# Unapproved AI at work: what shadow AI is and how to handle it (2026)

> By Kris Newlin · Published 2026-08-02 · Updated 2026-10-25
> Source: https://viktor.com/blog/how-to-handle-shadow-ai-on-your-team

By Kris Newlin. Updated 22 October 2026.

Shadow AI is AI use at work without IT approval or oversight: a personal ChatGPT login, a browser plugin or an unreviewed AI feature in paid software. Vendors may store or train on prompts, unchecked output reaches clients and spend lands on personal cards, so find what people use, approve safe tools, rebuild key workflows and assign owners.

## Key Takeaways

- **Definition:** Any AI use IT has not approved or cannot see, including AI features inside approved apps.
- **Risk:** Company data leaves the business, spend goes on personal cards and unchecked output reaches clients and courts.
- **Bans:** Blocking pushes people to personal accounts. A sanctioned alternative is what brings them back.
- **Fix:** Run a no-blame inventory, approve or retire tools, rebuild the top three workflows, assign owners and measure.
- **Sanctioned option:** A shared [AI employee](https://viktor.com/ai-employee) such as [Viktor](https://viktor.com) gives IT approval controls, usage visibility and a named owner per job.

## What is shadow AI?

IBM defines shadow AI as “the unsanctioned use of any artificial intelligence (AI) tool or application by employees or end users without the formal approval or oversight of the information technology (IT) department” ([IBM Think](https://www.ibm.com/think/topics/shadow-ai)). The UK’s National Cyber Security Centre calls it “a form of shadow IT” ([NCSC](https://www.ncsc.gov.uk/blogs/the-hidden-risks-of-shadow-ai)).

Unlike ordinary shadow IT, data typed into shadow AI can stay with the vendor. The NCSC warns that sensitive information sent to consumer AI “may be stored, retained or used to improve the service.” The category also covers allowed tools: “Shadow AI includes any AI use that lacks IT oversight. Even if the tool itself is technically allowed” ([Palo Alto Networks](https://www.paloaltonetworks.com/cyberpedia/what-is-shadow-ai)).

Shadow AI usually shows up in these forms:

- Personal ChatGPT, Claude or Gemini accounts used for company work.
- Browser plugins and third-party apps that add AI features through updates ([OWASP](https://genai.owasp.org/wp-content/uploads/2024/05/LLM_AI_Security_and_Governance_Checklist-v1.1.pdf)). This group also includes AI features switched on inside approved SaaS that nobody reviewed.

In the KPMG and University of Melbourne study of 48,340 people across 47 countries, 44% of the 32,352 employees surveyed said they had used AI against their organisation’s policies ([Melbourne Business School](https://mbs.edu/-/media/PDF/Research/Trust-attitudes-and-use-of-AI_Country-Insights-Report.pdf)). Gartner found that 69% of the 302 cybersecurity leaders it surveyed suspect or have evidence of prohibited public GenAI use ([Gartner](https://www.gartner.com/en/newsroom/press-releases/2025-11-19-gartner-identifies-critical-genai-blind-spots-that-cios-must-urgently-address0)).

People reach for these tools for practical reasons. [Gartner](https://www.gartner.com/en/documents/7526685) says unsanctioned use is “driven by use of GenAI tools to meet business goals faster than governance can respond”, and in [BCG’s AI at Work 2025 survey](https://www.bcg.com/publications/2025/ai-at-work-momentum-builds-but-gaps-remain) of more than 10,600 people, 54% said they would use unauthorized AI tools when corporate solutions fall short. Access matters too: [IDC reports](https://www.idc.com/resource-center/blog/shadow-ai-how-stealth-productivity-is-strangling-enterprise-ai-adoption-and-creating-a-security-nightmare/) that 39% of EMEA employees use free AI tools at work, while only 23% use organization-provided tools.

