Right now, someone in your organisation is pasting a confidential contract into ChatGPT and asking it to "summarise the key obligations." Someone else is uploading a spreadsheet of customer records into a free AI tool to generate a pivot analysis. A third person is feeding proprietary source code into an AI coding assistant that wasn't procured, wasn't vetted, and wasn't approved by anyone.

None of these actions will appear in your security logs. None will trigger a DLP alert. None will show up in your next compliance audit. And every single one of them represents a data exfiltration event that your organisation has zero visibility into.

Welcome to Shadow AI. It's not coming. It's already here. And you're almost certainly not detecting it.

Shadow IT Had a Child, and It's Smarter Than You Think

Security teams spent the last decade fighting Shadow IT—unauthorised SaaS applications, personal cloud storage, rogue software installations. They built controls. They deployed CASBs. They wrote policies. And then generative AI arrived, and every one of those controls became insufficient.

Here's why Shadow AI is fundamentally different from Shadow IT:

• Zero installation required. Most AI tools run entirely in a browser. There's nothing to install, nothing to detect on an endpoint, nothing for MDM to flag. An employee opens a tab, types a URL, and starts pasting confidential data. Your endpoint security sees a browser session. That's it.
• Data leaves on the input side, not the output. Traditional DLP looks for sensitive data leaving the network. Shadow AI inverts this—employees voluntarily push data to external platforms. They're not downloading secrets; they're uploading them. Most DLP configurations weren't designed for this direction of travel.
• The value proposition is immediate and obvious. Shadow IT was often about convenience. Shadow AI is about capability. An employee who uses AI to draft a board report in 20 minutes instead of four hours isn't going to stop because you sent a policy memo. The productivity gain is too real, too visible, and too personal.

A 2025 survey by Cyberhaven found that 27.4% of data put into AI tools by employees is sensitive. Not mildly confidential—sensitive. Client data, financial records, HR information, source code. And most organisations had no idea it was happening.

What Your Employees Are Actually Doing

Let's stop being abstract. Here are the patterns we see repeatedly in organisations that engage us for security assessments:

The Innocent Summariser

Middle managers pasting entire email threads—complete with client names, deal values, and internal strategy discussions—into ChatGPT to get a summary before a meeting. They don't think of this as a data leak. They think of it as being prepared. But every word of that thread is now stored on OpenAI's servers, potentially used for model training, and entirely outside your data governance framework.

The Code Accelerator

Developers copying proprietary code into AI coding assistants—not the enterprise-licensed ones with data retention agreements, but the free tiers that explicitly state they may use inputs for model improvement. Your intellectual property is now training material for a model that your competitors can also use. Try explaining that to your legal team.

The Model Shopper

This is the pattern that should alarm you most. Employees who have been told they cannot use ChatGPT simply switch to Claude. When that gets blocked, they move to Gemini. Then Perplexity. Then Mistral. Then whatever new model launched this week. For every AI tool you block, three more exist that you haven't heard of yet. Model shopping is the new tab-switching, and it makes whack-a-mole look like a viable strategy by comparison.

The Shadow Workflow

Entire teams quietly building AI-dependent workflows—using free tools to automate report generation, data analysis, email drafting, even client-facing communications. These workflows become embedded in daily operations. The team becomes dependent on them. And nobody in IT, security, or management knows they exist until the free tier runs out, the tool changes its terms, or something goes wrong.

The Data Exfiltration Problem Nobody Wants to Quantify

Let's call this what it is: when an employee pastes sensitive data into an unauthorised AI tool, that data has left your organisation. It is now on a third-party server, governed by that third party's privacy policy, data retention terms, and training data agreements—none of which you agreed to, reviewed, or even knew about.

Consider what a typical week of Shadow AI usage looks like across a 200-person organisation:

• Customer lists, contact details, and account information pasted into AI tools for analysis
• Financial reports and forecasts uploaded for summarisation
• Internal HR documents—performance reviews, salary data, disciplinary records—processed through AI for drafting responses
• Legal contracts and negotiation strategies fed into AI for clause analysis
• Proprietary methodologies, pricing models, and competitive intelligence shared for "help with a presentation"

None of this shows up in your data loss prevention reports. None of it triggers your SIEM. None of it appears in your incident management system. It's not a breach by any technical definition your tools recognise, but the data is gone just the same.

