Shadow AI is the use of artificial intelligence tools, models and agents inside an organisation without the knowledge, approval or oversight of the teams responsible for IT, security or compliance. The typical case is mundane: a marketer pastes a client brief into a personal ChatGPT account. The term exists because generative AI put a powerful data-processing service in reach of anyone with a browser, and data typed into it leaves the company's control the moment it is sent.

IBM defines it as "the unsanctioned use of any artificial intelligence (AI) tool or application" by employees or end users without formal approval from the IT department. It is a branch of shadow IT, with one difference: an unapproved AI tool does not only store data but processes it, may retain it and may train on it.

How shadow AI enters an organisation

Shadow AI arrives through several channels.

  • Personal accounts on public chatbots. An employee uses ChatGPT, Claude, Gemini or DeepSeek through a private email address. The account sits outside the company's contract, retention settings and audit logs.
  • Copy and paste. Much data reaches AI tools through the clipboard, which older data loss prevention (DLP) tools, built to watch attachments and uploads, often miss.
  • Browser extensions. Assistants that read the page being viewed, often with broad permissions.
  • AI features switched on inside approved software. An approved vendor adds a generative feature in an update, creating a data flow no one reviewed.
  • Agents and connectors. Since 2025, employees can connect assistants to calendars, drives and ad accounts through the Model Context Protocol (MCP), an open standard for linking AI models to external tools. A self-installed connector can let an agent act on systems security never mapped.

Where the data goes next depends on the vendor's terms. OpenAI's enterprise tier, launched on August 28, 2023, states that it does not train models on business data or conversations. Consumer tiers of several chatbots have allowed training on conversations unless the user opts out. The same tool can be acceptable under a company contract and a liability under a personal account, so identity, not the tool's brand, is the central variable.

Origin and evolution

The phrase has no recorded coiner. It spread in 2023, after OpenAI released ChatGPT on November 30, 2022, as shorthand for employees putting work data into consumer chatbots. Its reference case came from Samsung Electronics. After an engineer uploaded internal source code to ChatGPT to check it for errors, Samsung's Device eXperience division barred staff from using ChatGPT, Google Bard and Bing's chatbot on work devices, in a memo dated April 28, 2023, according to The Korea Economic Daily.

Outright bans gave way to sanctioned alternatives. Enterprise tiers with single sign-on (SSO) and no-training commitments arrived in late 2023. On May 8, 2024, Microsoft and LinkedIn's Work Trend Index, a survey of 31,000 people in 31 countries, reported that 75% of knowledge workers used AI at work and that 78% of AI users brought their own tools, a habit Microsoft labelled BYOAI.

The meaning has since widened. A 2026 review by governance software company Modulos counted five definitions in use: unauthorised consumer tools, ungoverned AI systems, AI features silently enabled in approved software, developer infrastructure without security review, and autonomous agents outside governance. The last, sometimes called shadow MCP, dominated vendor launches in 2026.

What the numbers say

The most cited figures come from IBM's annual Cost of a Data Breach Report, researched by the Ponemon Institute. The 2025 edition, published on July 30, 2025 and covering 600 organisations breached between March 2024 and February 2025, found that one in five organisations reported a breach linked to shadow AI. Organisations with high levels of shadow AI paid about $670,000 more per breach than those with little or none. Only 37% had policies to manage AI or detect shadow AI.

The 2026 edition, released on July 29, 2026 and based on 602 organisations breached between March 2025 and February 2026, put the share of security incidents involving shadow AI at 43%, according to analyses by ComplexDiscovery and law firm Baker Donelson. Breaches involving shadow AI averaged $5.39 million, up from $4.63 million. Only 29% audited regularly for unsanctioned AI.

Gartner, in a forecast dated November 19, 2025, predicted that more than 40% of enterprises would suffer security or compliance incidents linked to shadow AI by 2030. Its survey of 302 cybersecurity leaders, conducted between March and May 2025, found that 69% suspected or had evidence of employees using unapproved public generative AI tools.

Telemetry from security vendors fills in the detail. Cyberhaven, analysing the AI usage of 7 million workers in a report released on April 23, 2025, found that 34.8% of corporate data employees put into AI tools was sensitive, up from 10.7% two years earlier. Netskope's Cloud and Threat Report, published in January 2026, found that 47% of generative AI users at work relied on personal accounts, down from 78% a year earlier.

Detection and control

Organisations typically combine four approaches.

Discovery identifies which AI services employees reach, through web gateways, cloud access security brokers, browser telemetry, SSO logs and expense reports. Data loss prevention inspects prompts and uploads for source code, credentials or personal data, and blocks or redacts them. Identity controls force AI tools behind corporate SSO so usage is logged. Sanctioned-tool programmes give employees approved enterprise licences as a legitimate alternative.

Agents require network-level detection. In August 2026, Cloudflare's Gateway began classifying MCP traffic using the MCP-Protocol-Version header and blocking MCP calls that bypass approved portals. Local servers and off-network traffic remain invisible to it.

The regulatory frame

No regulation uses the phrase "shadow AI", but several create duties that it breaches. The EU AI Act required providers and deployers to ensure a sufficient level of AI literacy among their staff from February 2, 2025, under Article 4. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026, softened that to a duty to "take measures to support" literacy, according to analyses by ActuIA and Law & Technology. Accounts differ: PPC Land's report on the provisional agreement of May 7, 2026 described a text in which the Commission and member states would "encourage and facilitate" companies, while the published-text analyses say the obligation on providers and deployers survives as an obligation of means. Deployer duties for high-risk systems listed in Annex III now apply from December 2, 2027.

