Shadow AI: what it is and why businesses need to know about it
Shadow AI is not a special class of dangerous software. It is the same pattern as any other unsanctioned tool, sped up. A person can open an account, paste in today’s work, and get something useful back before anyone else knows the product exists.
In practice it looks like a personal ChatGPT account, a browser extension, an AI feature switched on inside a design tool, or a meeting assistant that joined a call because someone clicked the prompt. The organisation did not buy it. The organisation also cannot say what the tool retained.
Why it matters here
The information in a prompt is often the sensitive part of the job: a client name, a strategy, a person’s details, an unreleased idea. If that prompt sits in a consumer account, you may have no agreement, no retention limit, and no way to delete it when the client asks.
You also cannot answer a straightforward question in a security questionnaire. “Which AI systems process our data?” has an official answer and a real one. The real one is the one that counts.
What to do about it
Ask. People will usually tell you what they are using if the next sentence is not a ban. Write it down. Decide what is allowed, what must move to a company account, and what should stop. Where the volume justifies it, technical monitoring can show services the survey missed. The survey is still the right first week.
Prohibition without an alternative recreates the problem. Approved tools, a short rule, and a register are how shadow AI becomes a known list instead of a rumour.
If this is the question already sitting with you, a conversation is the useful next step.