And here's the compliance dimension that boards need to understand: under GDPR, if personal data of EU subjects is processed by an AI tool without a valid Data Processing Agreement, appropriate legal basis, and documented safeguards, you have a compliance violation. Not a theoretical one. An actual, reportable, fineable violation. The fact that an employee did it "without authorisation" is not a defence—it's an indictment of your controls.

Why Detection Is So Difficult

Traditional security monitoring was built for a different threat model. It looks for malware, unusual network traffic, suspicious login patterns, and known attack signatures. Shadow AI doesn't trigger any of these because, from a technical standpoint, an employee using ChatGPT looks identical to an employee browsing the web.

Specifically:

• HTTPS encryption means your network monitoring can see the domain being accessed but not the content being transmitted. You know someone visited chat.openai.com. You don't know they pasted your entire client database into it.
• Browser-based access means no application-level controls. There's no executable to block, no API call to intercept at the application layer. It's a web form in a browser.
• Personal devices bypass everything. If your organisation permits BYOD—or even if it doesn't, but employees check work email on personal phones—AI tools on personal devices accessing work data create a detection blind spot that is practically infinite.
• AI tool proliferation makes blocklisting impractical. New AI tools launch weekly. Maintaining a comprehensive blocklist of every AI platform, API endpoint, and access URL is a full-time job—and you'll always be behind.

The honest assessment: most organisations cannot reliably detect Shadow AI usage with their current security tooling. That's not a criticism of their tools. It's a structural limitation of the threat model those tools were designed for.

Building an AI Governance Framework That Actually Works

Here's where most guidance on this topic falls apart. The typical recommendation is: "create an AI acceptable use policy." That's necessary but wildly insufficient. A policy without enforcement is a suggestion, and suggestions don't stop data leaks.

An effective AI governance framework needs four layers:

Layer 1: Policy and Classification

Start with a clear, specific AI Acceptable Use Policy that goes beyond "don't use unauthorised tools." Your policy must answer the questions employees actually have:

• Which AI tools are approved, and for what purposes?
• What types of data can and cannot be used with approved tools?
• What constitutes "sensitive data" in the context of AI inputs? Be explicit—employees often don't consider a client's name in a meeting summary to be "sensitive data."
• What are the consequences of policy violations?
• How do employees request new AI tools to be evaluated and approved?

That last point is critical. If there's no legitimate pathway for employees to get AI tools approved, they'll use them illegitimately. Every prohibition without an alternative is an invitation to circumvent.

Layer 2: Technical Controls

Policy alone won't suffice. You need technical controls that create genuine friction:

• DNS and proxy filtering: Block known AI tool domains at the network level. Yes, employees will try to get around this. The point isn't to be watertight—it's to move Shadow AI from "casual and easy" to "deliberate and difficult."
• Browser extensions and endpoint monitoring: Deploy tools that can detect clipboard activity involving known AI platforms. Several EDR solutions now offer this capability.
• Cloud Access Security Brokers (CASBs): If you have one, update its policies to cover generative AI platforms. If you don't have one, this is a strong argument for procurement.
• DLP reconfiguration: Update your DLP rules to monitor outbound data to AI tool domains. Most DLP solutions can be configured to detect sensitive data patterns in HTTPS POST requests to specific domains.
• Sanctioned alternatives: Provide enterprise-licensed AI tools with proper data retention agreements, DPA compliance, and controlled access. Microsoft Copilot with enterprise data protection, Azure OpenAI Service, or Anthropic's Claude Enterprise—tools where the organisation controls data handling terms.

Layer 3: Monitoring and Detection

You cannot manage what you cannot measure. Implement ongoing monitoring that gives you visibility into AI tool usage patterns:

• Track web traffic to known AI platform domains—even if you can't see the content, traffic volume and patterns tell a story
• Monitor for new, previously unknown AI domains in your traffic logs
• Review SaaS audit logs for AI tool integrations (employees connecting AI tools to authorised platforms via OAuth)
• Conduct periodic access reviews: who has accounts on which AI platforms, and what data categories are they working with?

