Shadow AI is any AI tool used for work without official approval, oversight or governance: staff pasting company data into a personal ChatGPT account, an unsanctioned AI note-taker in meetings, an AI feature switched on inside a SaaS tool nobody reviewed. It is the AI equivalent of shadow IT.

Why is shadow AI a risk?

Because your data ends up in tools you do not control, decisions get made by systems nobody assessed, and you cannot prove any of it is governed. The exposure is real: confidential data leaving the business, regulatory obligations going unmet, and no audit trail when a regulator, auditor or customer asks how your AI is controlled.

How do you find shadow AI in a company?

Combine a few angles: ask people directly in a no-blame way, review SaaS and expense records for AI subscriptions, check which AI features are switched on inside tools you already pay for, and look at network or browser telemetry for AI services. No single method finds everything, so triangulate.

Should you ban shadow AI?

Usually not. Banning drives it further underground, and the demand is real because the tools genuinely help. The better move is to surface it, govern it, and give people sanctioned alternatives that are safe to use, so the value stays and the risk does not.

How does shadow AI relate to ISO 42001 and the EU AI Act?

Both expect you to know what AI is in use and to control it. An ISO 42001 management system starts with an inventory of every AI system, and the EU AI Act applies to AI you use, not just AI you build. Ungoverned shadow AI is precisely the gap those frameworks are designed to close.

Shadow AI: finding the tools you don't know you're using

Shadow AI is the AI tools your staff use for work without official approval or oversight. It is not a fringe problem; it is now the default: staff at over 90% of companies use personal AI tools for work, while only around 40% have officially sanctioned ones. Most of your AI exposure already lives in tools nobody signed off, and the first step to governing it is simply finding it.

Think of it as the AI version of shadow IT, but faster-moving and harder to see, because adopting a new AI tool is as easy as opening a browser tab.

What counts as shadow AI?

It is broader than “someone using ChatGPT.” Shadow AI includes:

Staff pasting company data into personal accounts of ChatGPT, Claude, Gemini or Copilot.
An AI note-taker quietly joining and transcribing meetings.
AI features switched on inside SaaS tools you already pay for, that nobody assessed.
Browser extensions and plugins that send your content to a third-party model.
A team wiring up an AI workflow or agent on their own, outside any review.

If it processes your data or makes decisions, and no one in the business owns or governs it, it is shadow AI.

Why it matters

The risk is not hypothetical:

Data leakage. Confidential or personal data ends up in tools you do not control, sometimes used to train models you cannot audit.
Compliance exposure. The EU AI Act and data protection law apply to AI you use, not just AI you build. Obligations attach whether or not you knew the tool was in play.
No oversight. Decisions get shaped by systems nobody assessed for bias, accuracy or appropriateness.
No evidence. When a regulator, auditor or customer asks how your AI is controlled, “we did not know that was being used” is not an answer that holds.

Governance done after an incident costs far more than finding the tools now.

How to find the shadow AI in your business

No single method catches everything, so use several and triangulate.

1. Just ask, without blame

The fastest source is the people using it. A short, genuinely no-blame survey or a few conversations per team will surface most of it, if people trust that the goal is to enable safe use, not to punish. Lead with that.

2. Review subscriptions and expenses

Comb through SaaS management tools, card statements and expense claims for AI products. Recurring charges and trials are a reliable trail, including small personal subscriptions expensed quietly.

3. Check the AI already inside your stack

The sneakiest shadow AI is the AI feature toggled on inside a tool you already own: your CRM, helpdesk, docs suite or analytics platform. Audit the AI settings and add-ons in the systems you already pay for.

4. Look at the network and browser layer

Where you have the tooling, SaaS discovery, single sign-on logs, DNS or proxy records, and managed-browser telemetry will show traffic to AI services that never came through procurement.

5. Follow the data

Ask where sensitive data flows. Anywhere people routinely copy text, customer records or documents “to get help with,” there is usually an AI tool on the other end.

What to do once you have found it

Resist the instinct to ban. Prohibition drives shadow AI further underground, and the demand exists because the tools genuinely help. The productive sequence:

Register it. Put every tool you find into a single AI system register, with an owner.
Classify the risk. Tier each one by what data it touches and what it decides, against ISO 42001 and the EU AI Act. This is a method in itself: how to classify your AI systems by risk.
Set a clear policy. What is allowed, what needs approval, and what is off limits, in plain language people will actually follow.
Offer sanctioned alternatives. Give people safe, approved tools that do the job, so the value stays inside your control.
Gate new tools. Evaluate the vendor and assess the next AI tool before it goes live, not after.

That is the difference between banning shadow AI and governing it: you keep the upside and remove the exposure.

Where this fits in governance

Finding shadow AI is not a one-off cleanup; it is the front door to a working AI Management System. An AIMS aligned to ISO 42001 starts with exactly this: a complete inventory, risk classification, ownership and an evidence trail. Shadow AI is the gap that inventory is built to close, and keeping it closed is what the ongoing governance does.

The short version

Shadow AI is already in your business, because the tools are useful and easy to adopt. The risk is not that people use AI; it is that you cannot see it, control it, or prove it is controlled. Find it by asking, by following the money and the data, and by auditing the AI hiding inside the tools you already own. Then govern it rather than ban it.

Want a fast read on where you stand? The free AI governance readiness assessment takes about ten minutes, no email required, and flags exactly these gaps. When you want to turn the findings into a register and a working management system, talk to us.

For the full picture, see the AI governance guide.