Executive briefing: AI risk
Shadow AI: What It Is, the Risks and How Boards Stop It
Shadow AI is uncontrolled AI use: AI used at work without the organisation's approval, visibility or control, such as staff pasting company information into public chatbots or switching on AI features in existing software. It is rarely malicious. The risks are data leakage, unchecked decisions, unvetted suppliers and unclear accountability. Bans do not stop it: visibility, a policy and an approved alternative do.
Read the full briefingIn brief
- Shadow AI is AI used without approval, visibility or control. It is almost always staff trying to work faster, not staff trying to cause harm.
- It creates four board-level risks: data leaving the business, decisions nobody checked, suppliers nobody vetted and nobody accountable.
- Banning AI does not stop shadow AI. It pushes it further out of sight, onto personal devices and personal accounts.
- The first control is visibility: an AI register, a clear acceptable use policy and an approved alternative that staff actually want to use.
- If management cannot say which AI tools are in use and what data goes into them, the organisation is not ready to fund AI.
Why the board should care
Your data may already be outside the business
Information pasted into a public AI tool leaves your control. The NCSC advises against putting sensitive information into queries to public AI chatbots.
Decisions are being shaped by unchecked outputs
AI drafts can reach customers, contracts and board papers with nobody checking them, and the organisation answers for what it sends.
Bans make the problem harder to see
Blocking tools on the network moves use to personal phones and accounts, where the business has no visibility at all.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The full written briefing
Next step
Find out where AI is already in use
The AI Readiness Assessment: Full Report (£999 + VAT) scores 30 areas across six domains, including governance and risk, with a prioritised roadmap and a 60-minute debrief with a senior partner. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
What is shadow AI?
Shadow AI is the use of AI tools at work without the organisation's approval, visibility or control. Examples include staff pasting company information into public chatbots, using consumer AI note-takers or browser extensions, and AI features a supplier has switched on inside existing software.
What are the risks of shadow AI?
Four risks: data leaving the business through tools it does not control, AI outputs reaching customers or reports unchecked, suppliers used with no due diligence, and no one accountable when something goes wrong. Each is manageable once the use is visible.
How do you stop shadow AI?
Not with a ban. Five controls work: an AI register of every tool in use, a one-page acceptable use policy, an approved enterprise alternative staff want to use, training on safe use, and one named executive accountable for AI use.
What are examples of shadow AI tools?
Public AI chatbots used with personal accounts, consumer AI meeting note-takers, AI browser extensions, AI writing and image tools, and AI features that suppliers switch on inside software the business already uses. The tool matters less than the data that goes into it.
How common is shadow AI usage?
Very. Microsoft's 2024 Work Trend Index, a survey of 31,000 knowledge workers in 31 markets published in May 2024, found that 78% of AI users were bringing their own AI tools to work. Assume it is happening in your organisation.
Should companies ban ChatGPT and other AI tools at work?
A blanket ban rarely works. It moves AI use onto personal devices where the business sees nothing. Restrict specific high-risk uses, such as confidential or personal data in public tools, and give staff an approved alternative instead.
What is uncontrolled AI use?
Uncontrolled AI use is AI used at work outside any approval, register or policy: another name for shadow AI. The risk is not the tools themselves but that nobody knows what data they see or what decisions they shape. Bring it under control with an AI register, a short acceptable use policy, approved alternatives and a fast approval route.
Who is responsible for shadow AI in a business?
The board is accountable for how AI is used, so it should name one executive to own AI use, keep an AI register and report on it regularly. IT can find the tools, but the policy and the risk appetite are board decisions.
This briefing is general information on governing unapproved AI use. References to data protection are governance guidance, not legal advice. AIPEX is not a certification body. For decisions about specific AI systems or data, take advice from qualified advisers.