In short
The term comes from “shadow IT”, the long-standing problem of staff using software and services outside the IT team’s control. Shadow AI is the same idea applied to AI tools, which are free or cheap, need no installation and are very easy to paste information into. It includes AI features switched on inside software you already use, as well as standalone tools.
Why it happens
Staff find that AI saves them time on emails, summaries and reports, and the business has not offered an approved alternative. Many people do not see a risk in pasting a customer email into a chatbot, and many businesses have not yet told them otherwise.
It is also harder to spot than older forms of shadow IT. There is nothing to install and no invoice to the company, and the tool often runs in a browser tab or on a personal phone. AI features are also being added to software the business already pays for, such as email, office and meeting tools, sometimes switched on by default, so staff may not think of them as separate AI tools at all.
Shadow AI is often a sign of demand. The people using it have found jobs where AI helps, which is useful information for your AI strategy. Treating it only as a discipline problem tends to drive it further out of sight and loses that information.
The risks
| Data protection | Personal data sent to a provider you have no contract with may breach UK GDPR obligations, and you remain responsible for it. |
|---|---|
| Confidentiality | Client documents, pricing, source code or plans may be stored by the provider and, depending on its terms, used to improve its models. |
| Accuracy | AI output that nobody checks can put wrong facts or figures in front of customers. |
| Lost knowledge | Work done in personal accounts is not stored where the business can find it when someone leaves. |
| Cost and sprawl | Several overlapping subscriptions paid on expenses, with no view of the total. |
A well-known example
In 2023 it was widely reported that Samsung engineers had pasted internal source code into ChatGPT, after which the company restricted staff use of generative AI tools on company devices. The case is often cited because the staff involved were trying to do their jobs well. That is typical of shadow AI.
How to bring it into the open
Ask first. A short, no-blame survey of which AI tools people use and for what will tell you more than any monitoring software. Then approve one or two tools on business plans with suitable data terms, and give people access to them.
Write a short AI acceptable use policy that says what is approved, what data must never go into AI tools, and how output must be checked. Train staff on it using their real tasks. Review the AI features in software you already pay for, because many are switched on by default.
If you find that personal data has already gone into an unapproved tool, work out what was shared, with which provider and under what terms, and whether it amounts to a personal data breach. Under UK GDPR, a breach that is likely to result in a risk to people must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. The ICO’s guidance explains how to judge this, so take advice promptly if you are unsure.
Recheck every few months. New tools appear all the time, and the aim is to keep giving people a safe way to do what they are already trying to do.
When this matters
Relevant to almost any business where staff use computers. New Era AI’s audits include an inventory of AI tools already in use, and the consulting roadmap sets out approved tools and rules so shadow AI becomes managed AI. This page is general guidance, not legal advice.
Questions
Is shadow AI illegal?
Using an unapproved tool is not illegal in itself. The risk is what goes into it: sharing personal data without a proper basis or contract can breach UK GDPR, and sharing confidential client information can breach contracts.
How do we find out what AI tools staff are using?
Ask them in a short, no-blame survey, review expense claims for AI subscriptions, and check which AI features are enabled in your existing software.
Should we discipline staff for using shadow AI?
Where there were no rules, the better response is to set them, provide approved tools and train people. Clear rules make it fair to act on later breaches.