What Is Shadow AI? Risks, Detection, and an AI Acceptable Use Policy

Shadow AI is the use of AI tools, models, agents, or AI features by employees or teams without the knowledge or approval of the people responsible for security, privacy, and the data involved. It covers a consumer chatbot on a personal account, an AI note-taker granted access to a corporate calendar, a browser extension that reads every page, and model API credits bought on a corporate card. The exposure is concrete: company data reaches providers whose retention and training terms nobody reviewed, with no data processing agreement (DPA) or business associate agreement (BAA) in place. In the KPMG and University of Melbourne global study of more than 48,000 people in 47 countries, almost half of employees admitted using AI in ways that contravene company policies. The fix is discovery, risk tiering, an AI acceptable use policy, and sanctioned tools good enough that people stop working around the rules.

What counts as shadow AI?

Shadow AI is a subset of shadow IT with two properties that raise the stakes: the tool processes whatever the user pastes or connects, and agentic tools act with the user's own credentials. The table lists each form and the signal that exposes it.

Why does shadow AI happen?

Shadow AI happens because demand for AI outruns the approved supply. A free assistant drafts and summarizes in seconds while a new enterprise tool waits on budget and review cycles, and a ban without an alternative pushes the same use onto personal phones and accounts. Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 knowledge workers in 31 markets that Edelman Data and Intelligence fielded from February 15 to March 28, 2024, found that 75% of knowledge workers used generative AI at work and that 78% of AI users brought their own AI tools to work, rising to 80% at small and medium-sized companies.

Policy and training trail that usage. In the KPMG and University of Melbourne study, fielded from November 2024 to mid-January 2025, 58% of employees said they intentionally use AI at work, but only 40% said their workplace has a policy or guidance on generative AI use, and only 47% said they had received AI training. Over half, 57%, said they hide their use of AI and present AI-generated work as their own. Two structural drivers add to the problem: vendors switch on AI features inside software the company already approved, and a slow or missing request process leaves employees no legitimate path to a new tool.

What are the risks of shadow AI?

Shadow AI risk falls into six groups, most of them traceable to contract terms and permissions nobody reviewed.

Under HHS guidance on cloud computing, a cloud provider that creates, receives, maintains, or transmits electronic PHI for a covered entity is a business associate even if it stores only encrypted data, so a clinician who pastes patient details into a consumer chatbot hands PHI to a vendor with no BAA. Under GDPR Article 28, a controller may use only processors that give sufficient guarantees and must bind them by contract, which an employee's personal AI account never does. On accuracy, the KPMG and University of Melbourne study found that 66% of employees rely on AI output without evaluating its accuracy and 56% have made mistakes in their work because of AI.

The consequences now show up in breach data. IBM's Cost of a Data Breach Report 2026, researched by the Ponemon Institute across breaches at 602 organizations from March 2025 to February 2026 according to IBM's July 29, 2026 release, found that roughly one in five organizations reported an AI-related breach, that 92% of those lacked proper AI access controls, and that only 40% of organizations used access controls on AI models and data, per IBM's X-Force analysis.

How do you detect shadow AI?

No single control finds all shadow AI, so discovery merges network, identity, browser, finance, endpoint, and people signals into one inventory.

Announce the first pass as a census with an amnesty period, because people who expect punishment hide usage.

What do ISO 42001, the NIST AI RMF, and the EU AI Act require?

Each of the three frameworks asks for something shadow AI makes impossible: a complete inventory of AI in use, controlled use, or trained staff.

Article 4 has applied since February 2, 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744 of July 8, 2026, entered into force on July 27, 2026 and replaced the article's text. Providers and deployers now "shall take measures to support the development of AI literacy" of their staff and others operating AI systems on their behalf, and the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual." The duty moved from a result to an effort, and it still reaches any organization whose staff use AI systems for work, because the AI Act defines a deployer as anyone using an AI system under its authority outside personal, non-professional activity. Confirm with counsel how the amended text applies to your EU entities.

How to write an AI acceptable use policy

An AI acceptable use policy works when an employee can apply it in the moment, so it has to answer three questions: which tools are approved, what data each tool may receive, and how to ask for something new. Start with the data rules, because they carry most of the risk.

BD Emerson's outline for a short AI acceptable use policy has nine sections:

1. Purpose and scope: who it covers, contractors included, and which uses count, including AI features in approved software.
2. Approved tools register: the live list of approved tools, each with an owner, permitted data classes, and a corporate account and single sign-on requirement.
3. Data rules: the data class matrix, plus outright bans on credentials, secrets, and regulated data in unapproved tools.
4. Use rules: human review before AI output reaches customers, regulators, courts, or production code, and disclosure where required.
5. Agents, connectors, and extensions: no OAuth grants, browser extensions, MCP servers, or agents with write access without approval.
6. Exceptions: how to request a new tool or use case, who decides, and the response time.
7. Training: the AI literacy training each role completes, which doubles as Article 4 evidence for EU deployers.
8. Monitoring and enforcement: what the company monitors and what happens after a violation.
9. Ownership and review: the policy owner and a review at least twice a year.

