What is shadow AI and what can you do about it?

antoniodiaz // Shutterstock

 

Organizations across industries are actively investing in AI to streamline operations, boost productivity, and stay ahead in competitive markets. However, most proceed with caution when rolling out new AI solutions internally as they need to meet standards for AI security, compliance, and responsible use through rigorous testing and assessments.

At the same time, teams may occasionally adopt AI solutions outside formal channels to simplify their workload. Often, these are commercially available tools that haven’t been vetted and approved by IT teams, which raises the issue of shadow AI, Vanta reports.

What is shadow AI?

Shadow AI refers to the use of AI tools and services within an organization outside formalized IT, security, or compliance oversight. It has become a growing trend in recent times due to the increasing accessibility of AI solutions. Options like ChatGPT, Midjourney, Claude, and Julius AI are easily available online and require little to no tech experience. This means that stakeholders may adopt them to support their everyday tasks without notifying management.

Let’s clarify the difference between shadow AI and shadow IT, which are similar concepts. While shadow AI refers to the use of AI tools without approval or oversight, shadow IT is the broader term that encompasses the unauthorized use of all software, hardware, and technology systems in an organization.

Though different in scope, both increase the chances of risk exposure and security breaches. Still, shadow IT is trickier to detect and control because it involves off-the-shelf apps, cloud-based services, and employee-owned devices that are easy to overlook.

According to Vanta’s AI governance survey, although 59% of companies feel confident in their visibility into AI tools, only 36% have or are developing an AI policy—meaning many organizations overestimate their controls and lack the formal structures necessary to manage AI responsibly.

Why should organizations worry about shadow AI?

The primary reason to worry about shadow AI is the low entry barrier for cloud-based AI tools. Most solutions require no additional setup or company credentials, and workers can use them without the guidance of AI teams.

Some of the reasons why stakeholders may resort to shadow AI are:

• Perceived productivity gain: From the layperson’s perspective, these tools surpass human processing limits and seem to deliver fast and easy results across creative use cases with no apparent harm.
• Gaps in internal governance: Many organizations still lack clear, accessible policies on how AI should (or shouldn’t) be used or what risks it poses.
• Slow approval process: Formal evaluations and approval chains are often seen as bottlenecks, so shadow AI emerges as a workaround to avoid slow internal processes.

In some cases, shadow AI doesn’t originate from internal users, but rather indirectly through vendors or consultants who use their own AI stack on your data or systems. This implicit trust in external partners can create blind spots, especially considering 92% of organizations trust vendors that use AI, often without asking how they use or manage AI tools.

5 risks of shadow AI

While shadow AI may boost your productivity in the short term, it also brings several significant risks. The most relevant ones are:

1. Data breaches and unmitigated vulnerabilities: The biggest shadow AI risk isn’t tied to any single tool, but rather to sensitive workflows where data confidentiality and privacy are critical, especially when using gated API access to third-party AI systems. If employees enter sensitive data into an unapproved platform, that information can be stored, accessed, or used in ways your internal teams can’t control.
2. Compliance violations: Unvetted tools might not meet industry regulations or data protection standards. Using them could inadvertently put your organization in breach of legal or contractual obligations.
3. Inconsistent output: Unauthorized AI-generated content, reports, or decisions may conflict with your company’s policies or procedures and lead to reputational risk and operational confusion.
4. Limited audit and oversight: When teams use AI without visibility, there is no clear record of how decisions were made or what data they used. This can limit your ability to audit processes and respond to inquiries from regulators or stakeholders.
5. Trust erosion: If shadow AI produces biased or misleading results, it can influence the quality of decisions your stakeholders make. Over time, repeated errors can damage your organization’s credibility with customers and partners.

6 steps to effectively manage shadow AI

Responding to shadow AI with blanket restrictions can trigger employee resistance—some may argue it slows down productivity and leads to missed opportunities for innovation. According to experts, banning AI tools could also be counterproductive.

A more effective solution is learning how to manage shadow AI in a way that supports both security and growth. Here are six steps to take:

1. Define your risk appetite
2. Develop an AI governance framework
3. Emphasize clear cross-team communication
4. Provide staff training on AI risks
5. Implement AI guardrails
6. Monitor and log AI use

Step 1: Define your risk appetite

To manage shadow AI effectively, first define how much risk your organization can tolerate through an AI risk assessment.

