What is a Shadow AI?

It's the AI-era extension of shadow IT — an employee pastes sensitive company data into a public chatbot to get a quick answer, or a team adopts an AI coding assistant or automation tool without going through security review, because the sanctioned alternative is slower or doesn't exist yet. The convenience gain is real, which is exactly why shadow AI proliferates even in organizations with clear policies against it. The risk is data exposure: public AI tools may log, retain, or train on submitted data depending on their terms of service, meaning confidential business information, customer data, or credentials pasted into an unsanctioned tool can leave the organization's control entirely, often without anyone in security being aware it happened. This is a growing focus area for SOC 2 and GDPR compliance programs, since "we don't know what data left the company" is precisely the accountability gap those frameworks are meant to close. The practical fix isn't just prohibition — since employees turn to shadow AI when the sanctioned tooling is inadequate, effective governance usually pairs a clear acceptable-use policy with actually providing capable, approved AI tools so there's no gap for shadow usage to fill.