# What is shadow AI? Definition and pitfall to avoid

> Shadow AI refers to the use of generative AI models by employees without validation or framing from their company. Widespread in 2025-2026, it creates legal, financial (leakage of business data to public models), and quality (unaudited outputs integrated into client deliverables) risks.

## Definition
Shadow AI is the AI equivalent of shadow IT, extended in 2024-2025 to nearly all companies. The figures converge: 45.2% of US workers aged 18 to 64 used generative AI for work in the second quarter of 2026 (Federal Reserve Bank of St. Louis, FRED series), up from 37.4% in August 2025. This measure does not separate sanctioned use from shadow use. A PagerDuty/Wakefield Research survey (fielded April 2026, 1,250 office professionals in non-IT roles at companies with $500M+ revenue) quantifies the scale on the corporate side: 66% of those who use AI for work have done so with a tool they believed was not permitted. 88% have shared work information with a public AI tool: 34% customer data, 31% financial information, 31% confidential documents or strategies. Four mechanisms feed shadow AI. The free nature of consumer tools (ChatGPT, Claude.ai): an employee only needs a personal email address. Perceived performance: public models produce useful results immediately. Slowness of official deployment: between identifying a need and providing a validated tool, several months often pass. Lack of explicit policy: without a written AI policy, employees interpret silence as tacit authorisation. These mechanisms show up in the data: 89% of users first adopted the tool in their personal life, 44% use it to work around the limits of company-approved tools, and 38% have delivered AI-assisted work without disclosing it. Frequent consequences: transmission of confidential documents to external models, use of outputs in deliverables without legal review.

## Example
An 80-employee HR consulting firm detects in 2025, during a GDPR audit, that 45 consultants use ChatGPT from their personal account to prepare client assessments. Estimated cumulative volume: 8,000 conversations over 9 months, containing personal data of about 1,200 individuals (candidates, evaluated employees). Company response: formal information to the persons concerned, legal audit, implementation of a written AI policy, deployment of a validated internal tool (Claude Enterprise with European hosting), mandatory training. Total cost of the incident: 95,000 euros, including the audit, client communication, training, and three departures of employees not wanting the new framework.

A publicly documented case, on a larger scale: Samsung Semiconductor (Korea), March-April 2023. Three separate incidents in 20 days saw engineers submit proprietary source code, internal meeting notes and chip test data to ChatGPT (free account, data re-usable for training under the terms of service at the time). Samsung responded in April 2023 with a company-wide ban on ChatGPT across corporate devices and networks, then announced work on an in-house LLM. The incident served as a sector-wide wake-up call: Amazon, Apple, JPMorgan and Verizon adopted similar restrictions in the following months.

## For a leader
The pitfall to avoid with shadow AI is not the spontaneous use of AI by employees, it is the absence of an appropriate organisational response. Three non-negotiable measures in 2026. First, write and distribute an explicit AI policy: which tools are authorised, which types of data must never be transmitted, which outputs require human validation. A well-written one-page AI policy is worth more than a fifty-page never-read internal rulebook. Second, quickly open an official AI access channel. If your employees find a useful tool in shadow, there is a real need; blocking it without alternative creates permanent workaround. Third, do not sanction without training. A shadow AI discovery should trigger information and training before any disciplinary action, except in case of serious confidentiality violation.

*Shadow IT, shadow AI and BYOD: what sets them apart*

|  | Shadow IT | Shadow AI | BYOD |
| --- | --- | --- | --- |
| Scope | Unsanctioned apps or SaaS | Generative models (ChatGPT, Claude.ai) via personal accounts | Personal devices used at work |
| Primary risk | Security, data governance, uncontrolled spend | Data leakage + reuse by public models for training | Endpoint security, work/personal boundary |
| Detection | MDM / proxy audits, card statements | DNS audits + surveys + deliverable review | Mandatory enrolment or network blocking |
| Typical framing | Approved SaaS catalogue | Written AI policy + official channel of equivalent performance | BYOD policy + MDM on enrolled devices |
| Emergence | ≈ 2010 (consumer SaaS) | 2023 (public release of ChatGPT) | ≈ 2010 (personal smartphones at work) |
| GDPR impact | Varies by processed data | High as soon as personal data is sent to the LLM | Varies by access and enrolled apps |

## FAQ

**What's the difference between shadow AI and shadow IT?**
Shadow IT refers to unsanctioned digital tools (SaaS, apps). Shadow AI is its 2024-2026 extension: use of generative models (ChatGPT, Claude.ai) via personal accounts, with an added risk: transmitted data is often used to train or improve the public models.