## Why shadow AI is a real risk (data, cost, quality)

Shadow AI incidents now cost more than the average breach. IBM’s 2026 Cost of a Data Breach report found that security incidents involving shadow AI more than doubled, to 43% from 20% a year earlier. Those incidents averaged USD 5.39 million, against a global average of USD 4.99 million ([IBM](https://assets.ibm.com/adobe/assets/urn:aaid:aem:21111142-1251-4369-86fb-57b82f5bb108/original/as/Cost%20of%20a%20Data%20Breach%20Report%202026.pdf)). The damage falls into three areas:

**Data:** In IBM’s data, 49% of shadow AI incidents involved data loss or compromise and 42% disrupted operations. In the KPMG study, 48% of respondents had uploaded sensitive company or customer information to public generative AI tools ([The Conversation](https://theconversation.com/major-survey-finds-most-people-use-ai-regularly-at-work-but-almost-half-admit-to-doing-so-inappropriately-255405)).

In 2023, Samsung employees pasted semiconductor source code and internal meeting notes into ChatGPT. Samsung then restricted generative AI on company devices from 1 May 2023 ([TechCrunch](https://techcrunch.com/2023/05/02/samsung-bans-use-of-generative-ai-tools-like-chatgpt-after-april-internal-data-leak/)).

**Cost:** Deloitte UK’s 2026 survey of 25,000 workers found that 17% pay for their own generative AI tools, about £1bn a year ([Deloitte](https://www.deloitte.com/uk/en/issues/generative-ai/genai-workforce-survey-shadow-ai.html)). Zylo’s 2026 index recorded expense-based SaaS spend up 267% year over year, with ChatGPT the most-expensed app ([Zylo](https://zylo.com/news/2026-saas-management-index)). See [the hidden cost of tool sprawl](https://viktor.com/blog/the-hidden-cost-of-tool-sprawl).

**Quality:** In the KPMG data, 66% of people rely on [AI output](https://viktor.com/blog/how-to-verify-your-ai-employees-work) without evaluating its accuracy and 56% report [mistakes in their work](https://viktor.com/blog/how-to-stop-ai-workslop-on-your-team) caused by AI ([KPMG](https://kpmg.com/xx/en/our-insights/ai-and-technology/trust-attitudes-and-use-of-ai.html)). In _Mata v. Avianca_, lawyers filed a brief with six fictitious citations generated by ChatGPT ([court opinion](https://law.justia.com/cases/federal/district-courts/new-york/nysdce/1:2022cv01461/575368/54/)). The court fined them $5,000 ([Reuters](https://www.reuters.com/legal/new-york-lawyers-sanctioned-using-fake-chatgpt-cases-legal-brief-2023-06-22/)).

## Why banning AI tools never holds

Blocking hides use rather than stopping it. Netskope’s 2026 Cloud and Threat Report found that 90% of organizations actively block genAI apps; even so, 47% of genAI users still use personal AI apps ([Netskope](https://threatlabs.netskope.com/reports/2026/cloud-and-threat-report-2026)). In Netskope’s customer data, that personal-app share fell from 78% a year earlier, while use of organization-managed accounts rose from 25% to 62%.

Gartner says blocking GenAI apps without viable alternatives drives employees to personal accounts ([Gartner](https://www.gartner.com/en/cybersecurity/trends/drive-secure-behavior)). In PagerDuty’s 2026 survey of 1,250 office professionals, 39% said they would rather use AI without telling anyone than be told they cannot ([PagerDuty](https://www.pagerduty.com/resources/ai/learn/survey-office-professionals-used-ai-tools-at-work-despite-not-being-allowed/)).

A sanctioned replacement gives employees a place to move to. JPMorgan Chase restricted ChatGPT in 2023 and then built its own LLM Suite, which about 250,000 employees could use by 30 September 2025 ([CNBC](https://www.cnbc.com/2025/09/30/jpmorgan-chase-fully-ai-connected-megabank.html)). The NCSC advises organisations to reduce risk “rather than assume it can be eliminated.”

## How to handle shadow AI in five steps

The steps run in order, and Step 5 measures results against the Step 1 baseline.

### Step 1: Run a no-blame inventory

Announce an amnesty first: nobody is punished for what they report. Then ask people what they use. The NCSC adds that learning why people turned to a tool shows which secure alternative to offer them.

Keep the survey to four questions:

- Which AI tools do you use for work, and on which account?
- What job does each tool do for you?
- What data goes into it?
- How often do you use it?

