FORGE
Book a Demo

Shadow AI

What is shadow AI?

Shadow AI is employees using AI tools that their organisation has not approved or cannot see: most often personal accounts of ChatGPT, Claude or Gemini, browser extensions, or AI features switched on inside other software.

It is rarely malicious. People use it because it saves them time. The risk is that company and client information goes into accounts, settings and records the organisation does not control, and nobody knows it happened.

Why it happens

The tools are good, free or cheap, and one tab away. When the approved route is slow, missing or banned, people take the quick one, often on their own phone.

Shadow AI is shadow IT with a difference: the information does not just sit in an unapproved app, it is sent to a model provider under one person's settings.

The risks

  • Confidential information sits under personal settings, where on some plans conversations may be used for training unless the person turns it off.
  • There is no record of what was shared, so the organisation cannot answer a client or a regulator who asks.
  • Uploading a client's document may breach a confidentiality agreement.
  • Personal data of customers or employees may be processed without a lawful basis.
  • AI output goes into work unchecked, with nobody accountable for it.

How to find it

Start by asking. An anonymous survey of which AI tools people use, and for what, usually finds more than any scan. Then look at:

  • web traffic to AI services, from your network or security tools;
  • expense claims and card statements for AI subscriptions;
  • browser extensions installed on company devices;
  • AI features enabled in the software you already pay for.

How to reduce it

Give people an approved tool that is as quick as the one they use now, publish a short policy that says which information may go where, and make the protections part of the tool rather than a habit.

Forge, by GradTensor, is built for this: an organisation sets the privacy rules once, personal details are masked before they reach a model, access follows projects, and every use is recorded without its content.

What does not work

  • A ban on its own. It moves AI use onto personal devices, where it is harder to see.
  • Blocking AI websites on its own. The same tools are on every phone.
  • A policy without an approved tool. It asks people to give up something useful and offers nothing in its place.

Questions

What is shadow AI?

AI tools used for work without the organisation's approval or knowledge, such as personal ChatGPT accounts, browser extensions, or AI features inside other software.

Is shadow AI the same as shadow IT?

It is a kind of shadow IT. The difference is that the information is sent to a model provider to be processed, under settings the organisation does not control.

Is using a personal ChatGPT account for work shadow AI?

Yes, if the organisation has not approved it. Even where the company has a business plan, work done in a personal account sits outside it.

Is it safe to upload confidential documents to ChatGPT? →
Should we ban AI tools to stop shadow AI?

A ban alone tends to make shadow AI worse, because people keep using the tools where you cannot see them. An approved tool and a clear policy work better.

A sample AI policy for employees →

Read next

Book a Democontact@gradtensor.com