Right now, in some department of your company, someone is pasting internal information into an artificial intelligence tool the technology team does not know about. It is not a disloyal employee. It is almost always one of the most productive: they discovered that a report that used to take three hours now comes out in twenty minutes. They do it from a personal account, with the best intentions in the world, without suspecting that they have just sent company data to a server nobody evaluated.
This phenomenon has a name: shadow AI, the use of artificial intelligence tools without the approval or oversight of the technology or security team. It is the heir to the old shadow IT, with one difference that changes the size of the problem. An unauthorized application stored files. An AI model learns from what it receives, and what it receives is no longer under your control.
Why is it growing so fast?
Because the barrier to entry disappeared. Anyone with a browser has free access to models that write, code, translate and analyze better than many corporate tools. For the first time, the company's most advanced technology was not bought by the company: its people brought it in.
And because many organizations responded with the worst possible strategy: silence. No policy, no official alternatives and no conversation, so each employee decides on their own. When I wrote about secure cloud migration, the challenge was different: you knew what you were contracting and with whom you were signing. With shadow AI there is no contract. There is a free account opened on a Tuesday afternoon.
Adoption always runs faster than governance. The strategic mistake is believing that gap can be closed by banning.
What do the data say?
The IBM Cost of a Data Breach 2025 report put numbers to the phenomenon: one in five breaches analyzed involved shadow AI, and those with a high level of unauthorized AI cost an average of 670,000 dollars more than the rest. There is another figure I find even more revealing: of the organizations that suffered AI-related incidents, 97% did not have adequate access controls over those tools. It is not that the controls failed. They did not exist.
What gets leaked also matters: above all, customers' personal information and intellectual property. In other words, what a competitor would like to have and what a regulator penalizes.
Ban AI? That battle has already been lost
The instinctive reaction of many committees is to block access and consider the matter closed. What happens next is well known: people move to their personal phones, to their home networks, to the new tool the filter has not yet registered. Usage does not go down. Visibility does.
Banning without offering an alternative turns your best employees into your biggest blind spot, and leaves the company with the worst of both worlds: it takes on the risk of shadow AI without capturing the value of AI.
Govern without slowing down: four moves
The mature response does not start with technology; it starts with governance. At ZetTateK we work on it with clients and also in-house, in our AI Labs. These four moves are the starting point:
1. Take an honest inventory. Ask each department which tools it uses and for what, with no penalties involved. A two-week amnesty reveals more than six months of auditing.
2. Publish a short policy. One page anyone can understand: which data never leaves the company (customer information, source code, contracts, financial figures), which uses are allowed and whom to ask when in doubt.
3. Offer an official route. Business accounts with data protection agreements, approved by IT. The official alternative has to be as good as the unofficial one, or the unofficial one wins.
4. Give it continuous visibility. Traffic to AI services is monitored just like the rest of the network. That is where the new tool shows up before it becomes a habit.
If you are looking for a formal reference framework, the NIST AI Risk Management Framework organizes the topic into four functions: govern, map, measure and manage. Our consulting team helps tailor it to the size and reality of each company.
The role of leadership
Shadow AI is not an IT department problem. It is the sign that your organization has already decided to work with AI and has not found an official channel to do so. That is why the response cannot be fully delegated either: someone, by name, has to be accountable for AI risk in your company.
Five questions for your next executive committee
- Do we know which AI tools each department actually uses?
- What company data has already left, and to which providers?
- Do we have an AI use policy that can be understood in two minutes?
- Did we offer an official alternative, or did we only ban?
- Who is accountable for AI risk: IT, legal or senior management?
If any answer is “we don't know,” that is the starting point. A free security assessment includes a review of unauthorized application and AI use on your network: you come away knowing what information is leaving your company and through which channels.
Innovation is not governed by banning it. It is governed by giving it a secure channel.
Frequently asked questions
What is shadow AI, and why is it a risk for my company?
Shadow AI is the use of artificial intelligence that employees adopt on their own, without the technology team knowing about it or approving it. The risk is that the information they paste into those tools (customer data, code, figures) travels to servers nobody has evaluated and is no longer under your company's control. In addition, many models learn from what they receive.
How can I control the use of artificial intelligence in my company without banning it?
Start with governance, not technology. Four steps work well: take an honest inventory of which tools each department uses (with no penalties), publish a one-page policy anyone can understand, offer approved business accounts with data protection agreements and monitor traffic to AI services as part of the network. The key is for the official route to be as good as the one people already use.
How much can shadow AI cost a company?
IBM's Cost of a Data Breach 2025 report found that one in five security breaches involved shadow AI, and that incidents with a high level of unauthorized AI cost an average of 670,000 dollars more than the rest. Add to that the damage of leaking precisely the most sensitive information: customers' personal information and intellectual property, which can end in regulatory penalties.
Is it a good idea to ban AI tools at work?
In practice it does not work. When a company blocks access without offering an alternative, people keep using AI from their personal phones or home networks, and the organization loses all visibility into what is leaving. The result is taking on the risk without capturing the value. What does work is providing an official, secure channel. ZetTateK helps achieve this with assessments that reveal which unauthorized applications and AI are being used on your network.
