AI Compliance Vendors

Guide

Shadow AI: what it is, why it matters and how to manage it

Shadow AI is the use of AI tools and features at work outside the systems and processes an organization has approved [1][2]. It is the norm rather than the exception: in Microsoft and LinkedIn’s 2024 survey of 31,000 people, 78% of AI users brought their own AI tools to work [7]. This guide covers what counts as shadow AI, how common it is, real incidents, what the EU AI Act, GDPR, HIPAA and financial regulators expect, how to find it, an eight-step program, and the tools that discover and control it.

Reviewed 15 Oct 2026 · next review by 14 Dec 2026 · 50 sources · report an error

What is shadow AI?

IBM defines shadow AI as employees or end users using any AI tool or application without the formal approval or oversight of IT [1]. The UK’s National Cyber Security Centre (NCSC) describes it as AI use that “isn’t captured in an organisation’s approved systems and processes” and treats it as a form of shadow IT [2]. Typical examples are pasting customer data into a personal ChatGPT account, installing an AI browser extension, switching on an AI feature inside an approved SaaS tool, or running an AI agent on a work laptop.

Shadow AI vs shadow IT. Shadow IT is any software, hardware or service used without approval; shadow AI is the AI-specific part of it [1]. Four things make it harder to control than ordinary shadow IT:

  • The data leaves in the prompt. No file transfer or new account is needed; a copy and paste is enough. The NCSC notes that data sent to consumer AI services may be stored, retained or used to improve them [2].
  • The same app can be approved or shadow depending on the login. Netskope says controls have to work account by account: signing off a tool for the company does not cover staff using it through personal accounts [32].
  • AI arrives inside software you already approved. FINRA’s rules apply to AI used through embedded features in existing third-party products [26], and NIST tells organizations to decide how AI embedded in application software is treated in their AI inventory [29].
  • Agents act, not just answer. The NCSC warns that AI agents can have critical vulnerabilities and create new opportunities for attackers [2].

How shadow AI gets into an organization

The main routes, with evidence
RouteWhat it looks likeEvidence
Personal or free accountsStaff use consumer chatbots on personal loginsShare of GenAI users on personal AI apps fell from 78% to 47% as company-managed accounts rose from 25% to 62% (Netskope, 2025 data) [8]
Browser extensions and AI browsersAI extensions and agentic browsers read pages and formsDiscovery tools now inventory installed browser extensions [37]
AI features in approved SaaSVendors switch on AI inside tools you already useFINRA says its rules apply to embedded AI features; NIST says to decide how embedded AI is treated in the AI inventory [26][29]
Agents, MCP servers and local agentsAgents with access to email, files and the shellOpenClaw (2026) and a malicious MCP server (2025), below [18][20]
Developer toolsCoding assistants, model APIs and keys in codeNetskope: source code was the most common data type in GenAI policy violations [8]
Netskope figures are from its own customer telemetry.

How common is shadow AI?

78%
of AI users bring their own AI tools to work[7]AI users in a 31,000-person survey, 2024
57%
of employees hide their use of AI at work[9]employees in a 48,000-person survey, 2025
69%
of organizations suspect or have evidence of staff using prohibited public GenAI[6]2025 survey, 302 security leaders
20%
of organizations studied had a breach involving shadow AI[4]2025 report, 600 organizations

Use runs ahead of procurement. MIT’s NANDA initiative found that only 40% of companies it studied had bought an official LLM subscription, while workers at more than 90% of them used personal AI tools for work, though its sample was small [10]. Only 40% of employees in the University of Melbourne and KPMG study said their workplace had a policy or guidance on generative AI [9].

Security vendors’ own telemetry shows what goes into the prompts. Netskope counted an average of 223 GenAI data-policy violations per organization per month [8]. Cyberhaven found that 39.7% of interactions with AI tools in 2025 involved sensitive data [11], and Harmonic Security found sensitive content in 4.37% of prompts and 21.86% of uploaded files in the second quarter of 2025 [12]. Treat these as indicators: they come from each vendor’s customer base, not a random sample.