Then cross-check the answers against expense reports and card statements, which catch personal AI subscriptions that employees claim back ([Drel](https://drel.ai/blog/shadow-ai-vendor-discovery)). SSO logs do not show personal-account access from a corporate device ([DeepInspect](https://www.deepinspect.ai/blog/shadow-ai-discovery-framework)), and the survey finds tools people pay for themselves and never expense.

### Step 2: Sort tools into two lists: approved and retired

Account tier usually decides which list a tool goes on. OpenAI says that on consumer plans “we may use your content to train our models.” Business, Enterprise, Edu and API data is not used for training by default ([OpenAI](https://openai.com/enterprise-privacy/)).

Google’s Workspace terms say Google “will not use Customer Data to train or fine-tune” its generative models “without Customer’s prior permission or instruction” ([Google Workspace](https://workspace.google.com/terms/service-terms/)). Under GDPR, a vendor processing personal data on your company’s behalf needs a binding written contract ([EDPB](https://www.edpb.europa.eu/system/files/documents/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf)).

Run each candidate through a [security checklist for AI tool access](https://viktor.com/blog/security-checklist-for-ai-tool-access), and confirm [where your data lives with an AI employee](https://viktor.com/blog/where-your-data-lives-with-an-ai-employee) before you approve one. Retire overlaps as well. In Ramp’s February 2026 data, 16% of businesses paid for both OpenAI and Anthropic ([Ramp](https://ramp.com/data/ai-index-february-2026)), and the guide on [how to stop two AI tools doing the same work](https://viktor.com/blog/how-to-stop-two-ai-tools-doing-the-same-work) covers how to pick one. Give every retired tool an end date and a named replacement.

Before approving a new AI tool, confirm five things:

- Training opt-out confirmed in the contract or admin settings.
- Data retention window, and how deletion works.
- Full list of subprocessors, since [63.6% of third-party vendors fail to disclose AI sub-processing](https://iapp.org/news/a/how-shadow-ai-and-hidden-subprocessors-are-challenging-governance-and-compliance-efforts) in data protection assessments (IAPP).
- A current SOC 2 report.
- Admin controls and SSO.

Commit to a decision within 10 business days, so people do not route around a slow approval queue.

### Step 3: Rebuild the top three workflows in a sanctioned tool

Start where the most people and the most sensitive data overlap. A typical case is the marketer who exports ad data into a personal chatbot every Monday.

Viktor is an AI employee (here is [what an AI employee is](https://viktor.com/blog/what-is-an-ai-employee) in more detail) who works in [Slack](https://viktor.com/integrations/slack) and [Microsoft Teams](https://viktor.com/integrations/microsoft-teams), and teams that use neither can start in the web app at app.viktor.com.

- He connects to Google Ads and Meta Ads through company-owned connections and posts the Monday ad spend recap in the channel as a scheduled task.
- The same Viktor pulls the Friday pipeline update from HubSpot and sorts overnight [support tickets](https://viktor.com/blog/ai-for-customer-success), escalating the hard ones by name.

Viktor connects to [9,800+ tools](https://viktor.com/integrations), and most connect in one click. Each connection is either shared with the workspace or kept private to the person who added it and the people they invite. The guide on [how to control what your AI employee can access](https://viktor.com/blog/how-to-control-what-your-ai-employee-can-access) walks through those settings.

Hampton’s published story shows what a rebuild can look like. In 44 days, Viktor connected 24 tools, took over reporting, built 12 dashboards and took on 26 recurring jobs a week ([Hampton’s customer story](https://viktor.com/case-study)). [Move your first shadow workflow to Viktor free, with up to $100 in credits and no credit card required](https://app.viktor.com/signup).

### Step 4: Name an owner for each workflow

Every approved workflow needs one named person. That person approves sensitive actions and reviews output. They also watch spend. The article on [who should manage your AI employee](https://viktor.com/blog/who-should-manage-your-ai-employee) covers how to choose that person.

AI literacy training for the people who use the approved tools covers three things. It states what data may go into each tool, starting from the [NCSC advice that no sensitive information should go into queries to public LLMs](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk), and it shows how to check output before it reaches a client or a record. Questions go to the workflow’s named owner, and the [SANS template](https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt5a67b5223b218f02/67fd478599bc687e4aa102fa/SANS_Artificial_Intelligence_Standard_April2025.pdf) makes training a required policy section.