Some organisations are now conducting "AI audits"—structured assessments where teams are asked to disclose their AI tool usage in a non-punitive context. The results are consistently surprising. Departments that leadership assumed were "not technical enough" to use AI are often the heaviest users.

Layer 4: Culture and Enablement

This is the layer most organisations skip, and it's the one that determines whether everything else works.

If your AI governance framework is purely restrictive—block, monitor, punish—you will lose. Employees will find workarounds faster than you can deploy controls. The productivity gains from AI are too significant for prohibition to be sustainable.

Instead, pair controls with enablement:

• Provide sanctioned tools that are genuinely useful, not watered-down versions that frustrate users into going around them
• Offer training on responsible AI use—not a 30-minute compliance video, but practical guidance on how to use approved tools effectively without exposing sensitive data
• Create fast-track approval processes for new AI tools that employees want to use. If the evaluation takes six months, employees won't wait
• Involve department heads in governance decisions. The legal team and the engineering team have very different AI needs. A one-size-fits-all policy will fit no one.

The goal isn't to prevent AI usage. It's to bring it inside your perimeter of visibility, governance, and control.

The EU Regulatory Angle

For organisations operating within the EU—and that includes most of the businesses we work with—there's an additional layer of urgency.

The EU AI Act is now in force. The GDPR hasn't gone anywhere. NIS2 is imposing cybersecurity obligations across a widening range of sectors. And Shadow AI creates violations across all three simultaneously:

• GDPR: Personal data processed by unauthorised AI tools without a DPA, without a legal basis for the transfer, without data subject awareness. Article 28 requires a contract with any processor. That free ChatGPT account isn't a contracted processor.
• EU AI Act: If an AI tool is being used to make decisions that affect people—even internally—there may be transparency and documentation obligations that your shadow usage is silently violating.
• NIS2: Organisations in scope must implement supply chain security measures and report significant incidents. Uncontrolled AI tool usage represents an unmanaged supply chain risk, and a data exposure through a shadow AI tool could constitute a reportable incident.

The regulatory risk is not hypothetical. Supervisory authorities are beginning to ask specific questions about AI tool usage in their audits. "Which AI tools does your organisation use?" is becoming a standard audit question. If your honest answer is "we don't know," you have a problem that no amount of retroactive policy can fix.

What to Do on Monday Morning

If you've read this far and you're concerned, good. Here's a practical starting point—five actions you can take immediately:

• Conduct an AI usage survey. Ask every department what AI tools they're using. Make it anonymous if necessary. Make it non-punitive. The goal is visibility, not punishment. You will be surprised by the results.
• Review your web proxy logs. Look for traffic to known AI platform domains: openai.com, anthropic.com, gemini.google.com, perplexity.ai, mistral.ai, and similar. Volume and frequency will tell you the scale of the problem.
• Draft an AI Acceptable Use Policy. If you don't have one, create one this week. If you do have one, review whether it addresses the specific scenarios described in this article. A policy from 2023 is already outdated.
• Evaluate enterprise AI options. If you want employees to stop using free consumer AI tools, give them something better. Enterprise-licensed AI with data protection controls is the single most effective mitigation against Shadow AI.
• Brief your board. Shadow AI is not an IT issue. It's a data governance issue, a compliance issue, and a business risk issue. The board needs to know it exists, understand the exposure, and approve the resources to address it.

The Bottom Line

Shadow AI is not a technology problem with a technology solution. It's a governance gap that opened the moment generative AI became freely available, and it widens every day that organisations pretend their existing security controls are adequate.

Your employees aren't malicious. They're pragmatic. They've found tools that make them dramatically more productive, and they're using those tools because you haven't given them a sanctioned alternative or a compelling reason to stop. That pragmatism is currently exfiltrating your sensitive data into third-party platforms with no contractual obligations to you, no data retention limits you agreed to, and no legal protections you can enforce.

The question isn't whether your organisation has a Shadow AI problem. It does. The question is whether you'll discover it on your own terms—or whether a regulator, a data breach, or a departing employee will discover it for you.

---

Concerned about Shadow AI in your organisation? IWH helps businesses identify unauthorised AI usage, build practical governance frameworks, and implement technical controls that balance security with productivity. Let's talk.