Shadow AI examples and incidents

Documented incidents
IncidentWhat happenedOutcome
Samsung, 2023Engineers entered confidential data, including chip test sequences and meeting notes, into ChatGPT; three leaks in under a month [14]Samsung banned staff use of generative AI tools in a major division [13]
Dutch data breach notifications, 2024A medical practice employee entered patients’ data into a chatbot; a telecom employee entered customer addresses [15]The Dutch data protection authority warned that this can be a reportable personal data breach [15]
NSW Reconstruction Authority, Australia, 2025A former temporary staff member uploaded spreadsheet data to ChatGPT; 2,031 people were affected, including health information [16]Independent review found gaps in governance, training and data security; the Privacy Commissioner was notified [16]
US cyber agency CISA, 2026The acting director uploaded contracting documents marked for official use only to ChatGPT, triggering automated security warnings [17]The Department of Homeland Security reviewed it for harm [17]
OpenClaw, 2026A viral open-source agent with access to email, files and the shell; Kaspersky warned that staff could connect it to work services, and that bans on work machines can push it onto personal devices [18]CVE-2026-25253 (CVSS 8.8) let a malicious link compromise it; fixed in version 2026.1.29 [19]
postmark-mcp, 2025A fake MCP server package added one line that copied every outgoing email to an attacker [20]The package had about 1,500 weekly downloads before it was exposed [20]

Why shadow AI is a compliance problem

EU AI Act. Article 4 has required providers and deployers of AI systems to take measures on the AI literacy of their staff since 2 February 2025 [23]. Regulation (EU) 2026/1744, the Digital Omnibus on AI, published on 24 July 2026, softened the duty: organizations must now take measures to support the development of AI literacy, without having to guarantee any particular level [21]. It still applies to deployers [24]. The Commission’s guidance says staff using generative AI should be told about specific risks such as hallucination, that no certificate is needed, and that organizations can keep an internal record of training [22].

A deployer is anyone using an AI system under its authority, other than for personal, non-professional activity [23]. Our reading: when staff use an AI tool for work, the organization is plausibly its deployer even if IT never approved it, so literacy measures and AI policies should cover unapproved tools too. Also on our reading, an organization whose staff use a general-purpose tool for a purpose the Act lists as high-risk, such as screening job applicants, may be treated as the provider of a high-risk system under Article 25(1)(c) [23]; those obligations apply from 2 December 2027 [24]. Our EU AI Act deadline explainer covers the new dates.

GDPR. The Dutch data protection authority has warned that staff entering personal data into AI chatbots against their employer’s rules is a personal data breach, which in many cases must be reported to the authority and to the people affected [15]. Our reading: with a consumer AI service, the organization typically has no Article 28 processor terms or Chapter V transfer safeguards in place, and the disclosure may lack a lawful basis or serve a new purpose [44].

HIPAA. HHS says a cloud service provider that creates, receives, maintains or transmits electronic protected health information is a business associate, even if it only stores encrypted data, and that using one without a business associate agreement puts the covered entity in violation [25]. Our reading: the same applies to an AI chatbot or transcription tool that receives PHI, so staff pasting PHI into a tool without a BAA create a disclosure risk.

Financial services. The New York Department of Financial Services expects covered firms to identify every information system that uses AI, train staff not to put nonpublic information into AI queries, and consider monitoring for unusual queries and blocking those that could expose it to public AI [27]. FINRA says its rules are technology-neutral and apply when firms use AI through third-party products, including embedded features [26].