Viktor holds sensitive actions on an approval card with Approve and Reject buttons, and a rejected action never runs. Admins can mark any tool as needing approval or as forbidden, and joining channels, changing integration access and setting spend limits always require approval. Cards work in both Slack and Microsoft Teams. See [how to keep a human in the loop with your AI employee](https://viktor.com/blog/how-to-keep-a-human-in-the-loop-with-your-ai-employee) for review points.

### Step 5: Measure whether it worked

Published sources set no targets for shadow AI metrics, so measure against the Step 1 baseline. McKinsey found that tracking well-defined KPIs had the most bottom-line impact of 12 gen AI practices, yet fewer than one in five respondents track them ([McKinsey](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai-how-organizations-are-rewiring-to-capture-value)).

Track four numbers each quarter:

- Share of AI use on personal accounts, from the survey and expense data
- Retired tools still showing up on expense reports
- Weekly use of approved tools by team
- AI-related policy incidents

Viktor’s Activity view shows credit use by person and task. Each scheduled task also shows the time it saved and its credit cost. Spend limits and auto top-ups with a monthly cap help control usage, and [usage-based credits shared across the workspace](https://viktor.com/pricing) replace per-seat licences.

## Shadow AI vs a sanctioned AI employee

The table compares an unapproved tool with Viktor as a sanctioned AI employee on the four questions IT asks first:

```json:object
{
  "_key": "k302",
  "_type": "table",
  "rows": [
    {
      "_key": "k297",
      "_type": "tableRow",
      "cells": [
        "Dimension",
        "Shadow AI",
        "Sanctioned AI employee (Viktor)"
      ]
    },
    {
      "_key": "k298",
      "_type": "tableRow",
      "cells": [
        "Risk",
        "Consumer tiers may store prompts or train on them, and no contract covers the data",
        "Customer data is never used to train Viktor’s or providers’ models; SOC 2 Type 1 (Type 2 in progress); approval before sensitive actions (security details)"
      ]
    },
    {
      "_key": "k299",
      "_type": "tableRow",
      "cells": [
        "Visibility",
        "Personal-account use stays out of SSO logs",
        "Activity view by person and task; Enterprise audit logs include integration tool calls"
      ]
    },
    {
      "_key": "k300",
      "_type": "tableRow",
      "cells": [
        "Cost",
        "Personal subscriptions and duplicate tools are spread across expense reports",
        "Credits shared across the workspace, with no per-seat fee and spend limits set by admins"
      ]
    },
    {
      "_key": "k301",
      "_type": "tableRow",
      "cells": [
        "Ownership",
        "Belongs to whoever signed up",
        "A named owner per workflow; admins decide which tools need approval or are forbidden"
      ]
    }
  ]
}
```

Want IT to see every AI job in one place? [Set up Viktor as your sanctioned AI employee in a few minutes, with up to $100 in credits and no credit card required](https://app.viktor.com/signup). For a [company-wide rollout](https://viktor.com/blog/how-to-roll-out-an-ai-employee-to-your-whole-team), [talk to the Viktor team about onboarding, security review and spend controls](https://viktor.com/contact-sales).

## Frequently Asked Questions

Unapproved AI use often breaches policy and sometimes causes a reportable breach, so the first question is whether it counts as a security incident.

### Is shadow AI a security incident?

Employees using unapproved AI often breach company policy and sometimes cause a reportable breach, and under NIST SP 800-61 Rev. 2, now superseded by Rev. 3, acceptable-use violations count as incidents ([NIST](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf)). Under GDPR, a personal data breach includes “unauthorised disclosure of, or access to, personal data” and must be reported within 72 hours unless it is unlikely to result in a risk ([GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/2016-05-04/eng)), though Debevoise notes that most notification duties depend on unauthorized access, “which may not be satisfied in many cases of unauthorized uploads to an AI system” ([Debevoise](https://www.debevoisedatablog.com/2025/04/16/an-employee-just-uploaded-sensitive-data-to-a-consumer-ai-tool-now-what/)). To decide, check whether personal data went in, whether a contract covers it and whether the vendor trains on or retains the data.

