Ask a room full of executives whether they have a clear picture of how AI is being used across their company, and most hands go up. Ask the people who actually work there, and the picture looks very different. One widely cited 2026 survey found roughly three in four executives believed they had good visibility into AI usage, while employee-side data put the real figure closer to one in four. That gap, between what leadership believes and what is happening, is Shadow AI in a single sentence.

It is not a future risk. It is not a niche problem for the security team to quietly handle. Multiple independent surveys through 2026 converge on a similar picture. Somewhere between half and two-thirds of employees now use AI tools at work in some form, while only a small minority of organisations, consistently under one in five in most studies, have a formal policy covering it. When companies finally run a proper inventory, they typically discover two to four times more AI activity in production than anyone expected going in.

If your organisation has not gone looking for this yet, the honest starting assumption is that it is already there.

What Shadow AI is

Shadow AI is any AI tool, feature, or agent processing company data without going through IT, security, or compliance review. That definition is broader than most people assume, and the breadth is the point.

The version everyone pictures first is an employee pasting a paragraph into ChatGPT on a personal account. That happens constantly, and it is a real risk. But it is only one slice of a much bigger picture, and increasingly not even the largest slice. A growing share of AI use inside most companies is happening through channels nobody would think to call "Shadow AI" at all: a feature quietly switched on inside a CRM everyone already uses, a browser extension that summarizes meetings, an automation a sales manager built themselves over a weekend using a tool that needed no approval to set up.

Shadow AI is the AI-era version of Shadow IT, the old problem of employees adopting unauthorized software to get work done faster. What makes this version harder to manage is that AI tools do not just store data the way an unauthorized Dropbox account did. They process it, transform it, and in many cases send it to a third-party model provider the organisation never vetted or signed a data agreement with.

Why it is already inside your organisation

Getting inside the organisation rarely takes an act of rebellion. It starts with someone trying to finish a task a little faster, using whatever is closest to hand.

A few forces are driving this at once. AI tools are cheap or free, require no procurement process, and can be adopted by a single person in minutes. Business units now control the large majority of software spending in most companies, not central IT, which means a team lead can put a subscription on a shared card without anyone in security ever hearing about it. And AI capability is arriving embedded inside tools that were already approved years ago, added by the vendor through a routine update rather than a new purchase decision anyone had to sign off on.

There is also a more specific pattern worth naming directly, because it is one of the most common and most avoidable causes. Organisations respond to AI risk by banning it outright, without offering any sanctioned alternative.

This almost never works the way leadership hopes. Employees still need to summarize a document, draft an email, or debug a piece of code faster than they could unassisted, and a policy that says "do not use AI" does not remove that need. The behavior just moves somewhere leadership cannot see it. Research on this is remarkably consistent. Companies that provide a properly licensed, monitored enterprise AI tool see unauthorized usage drop sharply, in some studies by close to ninety percent. Usage does not disappear entirely. A meaningful share of employees will still reach for a personal account even after a sanctioned option exists, often out of habit or because the approved tool feels slower or more restrictive. But the gap closes dramatically, and closes in a way that a ban never achieves.

The practical lesson is not "loosen every restriction." Restriction without an alternative just relocates the risk. An enterprise account, where the organisation controls what data goes in, who has access, and what gets monitored, gives people a legitimate way to do what they were already going to do anyway. Governed access beats invisible access every time.

The different forms Shadow AI takes

Treating Shadow AI as a single category, "unapproved chatbots," misses most of where the real exposure sits. In practice it shows up in at least five distinct forms, and each needs a different response.

Personal accounts on well-known tools. An employee uses their own ChatGPT, Claude, or Gemini login for work tasks. This is the most visible form and the one most policies already address, at least on paper.

Free tiers of tools the company already pays for. An employee defaults to the free version of a chatbot instead of the enterprise seat the company already licenses, because it is one click away and nobody explained the difference in data handling between the two.

Browser extensions and plug-ins. Meeting summarizers, writing assistants, and tab managers with AI features bolted on, often installed with a single click and granted broad permission to read whatever is on screen. Many employees do not even think of these as AI tools. They think of them as browser utilities that happen to be smart.

AI embedded inside already-approved software. A CRM, an HR platform, or a productivity suite the company has used for years quietly ships an AI feature in a routine update. Nobody re-reviews it, because nobody thinks of a tool that was approved in 2022 as something that needs approving again in 2026.

Employee-built agents and automations. Using low-code platforms now built into most major cloud and SaaS ecosystems, a single employee can connect an AI agent directly to real company data in minutes, with no security review at all. These agents are also the ones most likely to be forgotten entirely once the person who built them changes role or leaves the company, quietly running with access nobody remembers granting.

