Shadow AI

The specific and fastest-growing subset of shadow IT involving unsanctioned use of generative AI tools, AI browser extensions, AI meeting transcription tools, or AI coding assistants, adopted without security or governance sign-off. Distinct from other shadow IT channels because data submitted to a third-party AI tool often cannot be recalled once submitted, and because adoption friction is close to zero (a browser tab, no purchase or account approval required).

AI used in the course of the organization's work without being officially approved or listed: a consumer tool a staff member adopted, a feature switched on by a vendor update, an AI function buried in a familiar product. It is not on the inventory, but it still produces risk on the organization's behalf, so literacy must be scoped by actual use, not only by the approved list.

Unapproved AI tools or applications employees use without their organization's IT approval or oversight. IBM's 2025 Cost of a Data Breach Report found shadow AI added an average of 670,000 dollars to breach costs, a real, disclosed benefits-modeling data point for AI governance requirements.

AI tools built or adopted by a business unit outside any governed process, usually because no fast, sanctioned path existed. A signal of a missing or too-slow governed route; the structural remedy is to bring it under standards through a fast-track governed path, not simply to shut it down.

AI systems deployed at department or team level without going through centralized IT, procurement, or compliance review, often through individual SaaS subscriptions or API integrations. Shadow AI is a primary source of undercounting in early-stage AI registers.