Once data has already been pasted into a consumer AI account, the response to data leakage runs in order: delete the chats (OpenAI removes deleted consumer chats within 30 days unless it keeps them for security or legal reasons), then turn off chat history and model training in the account settings. Next, request deletion from the vendor and check its retention period, since Gemini chats already reviewed by humans are [kept up to three years and are not deleted when activity is deleted](https://support.google.com/gemini/answer/13594961). Finally, move the work to an approved tool, close or offboard the personal account and record the disclosure decision, keeping the record whatever the outcome.

### Should we block AI tools on company devices?

Block retired tools, and do it after an approved replacement is live. Gartner, writing about the sprawl of autonomous AI tools, warns that if employees cannot work in sanctioned tools, “they will likely go around the organization’s controls” ([Gartner](https://www.gartner.com/en/newsroom/press-releases/2026-04-28-gartner-identifies-six-steps-to-manage-artificial-intelligence-agent-sprawl)).

### How do we write an AI acceptable use policy?

Start from a published template. NIST’s Generative AI Profile recommends “transparent acceptable use policies for GAI” ([NIST AI 600-1](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)). The SANS April 2025 template covers definitions, prohibited uses, use approval, training and reporting. It bars confidential or personal data in open AI systems and requires expert review of all outputs ([SANS](https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt5a67b5223b218f02/67fd478599bc687e4aa102fa/SANS_Artificial_Intelligence_Standard_April2025.pdf)). Debevoise suggests separating prohibited use from permitted use. Permitted use is either restricted or generally permitted ([Debevoise](https://www.debevoise.com/insights/publications/2023/03/does-your-company-need-a-chatgpt-pilot-program)). Name approved tools by name and link the retired list from Step 2. The [NIST AI Risk Management Framework](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf) is a useful reference for AI governance.

Three data tiers set which approved tools fit each class of data:

- Public: any approved tool.
- Internal: only approved business or enterprise tiers whose terms exclude training.
- Restricted: only tools approved for that class under a signed contract, otherwise none.

Three data types get their own line:

- Client data: only in an approved enterprise tool, and only where the client contract allows it.
- Source code: never in personal accounts, only in tools approved for code.
- Personal data (PII): only in tools covered by a GDPR processor contract.

### How do we find out which AI tools people already use?

Combine a no-blame survey with expense review, SSO and OAuth logs, and network data, because each method misses something. The NCSC notes that cloud access security brokers can spot unapproved cloud services but, without intercepting encrypted traffic, cannot see personal-account use of approved services ([NCSC](https://www.ncsc.gov.uk/guidance/shadow-it)). Expense review catches reimbursed subscriptions, and the survey covers self-paid ones.

The concrete controls are OAuth tokens and third-party app grants in Google Workspace or Microsoft 365 admin consoles, read alongside [Okta and Entra logs, which track AI app usage “where applicable”](https://www.securityweek.com/ai-asset-inventories-the-only-way-to-stay-on-top-of-a-lightning-fast-landscape/), and SaaS management platforms, which [Gartner says address “lack of visibility”](https://www.gartner.com/en/documents/6790734). DLP rules or [input filters or warnings](https://www.edpb.europa.eu/system/files/documents/2025-04/ai-privacy-risks-and-mitigations-in-llms.pdf) can flag or block pasting sensitive data into AI tools, a secure web gateway or AI gateway can filter generative AI and LLM domains by category (see [Cisco Umbrella’s generative AI content category](https://www.cisco.com/c/en/us/support/docs/security/umbrella/225009-understand-new-generative-ai-content.html)), and AI features inside approved software such as Microsoft Copilot in Microsoft 365 count too, each needing a per-app admin review, as the CSA advises when it says to [catalogue “embedded AI capabilities within existing applications”](https://cloudsecurityalliance.org/blog/2025/08/08/strategic-implementation-of-the-csa-ai-controls-matrix-a-ciso-s-guide-to-trustworthy-ai-governance).

Start with one job you want off your team’s plate. [Try Viktor free with up to $100 in credits, no credit card required](https://app.viktor.com/signup).

[Add Viktor to your workspace free, with up to $100 in credits and no credit card →](https://app.viktor.com/signup)