**Is using ChatGPT in shadow AI illegal?**
Not per se, but it often breaches GDPR (or equivalent laws) when employees send personal data (candidates, clients, staff) to a public model without a legal basis or informing the individuals. The controller (the company) remains liable for processing carried out through these tools.

**How can I detect shadow AI in my organisation?**
Three signals: proxy or DNS audits for the relevant domains (chatgpt.com, claude.ai, gemini.google.com), non-punitive anonymous surveys, and deliverable analysis (LLM-typical phrasing, uncorrected hallucinations). In France, 73% of private-sector employees use AI at work (Ipsos bva, May 2026).

**Why do employees use AI in shadow mode?**
Four documented reasons: free consumer tools, immediate productivity gains, slow official rollout (often several months), and lack of an explicit policy, so silence gets read as tacit permission. 89% of office professionals who use AI for work first adopted it in their personal life.

**How do you frame shadow AI without killing innovation?**
Three non-negotiables: publish a one-page AI policy (allowed tools, banned data, outputs requiring review), quickly open an official channel of equivalent performance, and prioritise training over sanction. Blocking without an alternative creates permanent workarounds.

**What does a shadow AI incident actually cost?**
Illustrative case: an 80-person HR consultancy finds that 45 consultants use ChatGPT on client data. Legal audit, client communication, training and three resignations bring the bill to about €95,000. Indirect costs (trust erosion, GDPR non-compliance) are typically far higher.

## See also

- [Shadow AI Barometer 2026](https://wyp.agency/en/glossary/shadow-ai-barometer-2026/)
- [GDPR and AI](https://wyp.agency/en/glossary/gdpr-ai/)
- [Guardrails](https://wyp.agency/en/glossary/guardrails/)
- [Usage discipline](https://wyp.agency/en/glossary/usage-discipline/)
- [Training data](https://wyp.agency/en/glossary/training-data/)
- [Hallucination](https://wyp.agency/en/glossary/hallucination/)
- [Delegating to AI agents](https://wyp.agency/en/glossary/delegating-to-ai-agents/)
- [Workslop](https://wyp.agency/en/glossary/workslop/)
- [AI literacy (Article 4)](https://wyp.agency/en/glossary/ai-literacy/)

## Sources

- Generative Artificial Intelligence, Adoption Rate for Work: Employed Adults (series RPSGENAIUSAGESHAREWORK, Real-Time Population Survey, workers aged 18 to 64), FRED, Federal Reserve Bank of St. Louis, Q2 2026 value released 4 August 2026 (https://fred.stlouisfed.org/series/RPSGENAIUSAGESHAREWORK)
- The State of Generative AI Adoption in 2025, Bick, Blandin & Deming, Federal Reserve Bank of St. Louis, 13 November 2025 (https://www.stlouisfed.org/on-the-economy/2025/nov/state-generative-ai-adoption-2025)
- CNIL, "Artificial intelligence" topic page (in French) (https://www.cnil.fr/fr/intelligence-artificielle)
- PagerDuty Shadow AI Survey, conducted by Wakefield Research, fielded 9-20 April 2026 (1,250 office professionals in non-IT roles, companies with $500M+ revenue, US/UK/JP/AU, margin of error ±2.8 pts) (https://www.pagerduty.com/newsroom/shadow-ai-workplace-survey-2026/)
- AI at work: behind mass adoption, shadow uses, Ipsos bva × Greenworking, 23 September 2026 (fielded 12-25 May 2026, in French) (https://www.ipsos.com/fr-fr/ia-au-travail-derriere-ladoption-massive-des-usages-fantomes-et-des-managers-en-premiere-ligne)

---
Entry from the WYP.agency AI glossary · https://wyp.agency/en/glossary/shadow-ai/ · Last updated : 2026-10-14