Shadow AI

Shadow AI extends the older idea of shadow IT. It appears when staff paste client documents into a public chatbot, when a team connects an AI plugin to a corporate system, or when a vendor quietly adds AI features to software already in use. The risks are concrete: confidential information and personal data leaving the organization, outputs used without verification, intellectual property exposure, and AI systems that never pass through risk classification, so regulatory duties go unmet.

Banning everything rarely works; usage simply goes further underground. Effective responses combine an acceptable use policy that says what is allowed, approved alternatives that meet real needs, AI literacy training, technical controls such as data loss prevention, vendor management that catches AI features in contracts, and an intake route that brings discovered uses into the AI inventory. ISO/IEC 42001 and the NIST AI RMF Govern function both assume the organization knows which AI it uses.

Example: a legal team discovers associates drafting contracts with a free online assistant and moves them to an approved enterprise tool with logging.