Shadow AI
Staff using unauthorised AI tools with company data.
Adoption that happens outside IT’s knowledge — personal accounts, free tiers, browser extensions — usually because the sanctioned option is slower or less capable.
It is a signal at least as much as a risk: the demand is real and the official tool is losing. The effective response is a good sanctioned option plus clear rules, not prohibition alone.
Its cause is almost always friction: the sanctioned path is slower, worse, or unavailable. Blocking makes it invisible rather than absent, so the productive responses are to make the approved option genuinely better and to give people a way to request something without a committee.
Why people paste into a personal account
A sanctioned assistant takes two days for access approval.
People work around it because the delay is real. Reducing onboarding to minutes and allowing low-risk usage by default addresses the incentive; the alternative is policy nobody follows and data leaving through channels nobody monitors.
- reportState of AI-assisted software development 2025 ↗
Frames AI as an amplifier of the organisation it lands in: the same tooling helps strong delivery cultures and compounds problems in weak ones.
- docsData controls in the OpenAI platform ↗
Training-use and retention controls, including default abuse-monitoring retention and Zero Data Retention eligibility. Vendor-specific, and no substitute for your own privacy review.
Data Governance
Rules about what data may be used, by whom, and retained how long.
Adoption Curve
The path from a few enthusiasts to real usage.
Privacy
Protecting the people whose data flows through the system.
ROI · Return on investment
Did it save more than it cost?