I'm presenting today at the AI World Congress in London on the topic of Shadow AI for the Enterprise, and thought it might be helpful to share some insights here too. Shadow AI is quietly reshaping how work gets done across enterprises: and not always in ways that leadership intended. While employees are discovering powerful ways to boost productivity with AI tools, they're also creating serious risks that most organisations haven't fully grasped yet. In many organisations, “Shadow AI” is the norm rather than the exception.

The term “shadow AI” refers to artificial intelligence tools and systems being used within an organisation without the knowledge or approval of IT and security teams. Think of that marketing team using ChatGPT to draft campaign copy, or the analyst uploading sensitive customer data to an external AI platform for quick insights. It's happening right now, across departments, often with the best intentions but potentially devastating consequences.

Why Shadow AI Matters

Unapproved AI tools are a double-edged sword. On the positive side, they can accelerate experimentation, reduce manual effort, and help teams move faster than traditional IT processes allow. In a recent Salesforce survey, 71% of workers said they already use generative AI at work – and more than half of them are doing so without their employer’s explicit approval.

• Expose sensitive or personal data to third parties
• Create compliance and regulatory breaches
• Lead to inconsistent decisions and “black box” logic
• Duplicate spend not aligned with strategy

Gartner (2024) estimates that by 2027, 75% of enterprise software engineers will use AI coding assistants.

The Numbers Don’t Lie: Shadow AI is Everywhere

• 90% of organisations are concerned about shadow AI; 46% are "extremely worried" (Komprise).
• 97% of organisations encountered generative AI security issues last year. (Industry research)
• AI-associated data breaches cost over $650,000 per incident (IBM 2024).
• 1 in 5 UK companies experienced data leakage due to generative AI tools.

The Real Risks: Beyond Data Leakage

Intellectual Property and Competitive Intelligence

Employees using unauthorised AI tools may leak strategic plans, customer lists, code, or financial info to external providers. Nothing is ever truly free, is it? Sometimes, with those inputs used to train public models, and the data is the price that the organisation is paying to use AI.

Compliance and Regulatory Nightmares

Shadow AI can result in non-compliance due to lack of audit trails, unclear data flows, and jurisdictional risk. This is particularly the case in sensitive areas such as finance, healthcare, and other regulated industries.

The Quality Problem: Hallucinations and Bias

Unmonitored models deliver misleading, inaccurate, or biased results, impacting decisions and creating “model drift”.

Security Vulnerabilities

Consumer-grade AI tools may lack enterprise security controls, opening up new attack vectors and increasing overall cyber exposure.

Building Your Defence: Practical Solutions

75% of organisations are implementing data management and AI discovery tools to address shadow AI (Komprise).

Start with Governance, Not Prohibition

Map workflows, identify friction points, approve safe tools, and define clear data classification rules.

Implement Technical Controls

• Data Loss Prevention (DLP)
• CASB (Cloud Access Security Broker)
• Enterprise-grade AI licences, with audit and data protection

Continuous Monitoring and Discovery

Deploy discovery tools to monitor browser-based AI use and flag risky behaviour.

Change Management and Human Oversight

Require governance for AI rollouts, staged integration, and human review for mission-critical outputs.

When Things Go Wrong: Your Incident Response Plan

1. Pause & assess
2. Contain
3. Report
4. Engage vendors
5. Improve

The Path Forward: Balance, Not Prohibition

Shadow AI isn’t going away—so invest in balanced governance frameworks, robust controls, and real-time monitoring. This is the intelligent approach to safeguard reputation and leverage AI’s genuine benefits.

Curious how your organisation compares or where to start? Contact Jen Stirrup for an AI risk assessment and tailored data governance review.