Shadow AI & Unsanctioned Tools
Your teams are already using AI. The question is whether you know which tools, what data they're sending, and who owns the outputs.
What Shadow AI Looks Like
An engineer pastes a customer database schema into ChatGPT to help write a query. A support agent uses Claude to draft responses that include order details. A finance analyst uploads a P&L spreadsheet to an AI tool to "make it easier to understand."
None of this was approved. None of it went through security review. All of it is happening right now.
Why It Happens
Sanctioned tools move slowly. Unsanctioned tools solve the problem today. When the gap between "what IT provides" and "what the job actually needs" is large enough, people fill it themselves.
This is not a discipline problem. It's a product gap.
The Real Risks
Data exfiltration: Customer data, IP, financial data leaves the organisation's control and enters a third-party model's training pipeline (depending on terms of service).
Output ownership: Who owns content generated by an unsanctioned tool? The employee? The vendor? This is legally unresolved in most jurisdictions.
Compliance violations: GDPR, HIPAA, SOC2 — all of these have implications for what data can be sent to external processors. Shadow AI bypasses all of it.
Skill dependency: Teams build workflows around tools that could be withdrawn, changed, or monetised differently at any time.
The Fix: Make the Sanctioned Path Easier
The only sustainable fix for shadow AI is to make the approved path less painful than the workaround. This means:
- Audit first — understand what tools are actually being used before you ban anything
- Provide alternatives — for every banned tool, offer a sanctioned equivalent that solves the same need
- Create a fast track — a lightweight approval process for new AI tools (days, not months)
- Educate on risk — not threats, not fear. Practical examples of what can go wrong.
The Policy That Works
A blanket ban on AI tools doesn't work. People work around it. The policy that works:
"You may use AI tools for tasks that don't involve customer data, financial data, or internal IP. For anything else, use the approved stack or raise a request."
Simple. Auditable. Actually followed.
Dealt with shadow AI in your organisation? Share what worked — anonymised examples welcome.