The exceptions process decides whether the policy holds. Publish a fixed turnaround, for example ten business days for a standard request, review each request for data classes, vendor terms, and integration scope, and grant time-boxed approvals that expire unless renewed. Both major identity platforms support it: Google Workspace lets admins allow users to request access to unconfigured third-party apps, and the Microsoft Entra ID admin consent workflow lets users request review of apps they cannot approve themselves.

Offer sanctioned alternatives so people stop working around the policy

Blocking holds only when the approved option is nearly as good as the blocked one. Plan for three sanctioned options: an enterprise AI assistant with no-training terms and single sign-on, a governed path for teams that need model API access, and an approved list of extensions and connectors. Where regulated data cannot leave the company's environment, privately hosted open-weight models are a fourth.

Configure the identity layer to steer people toward those options. Microsoft recommends allowing user consent only for apps from verified publishers, and Entra ID can limit user consent to permissions an admin classifies as low impact. Google Workspace can block sign-in to unconfigured third-party apps until an admin reviews them. Pair each restriction with the request flow above, and publish the approved list where employees look first. Route agent connections to internal systems through governed MCP servers with per-server identities, as our Model Context Protocol guide describes.

How do you measure progress on shadow AI?

Track a small set of metrics, and have the AI governance owner review them monthly.

A 30-day plan to get shadow AI under control

Thirty days is enough to move from no visibility to a published policy and a tiered inventory with owners, if the work runs as four weekly sprints. BD Emerson recommends this sequence.

Repeat the discovery pull every month. Vendors add AI features to approved software between contract renewals, so the inventory is only as current as the last pull.

How BD Emerson helps

BD Emerson's AI governance consulting team runs shadow AI discovery, builds the tiered inventory, and writes the AI acceptable use policy and exceptions process. Where certification is the goal, our ISO 42001 consulting practice implements the AI management system and performs internal audits, and an accredited certification body issues the certificate. Our data privacy consulting team runs the vendor privacy reviews and privacy impact assessments that sanctioned tools need, and our guide to building an AI governance framework shows where shadow AI discovery fits in the wider program.

Frequently asked questions

What is shadow AI? Shadow AI is the use of AI tools, models, agents, or AI features without the knowledge or approval of the people responsible for security, privacy, and the data involved. Examples include consumer chatbots on personal accounts, AI note-takers with calendar access, AI browser extensions, and API credits bought on a corporate card. It creates data, contract, and regulatory exposure because nobody reviewed the tool's terms.

What is the difference between shadow AI and shadow IT? Shadow AI is a subset of shadow IT. Both involve unapproved technology, but AI tools process whatever users paste or connect, may retain or train on that content under consumer terms, and can act with the user's credentials when they run as agents or extensions. Those properties make shadow AI harder to find and faster to cause harm than an unapproved file-sharing app.

Is using ChatGPT at work shadow AI? It depends on the account and the approval. A personal ChatGPT account used for work without approval is shadow AI, and OpenAI states that it may use content from its services for individuals to train models unless the user opts out. A ChatGPT Business or Enterprise workspace the company approved is sanctioned AI, and OpenAI does not use those inputs for training by default.

Should we ban generative AI tools at work? A blanket ban rarely holds, because employees move the same use to personal phones and accounts where the company loses all visibility. Block specific high-risk tools, approve an enterprise alternative with no-training terms and single sign-on, publish which data classes each tool may receive, and run an exceptions process with a fixed turnaround so people have a legitimate path to new tools.

What should an AI acceptable use policy include? An AI acceptable use policy should cover scope, an approved tools register, data rules by data class, human review rules for AI output, limits on agents, connectors, and browser extensions, account rules, an exceptions process with a response time, role-based training, monitoring and enforcement, and a named owner with a review cadence. Keep it short enough that employees can apply it in the moment.

Does the EU AI Act require AI literacy training? Article 4 requires providers and deployers to take measures to support the AI literacy of staff who operate or use AI systems on their behalf. It has applied since February 2, 2025, and since July 27, 2026 the amended text states that it does not require a guaranteed level of literacy for any individual. Training records remain the practical evidence. Confirm scope with counsel.

If you're starting a shadow AI program, our AI governance team can run the discovery pull, build the tiered inventory, and draft the policy and exceptions process with your security, privacy, and legal owners.