Blog · Shadow AI · Risk
Shadow AI: the risks you cannot see and how to bring them into the light
10 September 2026 · 5 min read · By LeadAI
Somewhere in your organisation, someone is pasting a customer email, a contract clause or a block of source code into an AI tool you have never reviewed. They are not being careless on purpose. They are trying to finish the work faster. That is shadow AI: any use of AI that your organisation has not approved, recorded or controlled. It is one of the most common gaps we see, and one of the easiest to underestimate because you cannot see it.
How common is it?
Surveys differ in method and definition, so read the direction rather than the decimals. They all point the same way:
- A June 2026 PagerDuty survey of 1,250 office professionals at large companies in four countries found that about two-thirds had used AI tools at work that they believed were not permitted.
- The 2026 Verizon Data Breach Investigations Report, as reported by industry commentators, found unapproved AI use among employees tripling in a year, from 15% to 45%.
- Netskope research reports that roughly half of generative AI users at work rely on personal, unmanaged accounts.
- Cyberhaven reports that around four in ten data movements into AI tools involve sensitive data.
Most of these figures come from security vendors and should be treated as indicators, not precise measures. The pattern is clear enough to plan around.
Four faces of shadow AI
| Type | Example |
|---|---|
| Personal accounts on public tools | A manager summarises a board paper in a free chatbot using a personal login. |
| Unapproved apps, plugins and extensions | A browser extension that "improves" every email, reading each one. |
| AI features switched on inside approved software | A vendor enables an AI assistant in a tool you already pay for, with new data flows nobody reviewed. |
| Self-built automations and agents | A team connects a low-code agent to a shared drive using a personal API key. |
The third and fourth types are often missed. Shadow AI is not only about staff and chatbots.
The main risks
| Risk | What it looks like | Who feels it |
|---|---|---|
| Confidential data leaves the building | Customer records, contracts, unpublished plans or source code are pasted into a tool with unknown retention and training terms. | Security, legal, customers |
| Personal data and the law | Data goes to a provider with no data processing agreement, possibly abroad. That raises GDPR and KVKK questions, including cross-border transfer. | Data protection, legal |
| Intellectual property | Trade secrets go in. Outputs with unclear rights come out and get used. | Legal, product, editorial |
| Wrong answers used as facts | A fabricated figure, quote or citation reaches a customer, a decision or a publication with no review. | Operations, editorial, brand |
| Security exposure | Over-permissioned connectors, forgotten API keys, malicious plugins and prompt injection into tools that can act. | Security, IT |
| No record, no control | You cannot answer a regulator, an auditor or a customer who asks what AI you use and with which data. | Everyone, at the worst moment |
The last risk is the quietest and often the most expensive. A leak you can see can be investigated. A flow you did not know existed cannot even be scoped.
Why bans do not work
A blanket ban feels decisive, but it usually pushes use out of sight. People need to hit targets, official tools often arrive slowly or feel limited, and many staff are not sure what the policy actually says. When the sanctioned route is slower than the personal one, the personal one wins. Treat shadow AI as a signal. It tells you where people need better tools, clearer rules and faster decisions.
A five-step plan
1. Find it. Use two lists, as in our guide to building an AI inventory. The declared list is what teams register. The discovered list is what you find: expense claims for AI subscriptions, sign-in and app permission grants, browser extensions, API keys, network and cloud logs, and the AI features vendors have switched on. Consider a 30-day "tell us what you use" window with no blame.
2. Triage every finding. Make one decision per tool: approve, approve with conditions, replace, or stop. Record the reason and an owner.
3. Offer a better route. Publish a short approved tools list and give people enterprise accounts that protect company data. Set a clear target for answering new tool requests, so that asking is faster than working around the rules.
4. Write rules people can follow. Sort data into three groups: public, internal and restricted (including personal data and confidential sources). Say what may go into which kind of tool. One plain page works better than twenty.
5. Teach and keep checking. Train staff on what the rules are and why. Then compare the declared and discovered lists every quarter. The gap between them tells you how well policy matches practice.
Four measures worth tracking
- Number of unapproved tools found, and how many have a decision.
- Time from request to decision for a new tool.
- Share of AI systems in the inventory with a named owner.
- Share of staff who have completed AI training.
Where ISO/IEC 42001 fits
An AI management system depends on knowing what AI you have. You cannot scope, assess or control what you have not found, and shadow AI is exactly that. ISO/IEC 42001 gives you the pieces to deal with it systematically: a policy, defined roles, an inventory, rules for the use of AI systems, supplier management, awareness and training, monitoring and regular review. The same discipline applies to autonomous tools, which we cover in our note on giving every AI agent an ID badge. For how this fits a certification path, see our ISO 42001 guide.
Start this week
Pick one team and ask three questions: which AI tools do you use, what data goes into them, and what would make it easier to use an approved tool instead? The answers will give you your first real picture, and your first practical fix.
For a broader view, take the free AI Readiness Check, or see how the LeadAI Assure journey turns discovery into an inventory and evidence.
This article gives general information and is not legal advice or a substitute for ISO/IEC 42001:2023 or professional advice. Statistics are drawn from third-party surveys and vary by study.
Sources
- Questa AI, Shadow AI statistics and risks (PagerDuty survey, June 2026): https://www.questa-ai.com/privacy-cafe/shadow-ai-the-biggest-data-risk-in-2026
- Caiber Ops, Shadow AI statistics 2026 (Verizon, Cyberhaven, Netskope): https://www.caiberops.com/post/shadow-ai-statistics-2026
- Mimecast, Shadow AI: the hidden threat: https://www.mimecast.com/blog/shadow-ai-the-hidden-threat/
- Unseen Security, The State of Shadow AI 2026: https://www.unseensecurity.ai/shadow-ai-report