Unapproved AI tools pose governance challenges for IT teams
Employees using AI tools without IT approval, known as shadow AI, can expose confidential data and complicate audits.
Shadow AI refers to employees using artificial intelligence tools at work without the knowledge or approval of IT, cybersecurity or risk management teams. Staff often turn to such tools to summarise documents, write reports, analyse data and generate code in order to work faster.
The concern is that confidential information, such as customer data or business strategy, may be shared with external platforms. In one example, an organisation with 500 employees and 2,000 laptops kept an official list of three approved AI tools, while 47 were in actual use.
Auditors asking for a complete inventory of AI use can struggle to get an accurate picture. In one case, a survey returned 86 responses naming only 14 applications. Such use often stems from approved tools being unavailable, hard to use or slow to procure, rather than deliberate defiance.