Shadow AI (2026): What It Is, Why Employees Use It, the Risks and How to Manage It

TL;DR

Shadow AI is the use of AI tools at work without the company's approval or oversight, such as pasting a customer contract into a free chatbot or connecting a personal AI agent to a work inbox. It is widespread: in KPMG and the University of Melbourne's 2025 study, almost half of employees admitted using AI in ways that contravene company policy, and IBM's 2025 breach research found that one in five breached organizations reported a breach due to shadow AI. Banning AI rarely works, because employees use these tools to get real work done. The approach that does work is to find what is in use, set a short policy, and give people a sanctioned option that is better than the one they found. Sentra, the managed organization memory for teams and AI agents, is one such option: it gives every employee and agent the company's context with each source's permissions, and Sentra Agent asks before it sends, books or posts.

What is shadow AI?

Shadow AI means any AI tool, model or agent used for work that the company's IT or security team has not approved and cannot see. It includes consumer chatbots used with company data, AI features switched on inside existing apps, browser extensions that read every page, and agents that employees connect to their own work accounts.

It is a newer form of shadow IT, with one important difference. An unapproved project-management app stores the data you put in it. An AI tool may also learn from it, act on it, or send it somewhere else, often through an agent that holds an employee's login.

Why employees use unsanctioned AI

Most shadow AI starts with a good intention. Employees have a deadline and a tool that helps. Microsoft's 2024 Work Trend Index, a survey of 31,000 knowledge workers in 31 markets, found that 75% were using generative AI at work and that 78% of AI users were bringing their own AI tools to work.

• The approved tool is missing or worse. If the company offers nothing, or offers an assistant that cannot see the information people need, they go elsewhere.
• Approval is slow. A procurement review that takes a quarter loses to a free sign-up that takes a minute.
• The policy is unclear. People cannot follow a rule they have not been told about. The University of Melbourne's 2025 release on the KPMG study reported that only 40% of employees said their workplace had a policy or guidance on generative AI use.
• Personal agents are good. Agents that manage email, calendars and bookings for one person are genuinely useful, and employees bring them to work. Our guide to personal AI agents at work covers them.

The risks of shadow AI

Data leakage

The most common risk is company information leaving approved systems. KPMG and the University of Melbourne's 2025 global study of more than 48,000 people in 47 countries found that almost half of employees admitted using AI in ways that contravene company policies, including uploading sensitive company information into free public AI tools, according to the University of Melbourne.

Breaches that cost more

IBM's Cost of a Data Breach Report 2025, based on breaches at 600 organizations, found that one in five organizations reported a breach due to shadow AI, and that organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs. Only 37% had policies to manage AI or detect shadow AI, and 63% of breached organizations either had no AI governance policy or were still developing one.

No permissions

When an employee pastes a document into a chatbot, the document's access controls stay behind. When an agent is connected with an employee's credentials, it can often reach far more than the task needs. IBM found that 97% of organizations that reported an AI-related security incident lacked proper AI access controls. Our guide to AI agent permissions explains how agents should inherit the access of the person they act for instead.

No audit trail

If the company cannot see the tool, it cannot see what was shared, what the tool answered or what an agent did. That makes it hard to respond to an incident, a customer question or a regulator.

Wrong answers acted on

A consumer tool knows nothing about the company's current decisions. The same KPMG study found that 66% of employees rely on AI output without evaluating its accuracy and 56% have made mistakes in their work because of AI. An answer that sounds right but uses last quarter's pricing can reach a customer.

How to detect shadow AI

• Review OAuth grants in Google Workspace and Microsoft Entra for AI apps and agents that employees have connected to their work accounts.
• Check network and SaaS discovery logs for traffic to AI services, if you run a secure web gateway or a SaaS management tool.
• Audit browser extensions on managed devices, since many AI extensions read every page a user opens.
• Look at expenses and card statements for AI subscriptions bought by individuals and teams.
• Check which AI features are switched on inside the apps you already approved, because many vendors add them by default.
• Ask people. An anonymous survey about which tools help them most usually finds more than any log, and tells you what the sanctioned option has to beat.

How to manage shadow AI without banning it

Blocking every AI domain pushes use onto personal phones, where the company sees even less. A better sequence is to find what is in use, decide which tools are allowed for which kinds of data, and make the approved route the easiest one.

1. Write a one-page policy. Say which tools are approved, which data must never go into an unapproved tool, and who to ask about something new.

2. Classify data simply. Public, internal and restricted is enough for most companies, with clear examples of each.

3. Approve quickly. Publish a short review process for new AI tools, with a target of days rather than months.

4. Offer a sanctioned option people prefer. This is the step that actually reduces shadow AI, and it is covered below.

5. Review regularly. Repeat discovery every quarter, since new tools and new AI features appear constantly.

The positive answer: a sanctioned agent that already knows the company

Employees reach for unapproved tools because the tools help them work. To replace them, the sanctioned option has to help more, and the thing consumer tools cannot do is know the company. A free chatbot does not know what was decided in Tuesday's meeting or what the customer was promised. That gap is why people paste documents into it, which is exactly the leakage the policy is trying to stop.

Sentra closes that gap from the company's side. It reads Slack, email, meetings, calendar, docs and project tools such as GitHub, Linear, Jira and HubSpot, keeps each fact with its source and the newest version on top, and serves the same memory to people in Slack and to AI agents over MCP and REST. Permissions follow the source, so each person, and any agent acting for them, sees only what they could open in the original tool. Slack DMs are excluded from answers, and admins assign data-access roles for email, meetings and files.

For employees who want a personal agent, Sentra Agent is a sanctioned AI assistant for work: it reads only the sources a person connects, briefs them before meetings, tracks what they owe and does browser tasks such as bookings and forms. It waits for approval before it sends, books or posts, and it follows guardrails the company sets, such as spend limits and systems it may never touch. Because it already knows the company's context, employees have less reason to copy that context into a tool nobody approved.

If your teams are choosing business AI agents now, our buyer guide to AI agents for business compares the main options and what each one needs.

Shadow AI governance checklist

• We know which AI tools, extensions and agents are in use, and we repeat discovery every quarter.
• We have a one-page AI policy that names approved tools and restricted data, and every employee has seen it.
• New AI tools can be reviewed and approved in days.
• Approved assistants and agents inherit each person's permissions from the source tools rather than using shared admin access.
• Agents need a person's approval before they send, book, buy or post, and the company can set limits they cannot exceed.
• AI features inside approved apps have been reviewed, not just left on by default.
• Employees have a sanctioned assistant that knows the company's context, so they do not need to paste it elsewhere.
• There is a named owner for AI governance and a way to report a new tool or a mistake without blame.

Frequently Asked Questions