Where shadow AI sits in ISO/IEC 42001 and the NIST AI RMF
RequirementWhat it asks forShadow AI relevance
NIST AI RMF GOVERN 1.6Mechanisms to inventory AI systems [28]You cannot inventory what you have not discovered
NIST AI RMF GOVERN 6.1Policies for AI risks from third parties [28]Most shadow AI is third-party AI
NIST AI 600-1 GV-1.6-001, GV-1.6-002Add generative AI systems to the inventory and decide how embedded AI is treated [29]Covers AI features inside approved software
NIST AI 600-1 GV-6.1-010Update acceptable use policies for generative AI [29]The policy that defines what is shadow
ISO/IEC 42001 A.2.2 and A.9.2AI policy; processes for responsible use of AI [30]Rules for which tools staff may use, and how
ISO/IEC 42001 A.4.2–A.4.6Documenting the resources AI systems use, including tooling [30]The AI inventory
ISO/IEC 42001 A.10.2 and A.10.3Allocating responsibilities; suppliers [30]Third-party and embedded AI
ISO control numbers follow the NIST-hosted crosswalk, which was prepared on the final draft of ISO/IEC 42001 and uses Annex B (guidance) numbers that mirror the Annex A controls; check the published standard. Our ISO 42001 guide lists every Annex A control.

How to detect shadow AI

No single source sees everything. The NCSC’s first principle is that you cannot manage what you do not know about [2], and its shadow IT guidance notes that cloud access security brokers can’t see unapproved use of approved services without intercepting encrypted traffic [3]. Combine at least one network source with one browser or endpoint source, then add the others that fit your risks.

Discovery methods compared
MethodWhat it findsBlind spotsExamples
Network, SSE and CASB logsWeb and SaaS AI apps, volume by user and teamOff-network and personal devices; use inside approved apps without TLS inspection [3]Microsoft Defender for Cloud Apps, Netskope, Palo Alto Networks [31][32][33]
Browser extensionPrompts, pastes and uploads in web AI tools; personal vs corporate loginsUnmanaged browsers, desktop apps and command-line toolsHarmonic Security [34][46]
Endpoint agentDesktop AI apps, IDE assistants, local models, agents and MCP serversDevices without the agentHarmonic Security, Netskope, Knostic, Microsoft Purview on onboarded devices [34][32][42][31]
Email and OAuth signalsAI sign-ups, OAuth grants, connected agentsLittle prompt content on its ownNudge Security [37]
Cloud and code discoveryModels, agents, MCP servers and AI applications in clouds, code repositories and data platformsAI your teams build, not employee use of outside toolsHolistic AI (AWS, Azure, GitHub, Databricks); ServiceNow AI Control Tower [47][40]
Surveys and amnestyWhat people use and whyUnder-reporting: 57% hide their AI use [9]NCSC no-blame approach [3]

How to manage shadow AI: an eight-step program

Aim to reduce the risk rather than assume shadow AI can be eliminated. The NCSC recommends understanding why staff turn to unapproved tools so you can offer secure alternatives, avoiding unnecessary lockdowns and taking a no-blame approach, because punishment makes people less likely to disclose what they use [2][3]. Gartner recommends enterprise-wide AI usage policies, regular audits for shadow AI and adding generative AI risk to SaaS assessments [6].

  1. 01

    Discover

    Combine a network or SSE source with a browser or endpoint source; add code and cloud scanning if you build with AI (see detection above).

  2. 02

    Triage and score

    Sort what you find into sanctioned, tolerated and unsanctioned [33]. Score each app on whether it trains on inputs, where data is stored, whether it offers a data processing agreement or BAA, and whether it supports single sign-on.

  3. 03

    Write the policy

    Set out which tools are approved, which data must never go into AI tools, and how to request a new tool (see the next section) [29][30].

  4. 04

    Offer approved alternatives

    Give staff an enterprise AI tool with contractual protections. Netskope’s data shows personal-app use falling as company-managed accounts rose [8][2].

  5. 05

    Control data at the prompt

    Coach, redact or block sensitive data inline; NYDFS suggests considering blocking queries that could expose nonpublic information to public AI [27]. Prefer coaching and redaction to hard blocks where you can; the NCSC advises against unnecessary lockdowns [3].

  6. 06

    Train staff

    Cover AI-specific risks such as hallucination and data leakage, and keep an internal record of training for the EU AI Act’s literacy duty [22].

  7. 07

    Register and govern

    Feed approved tools into your AI inventory, as NIST GOVERN 1.6 and ISO/IEC 42001 expect [28][30], and route new requests through a single intake. Our AI risk register is a free starting point.

