Shadow AI

The specific and fastest-growing subset of shadow IT involving unsanctioned use of generative AI tools, AI browser extensions, AI meeting transcription tools, or AI coding assistants, adopted without security or governance sign-off. Distinct from other shadow IT channels because data submitted to a third-party AI tool often cannot be recalled once submitted, and because adoption friction is close to zero (a browser tab, no purchase or account approval required).

AI used in the course of the organization's work without being officially approved or listed: a consumer tool a staff member adopted, a feature switched on by a vendor update, an AI function buried in a familiar product. It is not on the inventory, but it still produces risk on the organization's behalf, so literacy must be scoped by actual use, not only by the approved list.

AI tools built or adopted by a business unit outside any governed process, usually because no fast, sanctioned path existed. A signal of a missing or too-slow governed route; the structural remedy is to bring it under standards through a fast-track governed path, not simply to shut it down.

AI systems deployed at department or team level without going through centralized IT, procurement, or compliance review, often through individual SaaS subscriptions or API integrations. Shadow AI is a primary source of undercounting in early-stage AI registers.

Employees using AI tools that are not approved or governed by the business; tied to about 20 percent of breaches and roughly $670,000 of added cost (IBM, 2025), and best controlled in a small business by a written rule plus least access.