Shadow AI is the use of AI tools, models or AI-built software at work without the knowledge or approval of IT and security. It ranges from an employee pasting a contract into a public chatbot to a team shipping an app built with an AI code generator that reads the production database.
It is rarely malicious. People use AI because it saves them hours, and approved options are often missing or slow to arrive. That is exactly why banning it does not work. Governing it means giving people a sanctioned way to do the same thing.
Why shadow AI happens
- AI is free and instant. A browser tab is all it takes, with no procurement step.
- The demand to build outpaces IT. An operations manager can describe an app and have AI generate it in an afternoon, instead of waiting months in an engineering backlog.
- AI arrives inside approved tools. SaaS products switch on AI features that send data to new places without a new review.
- Policies lag. Many companies still have no clear rule for what is allowed.
Examples of shadow AI
- Public chatbots with company data: customer lists, source code or financials pasted into ChatGPT, Claude or Gemini on personal accounts.
- AI features inside SaaS: meeting recorders, writing assistants and CRM AI turned on without a data review.
- Browser extensions: AI helpers that read every page an employee visits, including internal tools.
- Meeting bots: recorders that join calls and store transcripts in systems nobody approved.
- AI-built apps: tools generated with Lovable, Bolt or Replit, connected to a real database with an admin key, and shared across the team.
- Personal automations: Zapier or Make flows that push company data through an AI step to an outside model.
- Shadow agents: AI agents that act on email, calendars or records with an employee's credentials.
The risks
- Data leakage: confidential or personal data sent to third-party models, sometimes retained for training.
- Compliance breaches: GDPR, HIPAA or contractual data rules broken without anyone noticing.
- Uncontrolled access: AI-built apps that give everyone full access to production data.
- No audit trail: when something goes wrong, there is no record of what the AI saw or did.
- Wrong outputs in real decisions: unreviewed AI answers used in customer, legal or financial work.
- Orphaned tools: apps and automations nobody maintains once their creator leaves.
How to govern shadow AI
1. Find it
Check SaaS and expense logs, browser extension inventories and network traffic to AI domains. Ask teams directly; most will tell you.
2. Classify it
Separate harmless uses from ones touching sensitive data or taking actions. Focus effort where the risk is.
3. Publish a short policy
One page: what is allowed, which data must never go into which tools, and how to request something new.
4. Offer sanctioned alternatives
This is the step that actually reduces shadow AI. Give people an approved assistant and an approved way to build apps and agents on company data, with permissions and logging built in.
5. Enforce where it matters
Use SSO, data loss prevention and access controls on the highest-risk systems, and log every AI action on production data.
6. Review regularly
New AI tools appear every month. Re-run discovery each quarter.
Where Jet Admin fits
Much shadow AI is really shadow software: people building the tools they need because the official route is too slow. Jet Admin gives them a sanctioned route. Teams describe the app or agent, Jet builds it on company data from 200+ integrations without copying it, and IT keeps control: row-, column- and action-level permissions, SSO and audit logs on the Business plan and above, and on-premise or air-gapped deployment on the Enterprise plan.
Frequently asked questions
What is shadow AI?
AI tools, models, apps or agents used at work without IT or security approval or oversight.
What is the difference between shadow AI and shadow IT?
Shadow IT is any unapproved technology. Shadow AI is the AI subset, and it adds new risks because AI can see, generate and act on data.
Should companies ban AI tools?
Bans usually push use further out of sight. Approved alternatives with clear rules work better.
How common is shadow AI?
Very. Surveys consistently find that a majority of employees who use AI at work use at least some tools their company has not approved.
Give people a sanctioned way to build
Start with Jet Admin for free and build AI apps on company data under IT's controls.