  8. 08

    Measure

    Track AI apps discovered and the share approved, the share of AI activity on corporate rather than personal accounts, data-policy events per month, request turnaround and training completion, and audit for unsanctioned AI regularly; IBM found only 34% of organizations with a policy do [4][8].

What to put in a shadow AI policy

  • Approved tools and accounts: which tools are approved, on which accounts, and that personal logins to approved tools don’t count [32].
  • Data that must never go in: personal data, health information, nonpublic financial information, credentials and keys, and confidential source code [25][27][8].
  • AI features in approved software: who decides whether vendors’ new AI features are switched on [29].
  • Agents and connectors: whether staff may run AI agents, browser extensions or MCP servers, and who approves them [2].
  • Checking output: staff should know about risks such as hallucination [22], so require them to check AI output before relying on it.
  • Requesting a new tool: a fast, controlled route to tools outside the approved catalogue [3].
  • Reporting: a no-blame way to declare tools already in use, and AI-related data incidents handled under the breach process [3][15].

Shadow AI detection tools

We looked for tools whose own product pages document both discovery of AI use and controls on it, then weighed how many channels they cover (network, browser, endpoint, agents), whether they tell personal from corporate accounts, whether they coach, redact or block inline, how they feed an AI register, and pricing transparency. Vendors did not pay to be listed.

  • Harmonic SecurityBrowser and endpointOur review →

    Built for workforce shadow AI: finds AI apps through a browser extension and tracks corporate versus personal accounts, extends to desktop apps, IDEs and MCP connections, and coaches users inline by warning, nudging or blocking. Plans are listed without prices.[34][46]

  • Netskope Skylight AI Security (Netskope One)SSE platform

    For Netskope customers: inline inspection across 1,800+ AI apps, separation of corporate and personal accounts, real-time coaching toward approved tools, redaction, and an inventory of agents and MCP servers.[32]

  • Microsoft Defender for Cloud Apps and PurviewMicrosoft 365

    Often already licensed in Microsoft estates: a catalog of more than 1,000 generative AI apps scored on 90+ risk factors that can be sanctioned or blocked, plus Purview data loss policies for prompts sent to third-party AI sites from onboarded devices.[31]

  • Palo Alto Networks AI Access SecuritySASE add-on

    For Palo Alto SASE and firewall customers: classifies 4,000+ generative AI apps as sanctioned, tolerated or unsanctioned, with upload controls and data loss prevention.[33]

  • Nightfall AIData loss preventionOur review →

    DLP-first: keeps company data out of personal ChatGPT accounts, unapproved copilots and AI tools in the browser; its Premier tier adds Cursor, Claude Code and VS Code coverage and detection of unapproved MCP servers. Priced per user per year; prices not shown.[35][45]

  • WitnessAINetworkOur review →

    Discovers AI use by employees and agents, inventories AI apps and MCP servers, redacts data in real time and keeps audit trails. Offers a shadow AI audit tool. Its site shows no prices; its AWS Marketplace listing prices the enterprise plan at $180 per user a year, with a 1,000-user minimum.[36][49]

  • Nudge SecuritySaaS discovery

    Mainly discovery from read-only email and OAuth signals: finds AI tools, AI agents and risky integrations, and also flags sensitive data shared with AI chatbots through uploads and pastes. Published price: $5 per mailbox per month.[37]

These directory vendors also document shadow AI discovery and control. Their profiles show ownership changes as they happen.

  1. 01

    Prompt Security

    Best for: Controlling employee use of chatbots across browsers, desktop apps and APIs

    Now part of SentinelOne (Sep 2025)

    Now part of SentinelOne, which completed the acquisition on 5 September 2025. The product gives visibility into generative AI use and controls employee use of tools such as ChatGPT, Gemini and Claude across browsers, desktop applications and APIs.[38][50]

    Prompt Security profile →

  2. 02

    Lakera

    Best for: Check Point customers

    Now part of Check Point Software Technologies

    Now part of Check Point, which announced the acquisition in September 2025. Its Workforce AI Security finds unapproved AI use in apps and browsers and sets policy per user, app or action.[43][48]

