A communications adviser at a municipality has until four o'clock to rewrite a letter in plain language. Copilot is switched on, but the result keeps coming out stiff. In a second tab she opens the free version of ChatGPT, pastes the letter in and has what she needs within two minutes. Nobody forbade her to do that, and nobody knows it happened.
That is shadow AI. Not a hack, not bad faith, not unknown software on the laptop: an ordinary service in an ordinary browser, started by someone who wanted to finish her work. A ban does not remove that service. It only removes the tab you could still see.
What do we mean by shadow AI?
The definition we use has three parts, and all three have to hold.
The tool is self-serve: anyone can create an account online and start, with no procurement and no admin involved. The organisation has taken no decision on it; nobody said it is allowed, and nobody said it is not. And the tool is actually in use, within the last thirty days, not tried once and abandoned.
That last part does most of the work. A tool someone opened once in January is not a governance question. A tool twenty people opened this month is.
What falls outside: a tool that only works with a licence or through the organisation's own sign-in. Someone working in a business environment through the company login is using something the organisation set up, even if there are still questions about how. That is a procurement question, not shadow AI.
Why does it appear?
For one reason: the work gets easier. Rewriting a letter, summarising a meeting, explaining a piece of code, checking an email in a second language. The tool does in two minutes what used to take half an hour, and that is the entire motivation.
The preferred tool usually exists. It just does not feel adequate for this one job: too stiff, too slow, no access to the web, or simply not the tool someone already got used to at home. Then the tool that gets the work done wins, and that is usually a free account in a second tab.
That people do not report this is not a sign of bad faith. In the study by KPMG and the University of Melbourne of 48,000 workers in 47 countries (2025), 57 percent say they hide their AI use from their employer, and 48 percent admit to having put sensitive company information into a public AI tool. Reading that as an employee problem misses the point. It is a signal that the approved route and the working day do not line up.
Why does a ban move the problem instead of solving it?
A ban works on the network and on the managed laptop. It does not work on the phone in someone's pocket, on the home connection, or on the personal account that existed before the ban did. The use continues; only the part you could see disappears. How that plays out is covered in more detail in blocking AI does not make you safer.
There is a second effect. The use that remains almost always runs through a free account, and that is exactly the account type you did not want: free and business accounts process the same prompt under very different terms. The Dutch Data Protection Authority reported receiving several data breach notifications in which employees had entered personal data into an AI chatbot, and advises organisations to make clear agreements: whether it is allowed, and which data may go in. A ban is not an agreement. It is the end of the conversation.
The third effect is the quietest. A ban removes the reason to report anything. Someone using a tool that is not allowed does not tell IT. So IT never hears that the approved tool falls short, and the reason for the use stays in place.
None of this argues for allowing everything. An organisation may reject a tool, and sometimes has to. The point is that a rejection is a decision, with a reason and an alternative attached, not a door that closes.
Is every use without permission also risky?
No, and this distinction saves a lot of unnecessary work.
Without permission only means the organisation has said nothing about it yet. Whether the use is risky depends on two other things: the tool itself (where the data goes, whether it trains on it, under which terms, in which country) and what someone puts into it.
An employee polishing a press release in a free translation tool, a press release that goes online tomorrow anyway, is doing something without permission and without meaningful risk. An employee pasting a client file into the approved tool, when the agreement was that this is not done, is using an allowed tool and taking a real risk. The tool's status answers the first question; what is in the prompt is a second question with its own answer.
For that first question, four outcomes are enough, and the last two are the ones most often confused.
| Status | What it says | What the organisation still has to do |
|---|---|---|
| Allowed | Assessed, and the use is fine | Look again after an acquisition, an incident or new terms |
| Limited use | Allowed under a condition the organisation writes itself | Explain that condition in one sentence, at the moment it matters |
| No decision yet | Nobody has looked at it; the starting state of every tool | Assess it, starting with the tools that are actually used |
| Not allowed | Assessed, and the organisation would rather people use something else | Name the alternative and say why |
"No decision yet" is an honest outcome: it says the organisation has not assessed the tool. "Not allowed" is a choice, and it needs a reason and an alternative. Treating the two as one quietly bans everything new, which is the ban from above in a different coat.
Here is what that looks like in practice. A municipality has allowed Copilot, with a policy that says: use the approved tool. An inventory shows that, next to Copilot, Perplexity, ChatGPT and three specialised tools are in use: a translation service, a service that summarises meetings, and an AI feature inside a vendor's word processor. Two of them appear nowhere in the register. That is not an incident. It shows that the register is not keeping up with the working day, and that "no decision yet" is the correct status for those two until someone has looked.
What information does an organisation need, then?
Four things, and none of them is about individuals.
Which AI services are opened in the organisation, and how often. That is a list of domains, and it is shorter than you would expect: a few dozen, not thousands. Browser extensions belong on it, because an extension with read access is an AI tool too.
Which of those services have a decision, and which do not. That is the difference between a policy and a register: the policy says what is allowed, the register says per tool what was decided.
What share of the use runs through the approved tools. If that share drops while the policy stays the same, the preferred tool is falling short, and that is a procurement conversation, not an enforcement conversation.
And whether the decision arrives at the moment it matters. A register on the intranet is read on the first day of employment and never again. A decision that appears when someone opens the tool does get seen.
