# Shadow AI

AI Glossary · Governance, Risk & Ethics
Canonical URL: https://aisat.uk/glossary/shadow-ai
Author: Lucy Gilmore, Assistant General Counsel, Product, Privacy & AI at Sprinklr | Practical Privacy, Product & AI Governance & Defensible Risk Decisions (https://www.linkedin.com/in/lucy-gilmore/)
Breadcrumb: [Glossary](https://aisat.uk/glossary) > [Governance](https://aisat.uk/glossary?category=governance) > Shadow AI

## TL;DR

> **Shadow AI** is the unsanctioned use of artificial intelligence tools, models, or browser extensions by employees without the visibility or approval of IT, security, or governance teams. It exposes organisations to confidential data leakage, intellectual property loss, copyright liability, and regulatory breaches.

## How Shadow AI works in practice

Shadow AI emerges whenever consumer AI tools move faster than enterprise procurement and internal enablement. Employees under pressure to ship code, summarise board packs, translate client contracts, or analyse spreadsheets paste proprietary material into personal ChatGPT accounts, unvetted meeting-transcription bots, free PDF summariser websites, or local open-weight models downloaded onto company laptops.

Unlike enterprise API tiers or Zero Data Retention (ZDR) agreements, free and consumer-tier AI services frequently retain user prompts and uploads to train future models or permit human contractors to review flagged transcripts. Modern shadow AI also extends to developer workflows: an engineer may install an unvetted MCP server, connect a personal coding agent to a production repository, or embed a hardcoded OpenAI API key inside a client-facing microservice without security review.

For example, a Midlands manufacturing group discovered through CASB (Cloud Access Security Broker) network logs that staff across procurement and R&D had uploaded 1,400 supplier pricing sheets and CAD specifications to eleven consumer AI websites over a single quarter, inadvertently exposing tender margins and triggering a UK GDPR data-processing audit.

## Why it matters and trade-offs

Blanket bans on AI almost always backfire, driving usage onto personal smartphones and unmanaged home networks where security teams have zero telemetry. The commercial risk is twofold: immediate leakage of personal data or trade secrets under UK GDPR and confidentiality agreements, and silent operational reliance on unvalidated outputs that no one is testing for hallucinations.

The proven remediation strategy combines technical visibility with an attractive sanctioned alternative. Organisations pair DNS/CASB monitoring and browser DLP guardrails with an approved, SSO-authenticated enterprise AI workspace, clear acceptable-use policies, and practical Article 4 AI literacy training so staff have a fast, safe path to get their work done.

## Related AI concepts

- [AI Governance](https://aisat.uk/glossary/ai-governance): AI Governance is the operational framework of internal policies, model inventories, risk assessments, approval gates, human oversight rules and audit trails that an organisation uses to deploy artificial intelligence safely, ethically and legally.
- [EU AI Act](https://aisat.uk/glossary/eu-ai-act): The EU AI Act (Regulation (EU) 2024/1689) is the European Union's risk-based AI law: prohibited practices and AI literacy applied on 2 February 2025 and GPAI rules on 2 August 2025, while under the May 2026 Digital Omnibus agreement standalone high-risk duties apply from 2 December 2027.
- [Guardrails](https://aisat.uk/glossary/guardrails): Guardrails are programmable validation layers placed on the input and output paths of an AI application to detect prompt injections, redact personally identifiable information, verify citations and block policy-violating completions in real time.
- [Vibe Coding](https://aisat.uk/glossary/vibe-coding): Vibe Coding is an AI-native software development workflow, coined by Andrej Karpathy in 2025, in which builders steer coding agents through natural-language prompts and runtime feedback rather than authoring source code line by line.