    Lakera profile →

  3. 03

    Credo AI

    Best for: Connecting discovered AI to governance workflows

    Governance-led: its Shadow AI Discovery offering, launched as a design-partner program, aims to detect unauthorized AI use and connect it to governance workflows, and Credo AI says its AI registry gives “full visibility into shadow AI”.[39]

    Credo AI profile →

  4. 04

    ServiceNow AI Control Tower

    Best for: ServiceNow estates

    AI Control Tower finds agents, models, copilots and MCP servers whether they were built in-house, bought or never approved, and links them to the ServiceNow CMDB. Pricing on request.[40]

    ServiceNow AI Control Tower profile →

  5. 05

    Lasso Security

    Best for: Inline control at a proxy or AI gateway

    Builds an inventory of the AI tools and agents employees use and applies policy inline, at a proxy, through the API or at an AI gateway.[41]

    Lasso Security profile →

  6. 06

    Knostic

    Best for: Developer and agent use

    Discovers unauthorized agent use, scans MCP servers and VS Code extensions, and supports Cursor and Claude Code.[42]

    Knostic profile →

Related guides

Frequently asked questions

+What is shadow AI?

Shadow AI is the use of AI tools or features at work without the organization’s approval or oversight, such as pasting company data into a personal chatbot account, installing an AI browser extension or running an AI agent on a work laptop [1][2].

+What is the difference between shadow AI and shadow IT?

Shadow IT is any software, hardware or service used without approval; shadow AI is the AI-specific part of it [1]. It is harder to control because data leaves in the prompt itself, the same app can be approved on one account and shadow on another, and AI arrives inside software that is already approved [32][26].

+What are examples of shadow AI?

Samsung engineers entered confidential chip data into ChatGPT in 2023 [14]; a former temporary staff member at an Australian state agency uploaded data on 2,031 people to ChatGPT in 2025 [16]; and in 2026 Kaspersky warned that the viral OpenClaw agent could end up on staff’s personal devices, connected to work services, even where it was banned on work machines [18].

+Is shadow AI illegal?

Not in itself, but it can break laws and contracts. Entering personal data into a chatbot can be a reportable GDPR breach [15], a covered entity or business associate sending PHI to a tool without a business associate agreement can violate HIPAA, on our reading of HHS’s cloud guidance [25], and the EU AI Act’s AI literacy duty applies to deployers whether or not IT approved the tool, on our reading [21][23].

+How do you detect shadow AI?

Combine sources, because none sees everything: network or SSE logs for web AI apps, a browser extension or endpoint agent for prompts, desktop tools and agents, email and OAuth signals for sign-ups, code scanning for model APIs, and a no-blame survey for the rest [3][31][34][37].

+Should companies ban generative AI tools?

Bans rarely work on their own: 57% of employees already hide their AI use [9], and the NCSC advises aiming to reduce the risk rather than assuming shadow AI can be eliminated, with approved alternatives and a fast way to request new tools [2][3].

