Every company has an official list of software it uses, and a second, unofficial list of AI tools people actually use day to day. The gap between those two lists is shadow AI — and it's usually bigger than leadership assumes, because almost none of it was a deliberate purchasing decision.
Why shadow AI is different from ordinary shadow IT
Shadow IT — an employee signing up for an unapproved SaaS tool — has been a known problem for over a decade, and the fix is mostly procedural: tighter procurement, single sign-on, an approved-tools list. Shadow AI doesn't respond as well to that playbook, because most of it doesn't arrive as a new purchase at all. It arrives as a feature switched on inside software you already vetted and approved years ago.
Four ways shadow AI actually shows up
An employee pastes customer data into ChatGPT
To draft a reply, summarize a complaint, or debug an issue — because it's faster than the internal tool, not because anyone approved it.
A vendor quietly ships an AI feature into a tool you already pay for
Your CRM, helpdesk, or video-call tool adds an "AI-powered" summary or suggestion feature in a routine update. Nobody re-approved the tool because, on paper, it's the same tool you already vetted.
A manager signs up for a free AI tool with a company card
A CV-screening add-on, a scheduling assistant, an AI note-taker for meetings — approved by whoever needed it that week, never logged anywhere central.
A developer wires an LLM API call into an internal script
Solves a real problem fast. Becomes permanent infrastructure nobody flagged as "an AI system" because it was never a product decision — it was a Tuesday-afternoon fix.
Why it matters beyond "we should have a policy"
A policy that says "get AI tools approved before using them" doesn't solve the vendor case — nobody re-reads your terms of service every time a tool ships a feature update. And it doesn't solve the developer case — a quick internal script rarely gets treated as a formal "tool" at all, even though functionally it is one.
What actually works is the inverse approach: instead of trying to prevent every unofficial AI adoption before it happens, run a periodic sweep that asks each team directly what they're actually using — not what's on the approved list — and treat that as the real input to your AI inventory. You can't govern what you haven't found.
Frequently asked questions
Is shadow AI the same as shadow IT?
It's a subset of the same problem — unsanctioned tools adopted outside official procurement — but shadow AI is worse in one specific way: shadow IT tools mostly just create a security or licensing gap, while shadow AI tools can carry direct legal obligations under regulation like the EU AI Act regardless of who approved them.
How do I find shadow AI in my company if nobody reports it?
Ask department heads directly rather than relying on an IT asset list — shadow AI adoption rarely goes through procurement. Also check for AI feature toggles inside tools you already pay for; vendors add them without a separate purchase, so your existing software list won't show them.
Am I legally responsible for AI tools I didn't approve?
Often yes. Regulatory obligations generally attach to the business deploying or providing the AI system, not to whether a specific purchase was centrally approved. Not knowing a tool exists doesn't remove the obligation — it just means you find out about the gap later, usually at a worse time.
Surface your shadow AI
DiscloseAI's free assessment is built around the same principle — asking directly what each team actually uses, not relying on a procurement list that misses most of it. Free EU AI Act check →