Shadow AI is the AI version of shadow IT. IBM defines it as the unsanctioned use of any AI tool or application by employees or end users without the formal approval or oversight of the IT department, with an employee pasting work into a consumer chatbot as the common example (IBM, What is shadow AI?). People reach for whatever helps them get work done: a chatbot, a browser extension, an agent they set up themselves, usually well ahead of any sanctioned rollout.
The scale is the reason it is a governance topic and not an edge case. Microsoft and LinkedIn’s 2024 Work Trend Index, based on a survey of 31,000 people in 31 countries, found that 75% of knowledge workers were using generative AI at work, that 78% of AI users were bringing their own AI tools (80% at small and medium-sized companies), and that 52% of people who use AI at work were reluctant to admit using it for their most important tasks (Microsoft, AI at Work Is Here. Now Comes the Hard Part). An organization that has not approved any AI tools has not stopped AI use; it has stopped seeing it.
It is a signal as well as a risk. The upside is that it shows where AI creates value faster than a top-down strategy will. The risks are concrete: sensitive data entered into tools with no data-processing agreement, outputs used in decisions without review, and agents acting on company systems with credentials nobody tracks. IBM’s guidance for managing it reads like ordinary governance: a flexible framework that says which kinds of tools are allowed and how sensitive data is handled, guardrails such as approved tools and sandboxes, monitoring and access controls for unapproved software, and regular communication about the risks.
The practical response is to make the sanctioned path easier than the shadow one: provide approved tools that meet people’s needs, publish a clear data policy, and keep an inventory of AI systems in use. AI governance covers the broader program, how to govern AI agents covers agents specifically, and the enterprise AI topic collects the episodes on rolling AI out inside companies.
Sources
- IBM: What is shadow AI? — Defines shadow AI as unsanctioned use of AI tools without IT approval or oversight.
- Microsoft Work Trend Index: AI at Work Is Here. Now Comes the Hard Part — 2024 survey: 78% of AI users brought their own tools, and 52% were reluctant to admit using AI for important tasks.