Sources

  1. [1]IBM, What is shadow AI? (2024-10-25).
  2. [2]UK National Cyber Security Centre, The hidden risks of shadow AI (2026-09-07).
  3. [3]UK National Cyber Security Centre, Shadow IT (guidance).
  4. [4]IBM, IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls (2025-07-30).
  5. [5]IBM and Ponemon Institute, Cost of a Data Breach Report 2025 (full report) (2025-07).
  6. [6]Gartner, Gartner identifies critical GenAI blind spots that CIOs must urgently address (2025-11-19).
  7. [7]Microsoft and LinkedIn, Microsoft and LinkedIn release the 2024 Work Trend Index on the state of AI at work (2024-05-08).
  8. [8]Netskope Threat Labs, Cloud and Threat Report 2026 (2026-01).
  9. [9]University of Melbourne and KPMG, Global study reveals trust of AI remains a critical challenge reflecting tension between benefits and risks (Trust, attitudes and use of Artificial Intelligence: a global study 2025) (2025-05-23).
  10. [10]MIT NANDA, The GenAI Divide: State of AI in Business 2025 (2025-07).
  11. [11]Cyberhaven Labs, 2026 AI Adoption & Risk Report (2026).
  12. [12]Harmonic Security, GenAI Data Exposure: What GenAI Usage Is Really Costing Enterprises (2025-07-31).
  13. [13]Bloomberg, Samsung Bans Staff’s AI Use After Spotting ChatGPT Data Leak (2023-05-02).
  14. [14]TechRadar, Samsung workers made a major error by using ChatGPT (2023-04-04).
  15. [15]Pinsent Masons (Out-Law), Dutch DPA warns employers of AI data breaches (2024-08-23).
  16. [16]NSW Government, NSW Reconstruction Authority: Resilient Homes Program data breach (2026-03-26).
  17. [17]TechCrunch, Trump’s acting cybersecurity chief uploaded sensitive government docs to ChatGPT (2026-01-28).
  18. [18]Kaspersky, OpenClaw threats: assessing the risks, and how to handle shadow AI (2026-02-16).
  19. [19]OSV (Open Source Vulnerabilities), CVE-2026-25253 (OpenClaw) (2026-02-01).
  20. [20]The Register, One line of malicious npm code led to massive Postmark email heist (2025-09-29).
  21. [21]EUR-Lex, Regulation (EU) 2026/1744 (Digital Omnibus on AI), including the amended Article 4 (2026-07-24).
  22. [22]European Commission, AI literacy: questions and answers (2026-07-27).
  23. [23]EUR-Lex, Regulation (EU) 2024/1689 (AI Act), Official Journal text (2024-07-12).
  24. [24]Cuatrecasas, Digital Omnibus on AI has been published (2026-07-24).
  25. [25]US Department of Health and Human Services, Guidance on HIPAA and cloud computing (2022-12-23).
  26. [26]FINRA, Regulatory Notice 24-09: FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models (2024-06-27).
  27. [27]New York State Department of Financial Services, Industry letter: cybersecurity risks arising from artificial intelligence (2024-10-16).
  28. [28]NIST, AI RMF Core (GOVERN, MAP, MEASURE, MANAGE).
  29. [29]NIST, NIST AI 600-1: Generative AI Profile (2024-07).
  30. [30]NIST, NIST AI RMF to ISO/IEC FDIS 42001 AI Management System Crosswalk.
  31. [31]Microsoft, How do I discover AI apps and the sensitive data these use in my organization?.
  32. [32]Netskope, Netskope Skylight AI Security.
  33. [33]Palo Alto Networks, AI Access Security.
  34. [34]Harmonic Security, Harmonic Security (product overview).
  35. [35]Nightfall AI, Nightfall AI (shadow AI prevention).
  36. [36]WitnessAI, WitnessAI (product overview).
  37. [37]Nudge Security, Nudge Security (product overview and pricing).
  38. [38]SentinelOne, SentinelOne to acquire Prompt Security (2025-08-05).
  39. [39]Credo AI, Shadow AI Discovery Design Partner Program.
  40. [40]ServiceNow, AI Control Tower.
  41. [41]Lasso Security, Lasso Security (homepage).
  42. [42]Knostic, Knostic (Kirin).
  43. [43]Check Point, Check Point acquires Lakera (2025-09-16).
  44. [44]EUR-Lex, Regulation (EU) 2016/679 (GDPR) (2016-04-27).
  45. [45]Nightfall AI, Nightfall AI pricing.
  46. [46]Harmonic Security, Harmonic Security pricing.
  47. [47]Holistic AI, Holistic AI (AI discovery and inventory).
  48. [48]Lakera (Check Point), Lakera homepage (Workforce AI Security).
  49. [49]AWS Marketplace, WitnessAI Unified AI Security and Governance Platform (12-month prices).
  50. [50]SentinelOne (SEC), SentinelOne Form 10-Q, quarter ended 31 October 2025 (Prompt Security acquisition completed 5 September 2025).

How we keep this page current

Every claim links to its source. We re-check this page at least every 60 days, and sooner when a standard, law or vendor changes; vendor names, acquisitions and shutdowns update automatically from our directory. Vendors cannot pay to be included or ranked.