Definition
The use of AI tools by employees without the knowledge or approval of the IT or security team — for example, pasting customer data into a free AI chatbot, or using an unapproved AI coding assistant on a work laptop. Like 'shadow IT', it creates risks the organisation cannot see or manage.
Why it matters
Research suggests only 5% of organisations have full visibility into which AI tools their employees are using. Data sent to unsanctioned AI services may be used for model training, stored insecurely, or exposed in future breaches — creating compliance and data-protection liabilities the organisation is unaware of.