: What It Is and How Small Teams Take Control

Start with 4 places to look for shadow AI: unapproved apps, browser extensions, personal accounts and AI features inside software you already use. Then give each discovered use a decision and a workable approved alternative. A blanket ban without a usable path leaves the work that drove people to AI unresolved.

What Is Shadow AI?

Shadow AI is the use of AI for work without the company's approval or oversight. It can be a new application, an employee's personal account, an extension attached to a browser, or an AI feature inside an otherwise approved service. The defining issue is the missing organizational decision about that use. IBM's definition of shadow AI describes the same gap between employee adoption and organizational oversight.

Think of your business as a market with several entrances. Approving the main entrance does not tell you what passes through a side hatch or a counter inside another stall. Likewise, approving a software vendor does not automatically approve every AI feature, account or connection associated with it.

A paid personal subscription can still be shadow AI. A company email address can still belong to an account nobody reviewed. Conversely, an unfamiliar tool can become an approved tool after you assess its actual use and establish the boundaries.

Where Shadow AI Hides: Four Everyday Examples

Look at how work gets done, including the steps that never produce a purchase request. These are illustrative situations, not reports of incidents at named companies.

Unapproved Apps: The Extra Upload

An operations coordinator downloads a customer spreadsheet and uploads it to an AI analysis website to explain a change in orders. The useful task is analysis. The unanswered question is whether that website may receive the customer records.

Look for: document summarizers, transcription services, coding assistants and analysis tools used outside your approved list. Include desktop and mobile apps as well as websites.

Ask: what was uploaded, under which account, and why the existing workflow did not meet the need? A safer replacement might use an approved account and an aggregate export that leaves customer identities out.

Browser Extensions: Access Beyond the Prompt

A salesperson installs an AI writing extension and allows it to read pages in the customer relationship management system, or CRM. They may think they approved help composing emails; the extension's permissions may cover more page content.

Look for: installed extensions and their actual site-access settings. Google documents that extension permissions can allow access to site content and other browser resources. That permission establishes potential access; it does not prove that an extension transmitted every page it could read. Chrome's extension-permission guidance.

Ask: which sites can it access, what does it send to its provider, and can the useful function work with narrower permissions? Approve the extension separately from the main AI service it connects to.

Personal Accounts: The Right Brand, Wrong Workspace

A support lead uses a familiar AI assistant through a personal login to summarize a complaint thread. The company might already have approved that vendor's business service, but the employee is outside the approved workspace.

Look for: the account and workspace shown during the task, who owns the subscription, and who can remove access when someone leaves. Reimbursement alone does not establish company control.

Ask: can the employee demonstrate the approved destination before copying work material? If switching accounts is confusing, show the correct route during onboarding and provide a clear bookmark or launch link.

AI Features Inside Approved SaaS: The Quiet Expansion

SaaS means software delivered as an online service. Imagine a team enabling an AI meeting-summary feature inside its existing conferencing service, or connecting a CRM assistant to customer records. The parent application was approved; the new processing or access may never have been reviewed.

Look for: AI feature settings, integrations, meeting assistants and changes to what existing services can read or do. Ask application owners what they enabled, even when no new invoice appeared.

Ask: does the original approval cover this feature, these inputs, the resulting transcript or summary, and its recipients? Keep an already approved use running when those boundaries still match. Review a material expansion before treating it as routine.

Why People Use Unapproved AI

Start by finding the job people are trying to finish. A support queue is growing, a report is due, or the approved software cannot handle the task conveniently. Easy access and unclear approval routes make a personal tool an attractive shortcut. IBM also identifies productivity and faster problem-solving as drivers of adoption outside oversight. Shadow AI causes.

For an owner, the consequence is that the company can acquire a data-handling practice without making a conscious decision. For an operations lead, a hidden workaround can become part of a critical process before anyone knows who owns it.

Ask what would let the employee do the same useful work within your rules. Sometimes the answer is an approved tool. Sometimes it is access to a tool you already have, a better export, or a faster answer to an exception request.

Shadow AI Risks: Judge the Data and the Action

Prioritize uses by what they expose or can change. An unapproved assistant rewriting a public announcement presents a different problem from an unknown service receiving payroll files.

There are several distinct questions:

• Data disclosure: Did company or customer information reach a service that was not approved to receive it?
• Storage and access: Who can retrieve the content, how long is it kept, and can the company manage its deletion or sharing?
• Training: Can the provider use the content to improve its models? This is separate from processing a request or keeping chat history.
• Business consequences: Could an unchecked answer mislead a customer, alter a record or cause another consequential action?

A suspected exposure warrants investigation. It does not establish that information became public or entered model training. Record what happened before describing its consequences.

Shadow AI Agents Add Permission to Act

An AI agent is software that can use tools to perform tasks. An unapproved assistant that drafts a reply and one that can send it need different controls.

