Shadow AI: Finding and Managing Unauthorized AI Tools in Your Organization

Shadow IT used to mean unauthorized Dropbox folders. In 2026 it's staff pasting client details into free chatbots, installing "AI writing" browser extensions, and signing up for transcription tools that store meetings in unknown clouds.

Blocking everything kills productivity. Ignoring everything invites data leakage and compliance failure. The middle path is discover → classify → redirect.

How shadow AI shows up

• Public ChatGPT/Claude/Gemini sessions on work topics
• AI meeting recorders joining Zoom/Teams without IT review
• Chrome extensions that rewrite email or "summarize" pages, with broad permissions
• Mobile apps processing photos of documents
• Department-purchased "AI CRM add-ons" with unclear data handling

Discovery signals:

• Identity logs (unsanctioned OAuth apps)
• Network/DNS (if you filter outbound to known AI domains)
• Expense and card reports
• Direct ask in staff survey, anonymity helps honesty

Risk tiers

Tier	Example	Response
Critical	PHI/PII in public tools	Block + mandatory training + approved alternative
High	Internal financials, HR records	Enterprise tool with logging or prohibit
Medium	Generic marketing copy, no sensitive data	Guidelines + optional approved tool
Low	Personal use, no org data	Acceptable use policy reminder

Policy in one page

Staff should understand:

• What data classes never go into public AI
• Which enterprise tools are approved (Copilot, internal bot, etc.)
• How to request a new tool
• Consequences, framed as protection, not punishment

Channel, don't only block

If staff use shadow AI because official tools are slow or missing:

• Deploy approved internal assistant on SOPs and IT docs
• Offer Copilot or equivalent for roles that need drafting help
• Provide fast security review for requested tools (48-hour target)

Prohibition without alternative fails.

Technical controls (proportionate)

• DLP rules on M365/Google for paste patterns where feasible
• Block known risky extensions via browser policy
• SSO-only for approved SaaS
• Monitor OAuth consent grants

Perfection isn't required, reduce casual leakage while governance matures.

Quarterly shadow AI review

Add to IT council agenda:

• New tools discovered
• Incidents or near-misses
• Approved catalog updates
• Training completion

Precipice helps clients inventory SaaS and AI usage during security assessments. Request a review.