Review Shadow AI

Shadow AI is the use of AI tools, accounts, integrations, or workflows outside an organization's approved governance, security, procurement, or visibility processes.

Employees may adopt a public assistant, browser extension, automated workflow, or personal account to get work done without the organization knowing what data or decisions are involved.

Hidden use creates unknown data flows, contracts, dependencies, quality risks, and incident paths. It can also signal that approved tools do not meet real workflow needs.

An employee pastes confidential meeting notes into a free personal chatbot because the approved system lacks a useful summarization feature.

Shadow AI is not solved only by prohibition. Organizations also need usable alternatives, literacy, clear boundaries, and a safe path for employees to surface unmet needs.

If the organization cannot see the AI use, it cannot govern the risk or learn from the need.

* [[sensitive-information|Sensitive Information]] * [[workaround|Workaround]] * [[guardrail-displacement|Guardrail Displacement]] * [[ai-literacy|AI Literacy]] * [[ai-governance|AI Governance]]

* [NIST AI 100-1, Artificial Intelligence Risk Management Framework](https://doi.org/10.6028/NIST.AI.100-1) — governance framework supporting inventory, accountability, and oversight of AI use. * [NIST AI 600-1, Generative Artificial Intelligence Profile](https://doi.org/10.6028/NIST.AI.600-1) — AI-specific guidance on third-party resources, acceptable-use policies, monitoring, and governance.

* Treat hidden use as both a governance risk and a [[friction|Friction]] signal.