May 15, 2026
Written by Lesedi Phochana
Shadow AI is the new shadow IT and how organisations respond will define who leads and who gets left behind over the next three years.
Somewhere in your organisation right now, someone is pasting a client proposal into ChatGPT to clean it up. Someone else is using an AI summariser on a board report. A developer is asking Copilot to write a function that touches your production database schema. None of it is going through IT. None of it is on your risk register.
This is Shadow AI, the unsanctioned use of AI tools inside enterprise environments and the data on how widespread it has become should give every data and technology leader pause.
– 78% of employees bring their own AI tools to work, bypassing IT entirely
(Microsoft & LinkedIn Work Trend Index, 2024)
– 38% of employees share confidential company data with AI platforms without approval
(CybSafe & National Cybersecurity Alliance, 2024)
– $650K+ average additional cost per breach when shadow AI is involved
(IBM Cost of a Data Breach Report, 2025)
And yet despite those numbers McKinsey’s State of AI research found that by early 2024, 91% of employees were already using generative AI for work tasks. The tools aren’t going away. The question is what organisations do about it.
WE’VE SEEN THIS FILM BEFORE
When cloud storage appeared, employees started using Dropbox before IT had a policy for it. When messaging apps arrived, teams were on WhatsApp before security had a framework. In both cases, the business had a choice: ban it and lose the productivity gain or get ahead of it and channel the behaviour into governed infrastructure.
Most organisations that banned eventually reversed. The ones that moved quickly to govern are the ones who built institutional muscle around new technology. We are now at that same inflection point with AI except the stakes are considerably higher, because the data being shared is often customer records, financial models, and proprietary source code rather than a shared folder.
The Samsung incident from early 2023 illustrated this vividly. Engineers fed proprietary source code into ChatGPT for debugging assistance, unaware that inputs could be stored and potentially surfaced in responses to other users. The breach reportedly cost millions and exposed trade secrets. That wasn’t malicious behaviour, it was employees solving a problem with the tools available to them. Which is exactly what makes shadow AI so difficult to manage through policy alone.
“The risk isn’t that your people are using AI. The risk is that you don’t know what they’re feeding it.”
WHY A BLANKET BAN DOESN’T WORK
The instinct when shadow behaviour surfaces is to lock things down. Issue a policy. Block the domains. Add it to the acceptable use document nobody reads. The compliance and legal exposure from an employee feeding customer PII into an external model is real, and the concern is legitimate.
But the data suggests pure restriction creates its own problem. According to the Awareways Trend Report 2025, 47% of new employees say AI access actively influences their choice of employer. Block AI and you don’t just slow your team down you start losing the people most motivated to use it well. In a competitive talent market, that trade-off is harder to justify than it looks on a risk register.
IBM’s 2025 Cost of a Data Breach report reinforces the governance gap: organisations with high levels of shadow AI paid on average $650,000 more per breach than those with low levels or none and 63% of organisations still lack any formal AI governance policy. The cost of not acting isn’t theoretical anymore.
WHAT GOOD LOOKS LIKE RIGHT NOW
The organisations getting this right are doing a few things differently. First, they’re running controlled discovery, actively mapping where unsanctioned AI usage is happening before responding, rather than being reactive after an incident. Reco’s 2025 State of Shadow AI Report found that many unsanctioned tools show median usage durations of over 400 days. At that point, the tool isn’t an experiment anymore, it’s embedded in a business process, and removing it becomes a disruption, not just a policy fix.
Second, they’re building tiered access frameworks: open sandboxes where teams can experiment with non-sensitive data, private enterprise deployments for workflows that touch customer or financial data, and clear escalation paths for use cases that need individual review. Netskope’s 2026 Cloud and Threat Report found that when organisations provide approved AI alternatives, unauthorised usage drops significantly because most people aren’t trying to circumvent security, they’re just trying to do their jobs faster.
Third, and this is the part most organisations underinvest in: they’re pairing governance with genuine enablement. Running internal literacy workshops. Embedding AI-aware people into business units rather than centralising all capability inside IT. Making the right path easier than the shadow path.
THE BIGGER PICTURE
There is a version of this story that data and AI leaders should be genuinely excited about. The fact that your workforce is hungry to use AI is not a liability, it’s an asset most organisations would pay for if it didn’t already exist for free. McKinsey’s research consistently shows that the biggest barrier to AI value isn’t model capability, it’s adoption. The organisations that channel this bottom-up energy into governed, data-aware infrastructure will compound their advantage fast.
The window to shape the habits, workflows, and cultural norms around AI is right now. Not because the tools are going to stop evolving, they won’t but because the patterns your teams build in the next 12 months are the ones that will be hardest to change in 36.
Shadow AI isn’t the enemy of your AI strategy. Handled well, it might be the most honest signal you have about where to start building one.
I’d genuinely like to hear how other organisations are navigating this, particularly the tension between control and enabling productivity. Drop a comment or feel free to reach out directly.