If you want to conduct such a risk assessment, consider:

• Applicable regulations: Map the regulations that apply to your organization, such as the GDPR, ISO 42001, and EU AI Act, among others.
• Potential impacts of shadow AI: Assess the risks of unauthorized AI use in your organization. Consider high-impact threats such as data leaks, compliance violations and corresponding fines, and losing customer trust.
• Current operational vulnerabilities: Evaluate the weak spots in your workflows, systems, or procedures, such as limited visibility into tools your team uses, unclear policies, or a slow internal approval process.

The results of your assessment will clarify the acceptable level of AI usage and areas where you need to introduce stricter controls. You can segregate your decision into two categories:

Vanta

Step 2: Develop an AI governance framework

The next step is to build and implement a flexible AI governance framework. This will allow you to have some structure without stifling innovation.

To develop an AI governance framework, you should outline:

• Approved AI tools
• Process for requesting and vetting new tools
• Guidelines for using generative AI
• Policies for handling sensitive information
• Stakeholder training requirements
• AI usage declaration forms or intake portals

To ensure the framework meets all your organization’s needs, collaborate with stakeholders across multiple departments during its development. By involving IT, legal, HR teams, and others, you’ll have a well-rounded understanding of their concerns.

You should factor in the ever-evolving nature of AI while developing your framework, so schedule frequent reviews to adapt to technological changes. Additionally, as your company’s procedures and risk landscape evolve, updating the framework regularly will help identify potential risks early on.

Step 3: Emphasize clear cross-team communication

The communication gap between IT and other teams is a common reason why shadow AI takes hold. When teams fail to openly share and explain the capabilities and risks of AI, it can lead to misunderstandings and uneven adoption. So, some departments can fully embrace AI tools and use them responsibly, while others unintentionally resort to shadow AI.

To prevent confusion and miscommunication, establish clear communication channels across departments. This way, stakeholders can collaborate and gain a comprehensive understanding of which AI tools are safe to use, how to manage risks, and how to stay compliant with policies and procedures.

Step 4: Provide staff training on AI risks

Many teams use AI without notifying management because of the perceived lack of risk. Educate your team on the inherent AI risks and expected terms of disclosure. You can also conduct regular training on ethical use and compliance.

Ideally, training should be conducted at least once a year, or if there’s a breach, policy change, or detection of shadow AI. A good practice is to continually reevaluate new AI tools for data exposure or biased use and determine if additional training is necessary for users.

The best way to standardize training is to customize sessions to roles. This will help team members identify potentially detrimental tools and understand AI policies through the lens of their work profile.

You can also create training documentation for passive consumption, such as:

• Training guides
• Help decks
• Frequently asked questions (FAQ)

Step 5: Implement AI guardrails

Once you’ve defined the guidelines for responsible use of AI, the next step is to implement practical safeguards to enforce them. In this context, AI guardrails can help with the successful rollout of new policies by ensuring that employees use only approved tools within defined boundaries.

Here are several examples of effective guardrails:

• Guidelines for external AI use: Explain when and how employees can use third-party AI tools to avoid risk exposure
• Sandbox environments to test tools: Provide isolated, virtual environments where employees can safely experiment with AI tools without compromising data
• Firewalls and other solutions to block unauthorized platforms: Restrict employees’ access to unapproved AI tools on company-managed networks and devices

Step 6: Monitor and log AI use

Even if you implement strong policies and robust measures, you should accept that some level of shadow AI will persist. Rather than stressing about how to eliminate shadow AI completely—which may not be realistic today—invest your efforts in continuous monitoring to manage potential risks.

You can establish procedures for continuous monitoring, such as:

• Setting up access and usage logging for known AI endpoints to spot unusual activities
• Using endpoint monitoring to detect and flag risky AI-related behavior
• Using vendor risk management software that can detect the use of new generative AI tools

You can also explore cultural monitoring by frequently encouraging employees to share what new AI tools they use, which can surface shadow AI without much friction.

After you put these procedures in place, make it a habit to review the logs regularly and cross-reference them with your AI governance framework. If this seems like too much manual work, consider streamlining some of the processes with automation tools.

This story was produced by Vanta and reviewed and distributed by Stacker.