Shadow AI is the use of artificial intelligence tools inside an organisation without anyone having approved, contracted or assessed them. It is not sabotage or bad faith: it is a salesperson pasting a contract into a chatbot to summarise it, somebody in finance uploading a spreadsheet to a translator, a developer copying code to have it reviewed. Each of those gestures solves a real problem in thirty seconds, and none of them is recorded anywhere.
The problem is not that people use AI. It is that the organisation does not know it happens, and therefore cannot decide anything about it. It cannot know what information has left, to which providers, or under what contractual terms. It cannot complete its record of processing activities with real data. It cannot answer when a customer, an auditor or a regulator asks which AI tools it uses. And it cannot train anyone about a use that officially does not exist.
Internal surveys do not measure it. Nobody voluntarily declares what they suspect they should not be doing, so the result always comes in below reality, and often far below. The only reliable measurement observes the actual traffic towards AI tools, and that measurement is almost always uncomfortable: the number of distinct services is usually several times what management expected.
There are two ways to respond. The first is to ban, which is what almost everybody does and what almost never works: a ban with no alternative does not remove the usage, it pushes it out of sight. The second is to offer an authorised route and put a technical control at the point where the information leaves, so that what must not leave does not, and everything else is recorded. That second route is more work up front and is the only one that produces evidence.
This category collects the articles on where the data goes out, how much unapproved AI there really is in an average company, and what can be done about it without slowing anyone down. If what you need is what the law requires once you know what is happening, the starting point is the regulation section.
