Curious employees are eager to explore new AI tools, but some companies lack clear guidelines. Learn how to mitigate the risks of unsanctioned AI and turn it into an advantage.
Sydney Scott
Editorial Strategist, AI
Workday
It's a familiar scene in offices everywhere: someone discovers a cool new app or tool that makes their work life a little easier, a little faster.
Maybe it's an online AI writing assistant that polishes their emails, or a smart chatbot that helps them brainstorm ideas for a presentation. They're just trying to be more productive and make their day flow a bit smoother. Honestly, who can blame them?
But here's where things get interesting. What happens when these helpful tools aren't officially approved by the company's IT department? What if they're used outside of the usual rules and guidelines? That's what we call "shadow IT," and it's becoming a surprisingly common part of our workplaces.
Employees are all trying to get things done, sometimes without realizing the bigger picture. In fact, a recent report by data security company Varonis found that 98% of employees are using applications that aren't officially sanctioned, and that includes AI.
This might sound like a challenge, but what if we reframed it? Instead of seeing it as a hidden problem, view it as a powerful indicator of where our teams need more support and where innovation is eager to bloom.
The real opportunity lies in transforming these unsanctioned tools from potential liabilities into strong, trusted assets that empower everyone.
Report
So, what exactly is shadow AI? Think of it as any AI tool, model, or platform that an employee uses within an organization without official approval from the IT department or without following established company guidelines. This can include everything from popular generative AI tools to various AI-driven software-as-a-service (SaaS) applications.
Employees pick up these tools to automate everyday tasks, create content, or help with decision-making, often without realizing they're stepping outside of official company policies or security frameworks.
While shadow AI is a cousin to "shadow IT" (any unauthorized tech system), it brings its own set of unique and amplified risks. The big difference lies in how AI works: its outputs can be complex and sometimes unpredictable.
Unlike typical software, AI models often learn as they go, and they require a lot of data. This means unsanctioned AI can lead to bigger, more unpredictable, and potentially more serious problems than traditional unapproved software.
For employees and companies, the risks are substantial. One of the most immediate concerns is data security and confidentiality. When sensitive company information—like strategic plans, customer data, unreleased financial figures, or even proprietary source code—gets put into unapproved AI tools, that data can end up in publicly accessible or poorly secured AI models.
According to a recent survey, two-thirds of leaders see data exposure or data leakage as the biggest risk when it comes to unsanctioned AI use. So, we’re sure they’d be rattled to find that 37% of employees surveyed have entered private company information into external AI systems and one-third of employees admitted to entering confidential client information into outside tools.
This creates a huge blind spot for IT and security teams, which suddenly have no idea what tools are being used or where sensitive information is flowing.
A striking example of this occurred in 2023 with Samsung, when engineers accidentally shared proprietary source code with ChatGPT while looking for coding help. Samsung's valuable intellectual property was effectively exposed to an external AI provider.
“Here we are wanting people to explore, but they don’t feel that they have that time or permission. What we’re working on is changing the mindset.”
Ashley Goldsmith
Chief People Officer, Workday
This incident highlights a crucial way data can leak: some AI services, especially free ones, use the data they process to train their underlying models. This means your confidential information could become part of the AI's general knowledge, potentially becoming discoverable by other users or popping up in responses to different questions.
Dealing with shadow AI requires a thoughtful approach. Simply banning these tools isn’t effective, especially as AI becomes more ubiquitous in the workplace. Employees will inevitably find workarounds to boost their productivity. And with more leaders seeing it as a competitive advantage, organizations can no longer ignore AI as an asset.
Instead, enterprises can tackle this growing challenge with a two-pronged approach that focuses on both strong IT controls and proactive employee empowerment.
By combining robust technical measures to identify and manage unsanctioned AI with initiatives that educate and empower employees to use AI responsibly, businesses can transform potential risks into powerful assets.
This integrated strategy helps ensure data security and regulatory compliance, while also fostering an environment where innovation can thrive safely.
Gaining a clear picture of AI tool usage across an organization is the first crucial step in managing shadow AI. These tools often operate unseen within daily workflows, making them tricky to track with traditional methods.