For a hypothetical sales workflow, permission to read a prospect record should not silently become permission to email every contact or update deal stages. Record read access, write access and the person who approves consequential actions. A builder should keep credentials and production permissions out of an experiment until that scope has been reviewed.

Shadow AI Detection Without a Security Department

Begin with staff conversations and the business records you already control. You need a useful inventory before you need a new monitoring product.

How to Detect Shadow AI

Ask each functional lead to demonstrate where AI touches their work, using invented or public material. Include contractors and managers. Ask specifically about rewriting, summarizing, meeting notes, spreadsheets, code and automated actions; “Do you use AI?” is easy to interpret too narrowly.

Then reconcile their answers with authorized records: company card expenses, subscriptions, installed work-device extensions, application integrations, available sign-in records and enabled AI features. A missing expense does not rule out a personal account or a bundled feature.

For a Chrome extension, right-click its icon and choose Manage Extension. Inspect the listed permissions and site access, and ask the application administrator to restrict or remove access that is unnecessary. Review the extension's own data terms before deciding whether its requested access is acceptable. Google's extension documentation.

Keep discovery focused on work use. Ask people to identify the service, account type and data categories; do not ask them to paste sensitive conversations into a shared survey or hand over personal passwords.

A compact inventory entry can read:

Support drafting; support lead owns it; personal AI account; complaint threads pasted manually; no automated sending; awaiting review; move drafting to the approved workspace and assess prior uploads.

Record where you have not looked. Staff answers and available logs give partial coverage; they cannot prove that every use has been found. Investigate discrepancies and repeat the check when accounts, integrations or workflows change.

A One-Page Shadow AI Response Plan

Give the owner or operations lead responsibility for this worksheet. The application administrator or outsourced IT provider can handle settings and access changes. You do not need to create a committee to assign a decision and follow it through.

Scope: AI used for company work, including embedded features and contractor use.
Owner: the person who can approve a use, require changes and stop it.
Record: one shared inventory, with restricted access to incident details.

Suspected exposure takes priority: stop further sharing through the affected route, restrict the relevant access and record the service, account, time, data categories and available evidence. If a password or access token was exposed, have its owner revoke or rotate it. Preserve evidence securely before removing conversations or connections where practicable. Use your existing incident contact or outsourced IT support to assess impact and any contractual or notification duties; do not assume deletion proves the data was never retained.

Review: check unresolved uses weekly during rollout, then set a recurring review suited to the business. A monthly check is a practical starting point. Reopen a decision when the data, purpose, account or permissions change.

Use the AI acceptable use policy template for the employee-facing rule. The AI governance framework explains the broader ownership and evidence process. This worksheet coordinates the response; those pages supply the supporting documents.

What an Approved AI Tool Path Looks Like

An approved path starts with a company-controlled account, a task it can perform, permitted inputs and a named reviewer. Business-data training protections are a useful entry condition. They are not permission to upload every file.

The following commitments were verified against the makers' live documentation on 20 October 2026. Each applies to the covered business service and its terms. Training, retention, sharing and third-party connections remain separate checks.

ChatGPT Business: Use the Company Workspace

OpenAI ChatGPT Business, a team workspace for the ChatGPT assistant, excludes business customer content from model training by default. OpenAI's governance guidance treats conversation history and retention as separate issues and calls for decisions about integrations and sharing. OpenAI's business-data governance guidance.

Approve the named workspace and the tasks allowed within it. Have staff confirm they are in that workspace before using internal material, and review app connections separately.

The limitation: Exclusion from training does not mean chat history is never stored. Confirm the retention, sharing and audit controls available in the plan you use. Do not promise a deletion schedule or transcript audit you have not established.

Claude Team: Control Feedback Sharing

Anthropic Claude Team, the organizational version of the Claude assistant, falls under Anthropic's commercial-data commitments. Commercial inputs and outputs are not used to train its models by default. Explicit feedback or bug reports, or other chosen data sharing, can permit chats and coding sessions to be used for training. Anthropic's commercial training policy.

Give staff the company organization and specify which documents belong there. The owner can disable thumbs-up/down feedback through Organization settings > Data and Privacy > Rate chats, as described on the same policy page.

The limitation: “No training by default” should not become “every sharing action is covered by that default.” Set the feedback rule explicitly and review integrations before attaching company sources.

Microsoft 365 Copilot: Review Existing File Access

Microsoft 365 Copilot, Microsoft's assistant for work across its productivity services, is now called Microsoft Copilot in current documentation; some licenses and experiences retain the older name during the transition. Microsoft says prompts, responses and data accessed through Microsoft Graph, its connection to work information, are not used to train foundation language models. Microsoft's organizational privacy documentation.

Confirm the covered company account and service. Review who can access relevant documents before enabling a workflow across them.

