What is shadow AI?
Shadow AI is the use of AI tools inside an organisation without the knowledge or approval of IT, security, or compliance. It usually means consumer assistants accessed through a browser or a personal account, often paid for on an expense card, and used with real company content.
It is worth being precise about why this is a problem, because the usual framing — employees behaving carelessly — is both unfair and unhelpful. The risk is structural. When company content is pasted into a service the organisation has no contract with, there is no processing agreement, no defined retention, no access log, no incident notification path, and no way to answer a supervisory authority asking what happened to a data subject's information.
Why does banning consumer AI tools not work?
Because the demand does not disappear when the sanctioned route closes. Blocking a domain on the corporate network moves the activity to a phone on cellular data, where the organisation has no visibility at all. The prohibition succeeds at removing evidence and fails at removing risk.
There is a second cost that is easy to miss. A ban tells people that the organisation's answer to a genuine productivity gain is refusal. That makes them less likely to report what they are doing, less likely to ask for a compliant alternative, and less likely to involve security early on the next thing. Losing that channel is expensive, and it takes a long time to rebuild.
How do we find out what is actually happening?
Measure before you legislate. Three sources give a usable picture within a couple of weeks, and together they are far more accurate than asking people to self-report behaviour they suspect is against policy.
- Network and proxy telemetry: which AI domains are being reached, from which parts of the business, and how often.
- Expense and procurement data: individual and team subscriptions that never went through a formal purchase process.
- Anonymous, amnesty-framed survey: what people are using AI for, and which task they would most like help with. Make it explicit that the purpose is provision, not enforcement.
The output you want is not a list of offenders. It is a ranked list of tasks — the specific work people are reaching for AI to do. That list is the requirements document for whatever you deploy next, and it is the single most valuable artefact of this exercise.
What is the sequence that actually works?
Provide first, then govern, then enforce — in that order. Enforcement before provision produces evasion. Provision before governance produces a faster leak. The order matters more than the speed of any individual step.
1. Provide a genuinely better alternative
Deploy a sanctioned platform that beats the consumer tool at the top two or three tasks from your measurement exercise. Company context is the natural advantage here: an assistant that can see approved internal knowledge answers questions a public assistant cannot answer at all.
2. Make access controls hold at retrieval
Every source system's permissions must be carried into the retrieval step, per user, per query. Indexing everything under a broad service account and filtering afterwards converts a governance project into a faster leak.
3. Turn on evidence before you turn on scale
Source-level citations and a durable activity record should exist from the first pilot. Retrofitting audit onto a system people already depend on is far harder than starting with it.
4. Write policy people can follow
A short, specific policy that names the approved tool and the two or three genuinely prohibited cases will be followed. A long policy of general principles will not be read.
5. Enforce only once the alternative is real
Now blocking consumer endpoints is reasonable, because there is somewhere better to go. Enforcement at this stage reads as tidying up rather than as refusal.
6. Measure the substitution
Track consumer AI traffic against sanctioned platform usage. Falling shadow usage alongside rising governed usage is the signal that the programme is working. Falling shadow usage with flat governed usage means the work moved somewhere you cannot see.
How do we know it is working?
Track substitution rather than adoption. Adoption alone can rise while shadow usage stays flat, which means you have added a tool rather than replaced a behaviour. The metrics below distinguish the two.
| Metric | What it tells you |
|---|---|
| Consumer AI traffic on the corporate network | Whether the ungoverned behaviour is genuinely declining, not just moving. |
| Weekly active users of the governed platform | Whether provision is reaching people rather than sitting with a pilot group. |
| Share of queries answered with citations | Whether the platform is being used for real work rather than as a general chatbot. |
| Register-of-information completeness | For DORA entities: whether AI arrangements are documented as ICT third-party dependencies. |
| Time to complete the tasks from the measurement exercise | Whether the governed route is actually faster, which is what determines whether it holds. |