Shadow AI is any AI tool people use for work that nobody at your organization approved or keeps track of. You find it by asking your team, checking what’s connected to your Microsoft 365 or Google account, and then monitoring it, because a one-time sweep goes stale fast.

Look, somebody on your team is using an AI tool you never approved. We’d put money on it. And honestly? We get it. It saves them an hour a day and nobody said they couldn’t, right?

So we don’t see this as a discipline problem. People found something that makes their job easier. The problem is you have no idea where your data just went, and you can’t manage something you can’t see.

What actually counts as Shadow AI?

When people hear the term, they picture someone pasting a contract into ChatGPT. That’s part of it, sure. But there’s a lot more out there than that:

  • Personal accounts on tools like ChatGPT, Claude, or Gemini, used for work.
  • Browser extensions that read whatever’s on the page to help you write or summarize.
  • AI notetakers that join your meetings. Sometimes one person signs up and it starts showing up on calls they’re invited to.
  • AI features that got turned on inside software you already pay for.
  • Apps someone connected with “Sign in with Microsoft” or “Sign in with Google,” which may now have access to their mail or files.

That last one is the one we’d worry about most. A pasted document is one document. But what are the chances Phil in accounting read the permissions screen before clicking Accept on that new AI app? That connection can keep reading long after everybody forgot it was there.

Why should you care?

Mostly because of what happens to your data. What a vendor can do with it depends on the type of account, not just the product name. Some personal plans can use your conversations to train their models unless you turn that off, while business plans generally don’t by default. Terms change a lot, so check the current ones. We keep a vendor evaluation guide that walks through what to look for.

There’s also the question of who’s checking the work. AI models make things up all the time, and they sound completely sure of themselves when they do. If nobody knows it was used, nobody knows to double-check it. Then that wrong answer gets pasted into the next document, and the one after that, until you’ve got a game of telephone running inside your own company.

And then somebody asks. A client questionnaire, an auditor, or a cyber insurance renewal may want to know how you manage AI, and “we think people mostly use Copilot” isn’t a great answer.

How do you find it?

Just ask

Seriously, start here. Send a short survey or bring it up at a staff meeting, and be clear nobody’s getting in trouble. Ask what they use, what they use it for, and what they put into it. You’ll learn which jobs people actually want help with, too.

Check what’s connected to your accounts

If you’re on Microsoft 365, have whoever runs your admin account open Enterprise applications in Microsoft Entra to see which apps people have signed in to and what permissions they’ve been given. Google Workspace has a similar list in the admin console. If you only do one technical check, we’d make it this one.

Check expense reports and card statements

Look for AI subscriptions. A $20 a month charge doesn’t raise any flags, so it tends to slip through.

Look at browsers and meetings

Check which browser extensions are installed on company machines, and notice which bots keep showing up in your meeting invites.

Then monitor it

Everything above gives you a snapshot, and new tools show up all the time. AI monitoring tools can show you which AI services people are using on company devices, and some can step in before sensitive data gets uploaded. None of this sees a personal phone on a home network, though. That’s why the conversation with your team matters as much as the tooling.

Okay, you found it. Now what?

We wouldn’t start by blocking everything. We know it’s tempting, but in our opinion it rarely works. People can just move to their phones, and now you’ve lost what little visibility you had.

Here’s what we’d do instead. Go through the list and sort each tool into one of three buckets: approve it, approve it with limits, or say no. Then give people a good approved option, because if the tool they need is sitting right there with a business account behind it, we think most of them will use it. Write down the rules so everyone knows what’s allowed. Our free AI Policy Builder gets you a first draft in about five minutes.

Last, keep checking. Even a monthly look is fine.

If you’d rather have someone do this with you, finding what’s in use is where our AI governance service starts, and keeping an eye on it each month is part of it too.