What is shadow AI?
By the InTheory team · Updated November 2026
Shadow AI is the use of AI tools by employees without the business approving, configuring or knowing about them. Typical examples are staff pasting client emails into a personal chatbot account, installing AI browser extensions, or connecting AI note-takers to meetings. The risk is client data leaving your control without anyone deciding it should.
Why it happens
People are trying to get work done. If the business offers no approved tool and no guidance, staff fill the gap themselves, usually with free or personal accounts. Banning AI outright tends to push the use further out of sight rather than stopping it.
How to bring it into the open
Ask, without blame. A short anonymous survey or team conversation about which AI tools people use and for what usually reveals more than any technical scan. Review expense reports for small software charges and check which apps have been granted access to Microsoft 365 or Google Workspace accounts.
Then give people a safe, approved option that covers their real needs, a one-page policy on what data stays out, and a quick way to request a new tool. Measure progress by the share of AI use happening in managed accounts. For firms handling health, legal or financial records, this step matters more, because duties under HIPAA, privilege rules or the FTC Safeguards Rule do not pause for convenience.