Embedded features and self-built agents, the last two categories above, are growing the fastest of the five, and they are also the hardest to see with traditional monitoring, since they rarely produce the kind of unusual network activity that would flag a rogue application.

What can go wrong

Data leakage is the most immediate risk, and the simplest to picture. Someone puts information into a tool the organisation never agreed to share it with. Across the surveys done in 2026, a consistent quarter to a third of employees admit to having done exactly this with genuinely sensitive material: customer records, financial figures, source code. One of the clearest public examples remains an incident from a few years ago in which engineers at a major electronics manufacturer pasted proprietary source code into a public chatbot while debugging, and that code left the building the moment it was submitted. It has become a standard cautionary reference in this field for a reason. It is exactly the kind of small, well-intentioned decision that creates the biggest exposure.

The risk does not stop at data leaving the building through an obvious front door. Embedded AI features inside tools an organisation already trusts can introduce entirely new attack surfaces that nobody was watching for. A well-documented vulnerability disclosed in 2025, nicknamed EchoLeak, showed how hidden instructions buried inside an ordinary email or spreadsheet could silently trigger an AI assistant embedded in everyday office software to exfiltrate data, without the user clicking anything at all. That is not a hypothetical edge case. It is a real, published vulnerability in one of the most widely deployed AI copilots on the market, and it illustrates why "the tool is officially approved" is no longer the same thing as "the tool is safe."

Beyond data leakage sits a quieter but equally serious problem. Decisions get made using AI outputs nobody reviewed for accuracy or fitness for purpose, with no record afterward of what happened or why. When a regulator, auditor, or customer later asks how a particular decision was reached, "we are not entirely sure, an employee may have used an AI tool we do not have visibility into" is not an answer any leadership team wants to give.

How it spreads

Almost none of this arrives through a dramatic breach. It arrives through a long series of ordinary, well-intentioned choices, each one small enough that nobody thought it needed sign-off.

A colleague recommends a browser extension that saved them an hour last week. A vendor pushes a software update and a new AI panel appears on the dashboard, switched on by default. Someone in sales builds a small automation over a weekend to save themselves a recurring manual task, connects it to the CRM, and never mentions it to anyone because it did not feel like the kind of thing that needed mentioning. None of these moments look like a policy violation from the inside. They look like initiative.

That is precisely what makes this difficult to govern with the tools most security teams already have. Traditional monitoring was built to catch unauthorized software leaving a visible trace: a new application installed, an unusual network connection, a domain nobody recognizes. AI usage through a browser tab, an embedded feature, or a locally run model often leaves none of that.

What to do about it

The starting point is visibility, not enforcement. You cannot govern what you cannot see, and most organisations significantly underestimate how much AI activity already exists inside their own walls until they go looking. That means a real inventory, not a policy memo asking people to self-report, since self-reporting is exactly the mechanism that produced the executive-employee perception gap in the first place.

Once visibility exists, the highest-leverage move is usually the one already covered above. Replace the instinct to ban with the discipline to provide. Give people a sanctioned, properly licensed AI tool that is genuinely as capable as what they would otherwise reach for on their own, with clear rules about what kind of data it can and cannot handle. This alone closes most of the gap.

From there, governance has to become continuous rather than a once-a-year audit. New AI features get switched on inside existing software constantly, often without any announcement that would prompt a fresh review. A governance process built around an annual vendor review will always be months behind a landscape that changes monthly.

Finally, treat this as a leadership visibility problem as much as an employee behavior one. The perception gap at the start of this piece cuts both ways. Employees are not hiding AI use out of malice, and leadership is not blind to it out of negligence. Both groups are simply working from an incomplete picture, and closing that gap is the actual governance work, not a side effect of it.

Common questions

Is Shadow AI the same as Shadow IT? They are closely related but not identical. Shadow IT is unauthorized software generally. Shadow AI is specifically AI tools and agents, and it carries a distinct risk profile because these systems do not just store data, they process and transform it, often sending it to a third-party model provider.

Does banning AI tools outright solve the problem? Usually not. Research consistently shows that outright bans push usage further out of sight rather than eliminating it. Providing a well-supported, properly governed alternative reduces unauthorized use far more effectively than restriction alone.

What is the single most overlooked source of Shadow AI? AI features embedded inside software a company already approved years ago. Because the original tool went through review long before the AI feature existed, nobody thinks to re-review it once the vendor quietly adds one.

If your organisation has never run a real inventory of where AI is already touching company data, that is usually the most useful next conversation to have, before another policy gets written that nobody can actually enforce.

‍