What is shadow AI and how can organisations manage the risks?

Unapproved or unmanaged AI use is often referred to as shadow AI. It can include employees deliberately using tools that have not been approved, as well as AI functionality embedded into software already used across the business. 

According to Deloitte’s 2026 GenAI Workforce Survey, 31% of UK GenAI users use the technology without their employer knowing, 17% pay for at least one work-related AI tool themselves, and 46% use free tools at work. 

Those figures highlight more than an employee compliance problem. They are also a signal that an organisation’s AI governanceThe framework of policies, processes, and roles that ensure Artificial Intelligence (AI) is developed and used responsibly, ethically, and in compliance with applicable laws, societal expectations, and corporate values.  has fallen behind the way people are working. 

Banning certain AI tools is unlikely to solve the problem. In this blog, we explore why shadow AI develops and what controls are needed to manage the risks while supporting legitimate use.  

Key takeaway: Shadow AI is not only about employees using prohibited tools. It can expose gaps in an organisation’s visibility, governance and understanding of how AI is being used. Reducing the risk requires organisations to understand why unapproved use develops and create practical controls that employees can realistically follow.  

• Why does shadow AI develop?
• The risks of shadow AI
• Are AI policies enough?
• How to reduce the risk of shadow AI

Why does shadow AI develop? 

AI adopted outside existing approval routes

One of the main challenges is that employees now have access to powerful tools without needing their employer to provide them. They may use personal subscriptions such as ChatGPT and Claude to summarise documents, prepare meeting notes, analyse information, draft emails, or automate repetitive tasks. 

This makes shadow AI difficult to address through policy or approval routes alone. 

AI added through existing software 

Shadow AI is not always caused by employees deliberately adopting a new tool. AI is increasingly being embedded into existing software, including productivity suites, CRM systems, collaboration platforms, and other SaaS products. 

This means you may have an accurate software inventory but still lack a complete view of where AI is being used or how data is being processed. 

AI governance therefore needs to account for both AI tools adopted outside existing approvals and any changes to products that are already in use.  

What are the risks of shadow AI?

The main risk of shadow AI is loss of visibility and control over how personal dataInformation which relates to an identified or identifiable natural person. and confidential business data is being used. 

GDPR compliance

Where personal data is involved, organisations may be unable to confirm whether the processing is lawful, appropriately secured, or subject to the required contractual and transferThe movement of data from one place to another. This could be, for example, from one data controller to another, or from one jurisdiction to another. safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the....  

Using third parties to processA series of actions or steps taken in order to achieve a particular end. personal data without the required data processing contractual provisions will nearly always amount to a direct breach of the controller-processor obligations of the UK and EU General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. and EU GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation).).  

In the UK, the ICO’s guidance on AI and data protection emphasises a risk-based approach, including assessing risks to individuals and putting appropriate technical and organisational measures in place. 

EU AI Act compliance

Organisations within scope of the EU AI ActThe EU Artificial Intelligence Act was approved by the EU Council on 21 March 2024. A world-first comprehensive AI law, intended to harmonise rules for the development, deployment, and use of artificial intelligence systems across the EU. also need to understand the separate obligations that apply to AI use. Our EU AI Act blog series covers the key compliance requirements and timelines. 

Wider organisational risks

The risks are not limited to regulatory compliance.  

Shadow AI may expose confidential information, intellectual property, or commercially sensitive data. Employees may rely on inaccurate outputs, introduce unassessed security risks, or use AI in ways that conflict with contractual or internal requirements. 

The priority is visibility. Knowing where AI is being used and for what purpose so the level of risk can be assessed.  

Why is an AI policy not enough?

An AI policy can set boundaries, but it cannot guarantee that employees will recognise when a particular use creates risk. 

For example, an employee may understand that they shouldn’t upload a customer database to an unapproved tool but see little risk in asking the same tool to summarise an email chain containing customer details. Similarly, someone using AI functionality built into existing software may not realise that they are using AI at all. 

Employees therefore need practical guidance on: 

• Which tools are approved 
• What information should not be entered into AI systems 
• When a proposed use needs additional approval 
• Where to go for help or escalation 

AI literacy should help employees understand that risk depends on context. The same tool might be low risk when used to rewrite generic copy, but much higher risk when used with sensitive personal data or to support decisions about individuals. 

For organisations within scope of the EU AI Act, this also supports Article 4 requirements to take measures to promote AI literacy among staff and others using AI systems on their behalf. 

The goal is not simply to make employees aware of the rules, but to help them recognise when they need to stop, question a use case, or ask for advice. 

How can organisations reduce shadow AI risk?

The aim is to reduce the gap between how you think AI is being used and how it is actually being used across your organisation. The following steps can help improve visibility and bring AI use into clearer governance.  

• Understand how AI is already being used
  Use employee surveys, software reviews, procurement records, and appropriate technical monitoring to identify which AI tools and features are already in use, and why employees are using them.
• Provide viable approved alternatives
  Make sure employees have access to suitable approved tools and know how to request new tools or use cases where existing options do not meet their needs.
• Make risk assessment proportionate
  Create a triage process that allows low-risk uses to move through approval quickly whilst directing higher-risk proposals towards more detailed privacy, security, legal, or procurement assessments.
• Give employees AI literacy training
  Provide role-based guidance on which tools can be used, what information should not be entered, when approval is required, and where employees can go for help. Training should evolve as new tools are introduced.
• Regularly review tools and use cases
  Maintain an AI inventory and establish triggers for reviewing tools or use cases when their functionality, access, purpose, or risk profile changes.
• Assign clear accountabilityPerhaps the most important GDPR principle, which requires controllers to take responsibility for complying with the GDPR and, document their compliance.
  Unapproved AI use can persist because teams assume someone else is providing oversight. Define who is responsible for coordinating shadow AI governance across different functions so risks do not fall between departments.
• Use proportionate AI approval processes
  Assessments should consider factors such as the data involved, how the provider handles information, and whether outputs could affect individuals. Approval should also focus on the use case, not just the product. Employees should know who to approach, what information they need to provide, and what level of scrutiny to expect. 

The DPO Centre offers a range of AI governance and data protection services, including Outsourced AI Officers, EU AI Act Readiness Assessments, and AI Impact Assessments.

Contact us to find out how we can help your organisation strengthen AI governance and manage AI risk responsibly.

In case you missed it…

• LLMs vs AI agents: Managing different AI risks
• AI Officer vs DPO: Defining roles in AI governance
• AI Impact Assessments: What are they and why do you need one?