The limitation: Copilot can surface organizational information the user already has permission to view. It does not repair an overly broad file-sharing arrangement. Microsoft also documents stored interactions and separate considerations for web search and third-party agents. Review those features within the proposed use.

Gemini for Workspace: Confirm the Covered Service

Google Gemini for Workspace, AI assistance used through Google's business productivity services, has protections scoped to qualifying Google Workspace editions. Google's privacy hub says covered prompts, Workspace content, webpage context and generated responses are not used to train generative AI models without permission. Google Workspace's generative AI privacy hub.

Have the administrator confirm that the intended Gemini service and account fall under those Workspace commitments. Do not transfer that assurance to a personal Google account merely because the assistant has the same name.

The limitation: Google documents different retention arrangements across Gemini services and administrator controls. The training restriction does not mean conversations disappear after use. Record the actual service's retention and sharing configuration before approving sensitive work.

Make the Approved Route Easier to Follow

Choose a service that handles the work people disclosed. If staff need help summarizing documents, demonstrate that task with permitted sample material and a clear review step. An account invitation alone does not show them how to replace their workaround.

Publish the exact workspace or service, allowed inputs, prohibited uses and questions contact together. Give exception requests an owner and a response deadline you can meet. When a request cannot be approved, explain the blocked data or permission and offer a narrower way to accomplish the task.

What to Do Now, and What Can Wait

Owners: act now on unknown uses involving customer records, confidential employee material, credentials or automated actions. Name the person who can stop the affected route and make the approval decision.

Operations leads: fix access and workflow friction alongside the rules. Resolve the task that drove the workaround, then confirm staff can use the replacement.

Builders: review repository access, connected accounts and action permissions before extending an assistant into an agent. Approval to draft does not authorize production changes.

Teams already within an approved scope: keep routine work moving when the account, data, purpose and permissions remain covered. A dedicated discovery platform can wait while a manageable inventory and existing controls meet your needs; consider additional tooling when you cannot maintain that visibility reliably.

What's Overhyped About Shadow AI?

A discovered tool is evidence of a use you need to understand. It is not, by itself, proof of a data breach, deliberate misconduct or model training on company secrets.

The opposite shortcut is equally weak: buying a business plan does not finish the job. It leaves account selection, permissions, retention, employee behavior and output review to resolve.

Nor does a ban remove the underlying demand. A support lead still needs to clear the queue. Pair restrictions with a practical approved method, and make it easy to report a mistake promptly.

Judge progress by whether you can explain the important workflows and their boundaries. A growing inventory during discovery can mean visibility is improving, rather than that behavior suddenly became worse.

Frequently Asked Questions

What exactly is shadow AI?

It is AI used for company work outside organizational approval or oversight. It includes unapproved applications, extensions, personal accounts and unreviewed AI features inside existing software.

Why is shadow AI a problem?

The company cannot assess data handling, access or business decisions it does not know about. The response should depend on the actual inputs and permissions, rather than treating every unknown use as equally serious.

What is shadow AI usage?

It is the specific work being done through an unapproved AI route. Record the task and account: “support summaries in a personal workspace” is more useful than recording only a vendor name.

What is shadow IT in cyber security?

Shadow IT is work technology used outside organizational knowledge or approval. Shadow AI is the AI-specific part of that broader issue, including AI features within approved technology.

What to never say to AI?

Keep passwords, access tokens and private keys out of prompts. Do not supply confidential customer or employee material unless the specific account and task are approved for it. Use invented examples when identities are unnecessary.

What is a scary fact about AI?

An assistant or extension may have access beyond the text someone deliberately types. Check connected sources and browser permissions instead of assuming a short prompt means little information is involved.

What is the IQ of AI today?

A single IQ number is not a useful approval criterion for different AI tools and tasks. Evaluate the intended work, errors, data access and review requirements before relying on a system.

How to make shadow in AI?

If you mean a visual shadow in an image, that is an image-editing task. Shadow AI in a business context refers to unapproved use of AI, not an image effect.

What is Shadow Work AI?

If you mean an AI application for reflection or journaling, that is a different use of the phrase. The workplace issue here is whether a service has been approved for company work and data.

What did Stephen Hawking warn us about AI?

In his Cambridge speech on 19 October 2016, Hawking discussed powerful AI's potential benefits and dangers, including autonomous weapons and oppressive uses. That long-term warning is separate from assessing a particular workplace data exposure. Cambridge's speech transcript.

The Monday Move

Ask your functional leads to show where AI enters their work. Start with the unknown use involving the most sensitive information or greatest ability to act. Assign its decision to a person, provide a usable approved route and demonstrate the replacement with safe sample data.

Then publish the employee rule with the approved-account list and reporting contact. Leave the meeting with named actions and unresolved questions, rather than an assurance that buying accounts solved the problem.

For practical guidance on running AI inside a business, join the newsletter.