Shedding light on shadow AI

Just as quickly as enterprises are racing to operationalize AI, shadow AI is racing to outpace governance. It’s no longer about rogue chatbots, but entire workflows being quietly powered by unapproved models, vendor APIs and autonomous agents that never went through compliance. Sensitive data exposure, bias creeping into hiring algorithms and reputational harm when an experiment goes live before anyone notices are just some of the very real risks lurking behind the scenes.

So, how do we stop it? The solution isn’t to discourage or slow AI use, but to make responsible practices as easy and automatic as the shadow versions people turn to when the official path feels too slow. That’s what modern AI governance programs are designed to do. But unfortunately, many don’t.

It’s time for leaders to move beyond committee bottlenecks and spreadsheets to automated, scalable oversight. And in this case, using fire to fight fire is the best bet. AI can instantly evaluate new projects, flag critical issues and feed better information to governance teams. This balance of automation and accountability can transform governance from an uphill battle to a tech enabler.

The scale of the problem

Nearly 60% of employees use unapproved AI tools at work, according to a new Cybernews survey. While many understand the associated risks, they’re still feeding sensitive company information to unsanctioned tools. Despite half of respondents reporting access to approved AI tools for work, only a third claim that they fully meet on-the-job needs.

Shadow AI incidents now account for 20% of all breaches, while 27% of organizations report that over 30% of their AI-processed data contains private information — from customer records to trade secrets. In essence, unchecked AI projects aren’t just internal inefficiencies, but full-blown enterprise risk vectors.

This brings us to a crossroad. Employees understand the gamble they’re taking when they use rogue AI tools, but it doesn’t outweigh the desire to get their jobs done efficiently. Executives understand this is happening and the potential cost of missteps, but managing it can seem impossible. In fact, the same Cybernews survey found most direct managers are aware of or approve the use of shadow AI.

Make governance lightweight

There’s only one realistic path forward. To effectively mitigate shadow AI, you need to make it extremely easy for people to get their AI projects or tools approved. It’s not about bending the rules or rubber-stamping approvals, either. It’s about using the very tool we’re trying to govern to streamline and improve the approvals process itself.

Having a governance committee is still the right foundation, but if the process is too heavy — “write a 40-page document, attach spreadsheets, provide dozens of appendices” — teams will either skip it or simply go forth anyway. A strong governance model should strike the balance between two things:

1. Having enough rigor to mitigate the key risks
2. Being frictionless enough to encourage engagement.

Here’s how to achieve this in practice.

Automate the upfront risk analysis

Deploy an AI-driven assessment tool to prescreen projects and tools. Teams can simply upload their proposal or the URL of a third-party vendor and the tool automatically runs a risk-analysis workflow. By flagging common risk categories (data sensitivity, duplication of effort, model bias, vendor location, security posture, etc.) and assigning a risk ranking, leaders can better evaluate AI initiatives.

A committee should still review submissions, but with a high-quality, consistent evaluation process. This saves time for both the committee and the project owners. Let automation assess the AI for “is it safe/legal/a duplicate?” so the human review process can focus on strategic value and more layered judgment calls.

Lower the friction for the business unit

Make the submission process intuitive: upload whatever artifact you have (email draft, blog post, PowerPoint or vendor link). There is no need for a massive formal project charter in the first iteration. What you want is speed and transparency. For example, “I’m building an HR chatbot for employees,” or “I’m using an API to screen 6,000 candidates down to 100.” The submission can be integrated into the committee workflow for visibility or feedback before being approved or denied.

Enable visibility and oversight

Just like classic shadow IT (think of Excel spreadsheets full of sensitive data sitting on unmanaged cloud shares), AI tools can hide in plain sight. Once someone starts populating free chat tools with internal data, it’s a domino effect that the enterprise often loses track of or isn’t aware of at all.

To surface and trace AI usage, consider using asset discovery tools like agent identifiers, real-time monitoring and activity logging. This can help maintain an inventory of AI applications. While some of this may sound intrusive, without true visibility, there’s no governance.

Embed a risk-based approval model

Not every AI project is equal: an HR assistant for policy questions is lower risk than an autonomous agent making hiring decisions or a vendor API conducting background checks for thousands of candidates. The latter requires digging deeper into bias, model provenance, vendor chain and data protection. For simpler tools you want to fast-track, automation can help assign a lower risk tier. The committee can then apply more scrutiny to high-risk items only, keeping things moving.

Treat governance as an enabler, not gatekeeper

We need to stop treating governance as a gatekeeper. It’s supposed to give teams safe lanes to use AI, rather than forcing them underground. But when overly restrictive, slow or poorly implemented, AI governance can have the opposite unintended effect — actually forcing shadow AI in the name of productivity.

Instead, provide sanctioned AI tools when possible, vet new ones with ease and, when there’s a cause for concern, be transparent about the reasons so new solutions or tools can be explored. When the official path is easy, there’s less incentive to go rogue.

Without centralized governance, many AI tools are emerging in the shadows. This leads to higher risk, blind spots for compliance and security and a missed opportunity to scale responsibly. To avoid this, we don’t need to bring the hammer down on the employees using shadow AI, but instead, implement easier, faster, more comprehensive ways to assess risk. And the best way to do this is by using AI itself.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?