A communications adviser at a municipality has until four o'clock to rewrite a letter in plain language. Copilot is available, but the result keeps coming out stiff. In a second tab she opens the free version of ChatGPT, pastes in the letter and has what she needs within two minutes. Nobody told her not to, and nobody knows it happened.
That is shadow AI. Not a hack, not bad faith, not unknown software on the laptop: an ordinary service in an ordinary browser, started by someone who wanted to do her work well. The question for the organisation is not who did this, but whether anything has been decided about this tool yet.
What do we mean by shadow AI?
The definition we use has three parts, and all three have to hold.
The tool is self-serve: anyone can create an account online and get started, without procurement or an admin being involved. The organisation has taken no decision on it: nobody has said it is allowed, and nobody has said it is not. And the tool has actually been used in the last thirty days, not tried once and abandoned.
That last part does most of the work. A tool someone opened once in January is not a governance question. A tool twenty people opened this month is.
What falls outside the definition: a tool that only works with a licence or through the organisation's own sign-in. Someone working in a business environment through the company login is using something the organisation set up, even if there are still questions about how. That is a procurement question, not shadow AI.
Why does it happen?
For one reason: the work gets easier. Rewriting a letter, summarising a meeting, explaining a piece of code, checking an email in a second language. The tool does in two minutes what used to take half an hour, and that is the entire motivation.
There is usually a preferred tool. It just does not feel up to this particular job: too stiff, too slow, no web access or simply not the tool someone has got used to at home. So the tool that gets the work done wins, and that is usually a free account in a second tab.
The fact that people do not report this is not a sign of bad faith. In the study by KPMG and the University of Melbourne of 48,000 workers in 47 countries (2025), 57 per cent say they hide their AI use from their employer, and almost half admit to having put sensitive company information into a public AI tool. Above all, it shows that the approved tools and the working day do not yet line up.
Does a ban help against shadow AI?
A ban without an alternative only goes part of the way. It works on the network and the managed laptop, but not on the phone or the home connection, and the work someone used the tool for is still there. So part of the use shifts to places you cannot see. Our article on blocking AI covers how a workable alternative and clear rules change that.
There is a second effect. The use that remains often runs through a free account, and that is exactly the account type you did not want: free and business accounts process the same prompt under very different terms. The Dutch Data Protection Authority reported receiving several data breach notifications in which employees had entered personal data into an AI chatbot, and advises organisations to set clear rules: whether it is allowed, and which data may go in. A ban without explanation does not answer that second question.
And there is a third effect: someone using a tool that is not allowed is less likely to mention it. So IT never hears that the approved tool falls short, even though that is exactly the information you need.
None of this argues for allowing everything. An organisation may reject a tool, and sometimes has to. The point is that a rejection is a decision, with a reason and an alternative attached. The organisation can also choose to stop employees going on to that tool and send them straight to the alternative; then everyone knows why, and where the work can be done.
Is all use without permission risky?
No, and this distinction saves a lot of unnecessary work.
"Without permission" only means the organisation has said nothing about it yet. Whether the use is risky depends on two other things: the tool itself (where the data goes, whether it trains on it, under which terms, in which country) and what someone puts into it.
An employee polishing a press release in a free translation tool, a press release that goes online tomorrow anyway, is doing something without permission and without meaningful risk. An employee pasting a client file into the approved tool, when the rule was that this is not done, is using an allowed tool and taking a real risk. The tool's status answers the first question; what is in the prompt is a second question with its own answer.
For that first question, four outcomes are enough, and the last two are the ones most often confused.
| Status | What it says | What the organisation still has to do |
|---|---|---|
| Allowed | Assessed, and the use is fine | Look again after an acquisition, an incident or new terms |
| Limited use | Allowed under a condition set by the organisation | Explain that condition in one sentence, at the moment it matters |
| No decision yet | Nobody has looked at it; the starting status of every tool | Assess it, starting with the tools that are actually used |
| Not allowed | Assessed, and the organisation would rather people use something else | Name the alternative and say why |
"No decision yet" is an honest outcome: it says the organisation has not assessed the tool. "Not allowed" is a choice, and it needs a reason and an alternative. Treating the two as one quietly bans everything new, including tools that would turn out to be fine.
Here is what that looks like in practice. A municipality has allowed Copilot, with a policy that says: use the approved tool. An inventory shows that, alongside Copilot, Perplexity, ChatGPT and three specialist tools are in use: a translation service, a service that summarises meetings and an AI feature inside a vendor's word processor. Two of them do not appear anywhere in the register. That is not an incident. It shows that the register is not keeping up with the working day, and that "No decision yet" is the correct status for those two until someone has looked.
What information does an organisation need, then?
Four things, and none of them is about individuals.
Which AI services are opened in the organisation, and how often. That is a list of domains, and it is shorter than you would expect: a few dozen, not thousands. Browser extensions belong on it, because an extension with read access is an AI tool too.
Which of those services have a decision, and which do not. That is the difference between a policy and a register: the policy says what is allowed, the register records what was decided for each tool.
What share of use goes through the approved tools. If that share drops while the policy stays the same, the preferred tool is falling short, and that is a procurement conversation, not an enforcement conversation.
And whether the decision reaches people at the moment it matters. A register on the intranet is read on someone's first day and rarely after that. A decision that appears when someone opens the tool does get seen.
