Is shadow AI illegal?

Not by itself — it is a governance and security risk rather than a crime. But it can create real legal exposure if the data shared violates a data-protection law, a client contract, or a confidentiality agreement.

How common is shadow AI at work?

Very common. Microsoft’s 2024 Work Trend Index found that roughly 78% of AI users bring their own AI tools to work, often without formal IT approval.

What's the difference between shadow AI and shadow IT?

Shadow IT covers any unapproved software or hardware. Shadow AI is the AI-specific subset, and it carries extra risk because AI tools can retain, learn from, or redistribute the data fed into them, not just store it.

Does banning AI tools at work solve the problem?

Rarely. Outright bans tend to push usage underground rather than end it, so most security teams now favor visibility plus an approved alternative — see the NIST AI Risk Management Framework — over a blanket ban.

Is using ChatGPT itself shadow AI?

Not inherently. It becomes shadow AI only when used without the organization’s knowledge or approval; the same tool used through a company-sanctioned account is not.

What Is Shadow AI — and How Should Businesses Manage It?

Shadow AI is the use of artificial intelligence tools inside a company or organization without the knowledge, review, or approval of its IT or security team. An employee pasting a client contract into a personal ChatGPT account to summarize it, a developer running an unapproved coding assistant, or a sales rep using a browser plug-in that quietly sends prospect data to an outside model — all of these count as shadow AI. The tools themselves are often perfectly legitimate; the problem is that nobody responsible for the organization’s data and compliance obligations knows they are in use.

An Old Problem With a New Name

The term borrows from shadow IT, the decades-old practice of employees adopting software or hardware their IT department never vetted — think unauthorized cloud storage accounts or personal messaging apps used for work chats. Shadow AI is a sharper version of the same problem, because generative AI tools don’t just store data, they can retain it for training, expose it in later outputs, or pass it to third parties through their own supply chains. Handing a chatbot a spreadsheet is a different kind of risk than saving that spreadsheet to an unapproved cloud drive.

How It Shows Up in Practice

Shadow AI rarely looks like a single rogue app. It shows up as a personal-account version of an enterprise tool (free ChatGPT instead of a company-licensed one), as a coding assistant installed straight from an IDE marketplace, as a browser extension that summarizes emails, or — increasingly — as an AI feature quietly switched on inside software the company already uses, without anyone flagging it to IT. That last category is why the problem keeps growing even at organizations that think they’ve locked things down: approving a SaaS product is no longer the same as approving every AI feature bundled inside it.

Why It’s a Real Risk, Not Just a Policy Nuisance

The risk isn’t hypothetical. IBM’s 2025 Cost of a Data Breach Report found that one in five breached organizations had experienced an incident linked to shadow AI, and that organizations with high levels of shadow AI paid roughly $670,000 more per breach on average than those with little or none. The same report found that 63% of breached organizations had no AI governance policy at all, and only 37% had any approval process for AI tools. Shadow AI incidents were also disproportionately likely to expose customer personal data. The underlying failure mode is usually simple: sensitive information — source code, financial records, health data, unreleased product plans — ends up inside a system whose data-retention and training practices nobody checked, a question we cover in more depth in what actually happens to your data when you use an AI tool. Some of this overlaps with plain data loss prevention, the older discipline of stopping sensitive data from leaving a company’s control, which shadow AI adds a new front to.

How Companies Are Getting Ahead of It

Security teams increasingly treat shadow AI as a visibility problem before it’s a rules problem: you can’t govern what you can’t see. That starts with discovering which AI tools are already in use — through network and SaaS-usage monitoring — rather than assuming a ban is enough. Outright bans tend to just push usage further underground, since employees who find an AI tool genuinely useful for their job will keep using it one way or another. The more durable approach is to define which data categories can never go into any AI tool, offer an approved alternative for the tasks people actually want AI for, and build a lightweight process for reviewing new tools instead of a blanket “ask permission for everything” policy that nobody follows. A useful starting point for any business building this from scratch is the US National Institute of Standards and Technology’s AI Risk Management Framework, a free, vendor-neutral guide to identifying and managing AI-related risk that many companies use as a template for their own AI usage policy — the same governance gap that shows up across enterprise AI adoption generally.

Why It Matters for Georgia

A Business Association of Georgia survey found that 84% of Georgian companies are already adopting AI in some form — a pace of uptake that is unlikely to be matched by formal IT policy. Most of that adoption is happening the way it does everywhere else: individual employees and teams picking up free or personal-account AI tools because they’re useful, not because a company rolled out an approved platform. For Georgian businesses handling client, financial, or health data — and for any company that will eventually need to show compliance under a framework like the EU AI Act — getting basic visibility into which AI tools staff already use is a cheap, practical first step, well before drafting a full governance policy.

In the News

Georgia’s fast pace of informal AI adoption is exactly the backdrop shadow AI risk grows in — see our report on the BAG survey finding 84% of Georgian companies adopting AI.