Under the General Data Protection Regulation (GDPR), pasting customer personal data into a consumer chatbot can mean processing without a data processing agreement and, for non-EU vendors, an unvetted international transfer. The Dutch data protection authority's AI literacy guide of October 2025 told organisations to start with an inventory of AI systems in use. The US National Institute of Standards and Technology (NIST) AI Risk Management Framework of January 26, 2023 and ISO/IEC 42001, published in December 2023, likewise assume an organisation knows which AI it runs.

Why it matters for marketing

A ProGEO.ai survey of 112 marketers at the RSAC conference in March 2026 found that 75.9% used generative AI daily and 57.1% paid for personal subscriptions, while only 43.8% said technical controls enforced their company's AI policy. Agencies handle client data under contracts that rarely contemplate a third-party model seeing it.

University of California, Davis researchers found that 17 of 20 chatbots sent data to at least one third party, including advertising endpoints, during a single session. A brief pasted into such a tool may reach ad tech that the brand never contracted with.

Criticisms and disputes

Most shadow AI data comes from companies that sell shadow AI controls. LayerX, Netskope and Cyberhaven measure their own customers, who chose to buy monitoring tools. IBM's sample is non-statistical and limited to breached organisations, and its governance figures are self-reported.

Units also differ. Netskope's 47% counts users on personal accounts; LayerX's 2026 figure of 47.11% counts conversations on personal identities; LayerX's own 2025 report put personal-account usage at 67%. The figures are not comparable, despite similar headlines.

The term itself is contested. Critics argue that "shadow" frames employees as the problem when the gap is often slow procurement, and that bans push use further out of sight. Definitional drift means two reports citing "shadow AI" may measure different things.

Shadow AI versus adjacent terms

  • Shadow IT is any technology used without IT approval. Shadow AI is a subset, distinguished by data processing, retention and model training.
  • Bring your own AI (BYOAI) describes employees supplying their own AI tools. It overlaps heavily, but BYOAI can be permitted.
  • AI sprawl is the uncontrolled multiplication of AI tools, models and agents, sanctioned or not.
  • Prompt injection is an attack that hides instructions in content an AI system reads. Shadow AI widens the exposure; prompt injection is one exploit.

Recent developments

In May 2026 LayerX found that 15% of employees ran an AI browser extension, nearly three-quarters requesting high or critical permissions. OneTrust and Information Security Media Group found that 65% of organisations lacked full visibility into shadow AI. In September 2026, Augmentt reported that 47% of managed service providers had faced an AI or Copilot data exposure or near miss in a client tenant over 12 months.

Vendors have responded with products. Sophos made AI Defense generally available on October 13, 2026. On October 20, 2026, Axonius launched Shadow AI Discovery, with tools to inventory models, agents and MCP servers due in preview by the end of January 2027.

Timeline

  • November 30, 2022 - OpenAI releases ChatGPT.
  • January 26, 2023 - NIST publishes the AI Risk Management Framework 1.0.
  • April 28, 2023 - Samsung's Device eXperience division restricts generative AI after source code was uploaded to ChatGPT; reported May 2, 2023.
  • August 28, 2023 - OpenAI launches ChatGPT Enterprise with SSO and a no-training commitment.
  • December 2023 - ISO/IEC 42001 AI management system standard published.
  • May 8, 2024 - Microsoft and LinkedIn report 78% of AI users bring their own tools to work.
  • February 2, 2025 - AI Act Article 4 AI literacy obligation applies.
  • April 23, 2025 - Cyberhaven reports 34.8% of data put into AI tools is sensitive.
  • July 30, 2025 - IBM reports one in five organisations breached via shadow AI, with a $670,000 cost premium.
  • November 19, 2025 - Gartner forecasts shadow AI incidents at more than 40% of enterprises by 2030.
  • January 2026 - Netskope reports 47% of generative AI users on personal accounts, down from 78%.
  • July 24, 2026 - Digital Omnibus on AI (Regulation 2026/1744) published, softening Article 4.
  • July 29, 2026 - IBM reports shadow AI in 43% of incidents studied, average cost $5.39 million.
  • August 14, 2026 - Cloudflare adds MCP detection to Gateway.
  • October 13, 2026 - Sophos AI Defense generally available.
  • October 20, 2026 - Axonius launches Shadow AI Discovery.

Summary

Who: Employees in any function, including marketers and agency staff, who use AI tools without approval; the IT, security and compliance teams who try to detect them; vendors such as IBM, Netskope, LayerX, Cyberhaven, Sophos and Axonius that measure or sell controls; and regulators enforcing the AI Act and GDPR.

What: The use of AI chatbots, extensions, embedded features and agents outside an organisation's sanctioned tools and oversight, the AI-specific form of shadow IT.

When: The term spread in 2023 after ChatGPT's launch and Samsung's restrictions; measured incidents rose from one in five breached organisations in IBM's 2025 report to 43% of incidents in 2026, with agent-focused detection products arriving through 2026.

Where: In browsers, personal accounts, extensions and connectors on corporate devices worldwide, with regulatory consequences sharpest in the EU under the AI Act and GDPR.

Why: Consumer AI tools are faster to adopt than enterprise procurement allows, and every prompt sent outside a governed account can expose client data, personal data or intellectual property to retention, training or third parties.