As Krishna Prasad, chief strategy officer and CIO at UST, points out, one of AI's biggest risks is data leaks. While planned AI projects have safeguards, unsanctioned AI tools lack these protections, significantly increasing the chance that sensitive company information could be exposed.
To counter this, Prasad advises technology, data, and security teams to strengthen their data access rules, controls, and overall data loss prevention programs to stop leaks from shadow AI.
IT and security teams have several key strategies to uncover and control shadow AI:
By putting these safeguards in place, IT can move from a reactive to proactive risk management. These technical controls enable organizations to gain visibility and enforce policies to protect company, client, and employee information.
Once shadow AI usage is identified, leaders can transform these potential liabilities into managed assets. Invisible shadow usage becomes measurable activity, allowing organizations to track which models are being used, what data is being sent, and even spending by each team, all from a single dashboard. IT can also deploy enterprise AI models, taking on administrative duties to better secure data and limit access.
Create an environment where employees feel comfortable seeking approval for AI tools and where IT departments are supportive and responsive.
By putting technical guardrails in place, organizations can enforce security policies, log interactions, and ensure that only vetted models are accessible, thereby creating a more resilient and secure digital environment.
Along with establishing strong IT safeguards, the biggest weapon in your arsenal against shadow AI is humans.
Humans are naturally curious about new technology. Instead of hindering it, allow them to explore and innovate. Nearly half of employees use some sort of AI tool at work, but one in three admit to keeping their AI use a secret.
Organizations that lack clear guidelines around AI use, or outright refuse to adopt the new technology, have led some employees to quietly use AI in their work because it offers a clear path to greater productivity and efficiency.
David Torosyan, human resources and payroll manager at J&Y Law, told Digiday, “Employees aren’t hiding their AI use because they’re trying to get away with something—they’re hiding it because they’re trying to get ahead without getting in trouble. People are using it to write faster, organize smarter, and communicate clearer. They’re solving problems in real time with tools that didn’t exist a few years ago.”
This isn't about malicious intent. It's about finding solutions to everyday work challenges. Employees are proactively seeking ways to enhance their skills and performance, recognizing that mastering AI can be a way to stay relevant in a changing work landscape. This demonstrates a workforce ready and willing to adapt and innovate.
Organizations should harness that curiosity and focus on creating an environment where employees feel empowered to explore new technologies responsibly. This involves several key components:
Research found 98% of employees are using applications that aren't officially sanctioned, and that includes AI.
The complexity of AI's impact means that distilling all associated responsibilities into a single role is impossible. Instead, a shared mindset and collective action are required to successfully navigate the evolving landscape of human-AI collaboration.
The CIO and CHRO might collaborate to redefine how work gets done in the age of AI. Mindsets will need to change, roles may need to be merged, or new ones will need to be created altogether.
Humans are essential to combating shadow AI, so consider what role HR will play in your strategy. Or how IT leaders will need to rethink their approach to driving adoption and implementing AI that’s accessible to everyone.
Collective leadership is crucial for preparing teams for an AI-driven future and managing the balance between AI's potential benefits and employee concerns.
By working together to keep humans at the center of any AI adoption strategy, organizations can move beyond simply reacting to AI advancements and proactively design a more productive and fulfilling future of work.
The emergence of shadow AI is driven by human curiosity and a desire for tools that allow people to focus on creative tasks.
Think of shadow AI as both a challenge and opportunity. By embracing a two-pronged approach—combining robust IT controls with a culture of employee empowerment—businesses can transform these unsanctioned tools from hidden risks into powerful assets.
The adoption of unsanctioned AI is a clear signal of your workforce's readiness to embrace new technology. And when everyone works together, you can design a landscape where AI amplifies human potential.
Keep employees in the loop and look for ways to proactively reshape your organization. Look to humans to lead the way into an AI-powered future.
With insights from over 2,300 global leaders, download our report to discover why 98 percent of CEOs forsee the positive impact AI can have on the future of enterprise.
Report
A gap between effort and impact is the real ROI problem. Discover the solution.