Shadow AI: managing unapproved AI tools at work
Shadow AI is the use of AI tools, accounts or features at work without the knowledge or approval of IT, security or leadership, such as staff pasting documents into personal chatbot accounts or connecting unapproved AI apps to company data. It happens because the tools are useful and approved options are slow or missing. Manage it by discovering what is in use, approving good tools quickly, setting clear data rules, training staff and monitoring, rather than relying on bans alone.
What is shadow AI?
Shadow AI is the AI version of shadow IT. It includes staff using personal accounts on chatbots for work, installing browser extensions that read pages, connecting AI note-takers to meetings, granting AI apps access to company email or files, and turning on AI features inside approved software without review. Most of it is well-intentioned: people want to work faster. The problem is that the company cannot protect data or meet its obligations for tools it does not know about.
Why do employees use unapproved AI tools?
- They are useful: AI saves time on writing, research, analysis and coding.
- Approved options are missing: The company has not provided a good alternative.
- Approval is slow: Requests take weeks, so people go ahead anyway.
- Rules are unclear: Staff do not know what is allowed.
- Tools are everywhere: AI features appear inside apps people already use.
What are the risks?
- Confidential or personal data leaving company control
- Breaching client contracts that restrict AI use
- Data protection breaches under GDPR or local law
- Unapproved connectors with broad access to email and files
- Unchecked AI output in client work or decisions
- No audit trail when something goes wrong
Our guide to AI security covers how connected tools can be attacked, and MCP security risks covers connectors.
Why does banning AI rarely work?
Blocking popular AI websites on the office network does not stop people using phones or home laptops, and it signals that the company is behind. Bans can also push use further out of sight, which makes the risks harder to manage. Most organisations get better results by offering approved tools that are as good as the consumer versions, with business terms that protect data, and by making the rules clear.
How do you manage shadow AI?
- Discover: Review web traffic, browser extensions, OAuth app grants and expense claims; ask staff in an anonymous survey.
- Assess: Rate each tool for data handling, security, contract terms and usefulness.
- Approve or replace: Approve good tools on business plans; offer alternatives for risky ones.
- Set clear rules: Publish an AI usage policy with data rules and examples.
- Train: Show staff what is allowed and why.
- Monitor: Watch for new tools and connected apps; review quarterly.
- Make requests easy: A simple form and a quick decision.
Use our AI usage policy template and 30-day AI literacy plan as starting points.
What about AI features inside approved software?
Many tools the company already pays for now include AI features: email, office suites, design tools, CRMs and support platforms. These can be safer than consumer tools, but they still need review. Check whether the feature sends data to a third-party model, whether it is covered by your existing contract and whether admins can control it. Turn features on deliberately rather than by default.
How do you build a healthy culture around AI?
People hide AI use when they fear being judged or punished. Leaders can change this by using approved tools openly, sharing good examples and asking teams what they need. Treat discovery of shadow AI as information about unmet needs, not a disciplinary matter, unless someone knowingly breaks clear rules. An amnesty period when the policy launches lets people switch to approved tools without worry.
How do you know it is working?
Track a few simple signals over time: the number of AI tools discovered outside the approved list, the share of staff using approved tools, the time taken to answer tool requests, and incidents or near misses involving AI. A falling count of unapproved tools alongside rising use of approved ones shows the approach is working. Ask staff every few months whether the approved tools meet their needs; gaps in the answers point to where shadow use will appear next. Report these figures to leadership so AI governance is treated as an ongoing programme rather than a one-off project.
What does this look like in practice?
A professional services firm in Abu Dhabi runs an anonymous survey and reviews app permissions. It finds more than twenty AI tools in use, including note-takers connected to client meetings and personal chatbot accounts used for drafting reports. It approves a business AI assistant and a note-taker with data agreements, blocks two apps with broad email access, publishes a two-page policy and runs short training sessions. Requests for new tools get an answer within a week. Shadow use falls, and the firm can now show clients how their data is protected.
How UIUX Studio helps
We help companies choose, set up and integrate approved AI tools and build internal assistants on their own data. Talk to our Technology Advisory or Agentic AI & Automation teams.
Frequently asked questions
What is shadow AI?
Use of AI tools at work without IT or leadership approval.
Is shadow AI dangerous?
It can leak data and breach contracts or data protection law.
Should we block ChatGPT?
Blocking alone rarely works; offer approved alternatives.
How do we find shadow AI?
Review traffic, app permissions and extensions, and ask staff.
Who owns shadow AI risk?
Usually IT or security, with legal and business leaders.