Your team is already using AI tools you never approved. Banning them won’t work, so here’s a practical way to bring shadow AI into the light without slowing anyone down.
Here’s an uncomfortable question for any CEO: how many AI tools does your company use?
If you answered with a number, it’s probably wrong. And you’re in good company.
In a March 2026 survey for Okta’s AI Agents at Work report, 90% of executives said they were confident they could see which AI tools their organization used. Meanwhile, 52% of knowledge workers admitted to using unapproved AI tools, and 16% had shared their login credentials with one. In the US, unapproved use hit 67%.
That gap has a name: shadow AI. In this post I’ll cover why it happens, what it actually costs, and a simple plan to get ahead of it without becoming the Department of No.
Why your people go around you
Let’s be honest. Nobody pastes a customer contract into a random chatbot because they want to cause a breach. They do it because they have a deadline, the tool is fast, and the approved alternative is either missing or buried behind a three-week procurement process.
Shadow AI is mostly a supply problem, not a discipline problem. When the official path is slower than the unofficial one, the unofficial one wins. Every time.
What it actually costs
This is where it stops being a hallway conversation and becomes a board conversation.
IBM’s 2025 Cost of a Data Breach report found that one in five organizations studied had a breach tied to shadow AI. Those breaches cost an average of $670,000 more than breaches with little or no shadow AI, and they exposed personal data in 65% of cases, compared with 53% across all breaches (TechRepublic).
The same report found that 63% of breached organizations had no AI governance policy, or were still writing one. IBM’s researchers pointed to weak access controls as the common thread in nearly all AI-related incidents.
And it isn’t only about breaches. Shadow AI quietly creates:
- Data you can’t get back. Once confidential files go into a third-party tool, you don’t control where they live or how long.
- Decisions you can’t explain. If a model helped write a pricing proposal or screen a candidate, can anyone reconstruct how?
- Spend you can’t see. Dozens of individual subscriptions on expense reports add up, with no volume pricing and no security review.
- Awkward answers to customers. The next enterprise security questionnaire will ask how you govern AI. “We trust our people” is not a great answer.
Why banning it doesn’t work
The instinct is to block everything. In my experience, it mostly moves the problem to personal phones and home laptops, where you have even less visibility. You also send a message that leadership doesn’t understand how work gets done now. The people most likely to route around a ban are often your most productive ones.
The goal isn’t zero AI. It’s AI you can see, trust and defend.
A 30-day plan to bring shadow AI into the light
You don’t need a 40-page policy to start. Here’s what I’d do first:
- Ask, don’t audit. Run a short, no-blame survey: which AI tools do you use, for what, and with what kind of data? Amnesty gets you honest answers. Audits get you silence.
- Classify your data in plain English. Three buckets is enough: public, internal, and never-leaves-the-building (customer data, health or financial records, source code, contracts). Most risk lives in that third bucket.
- Pave the road. Pick one or two approved AI tools with business or enterprise terms that keep your data out of model training, and roll them out with single sign-on. Make the safe path the fast path.
- Write a one-page policy. What’s approved, what data can go where, and who to ask. If it doesn’t fit on a page, nobody will read it.
- Turn on visibility. Use what you already own (identity provider logs, browser management, expense reports) to spot new AI tools as they appear.
- Review quarterly. AI tools change monthly. Your list should too.
None of this is glamorous. That’s the point. Good governance should be boring, cheap and mostly invisible to the people doing the work.
Key takeaways
- Shadow AI is already in your company. Survey data suggests leaders consistently overestimate how much they can see.
- It has a real price tag. IBM ties shadow AI to costlier breaches and more exposed personal data.
- Bans backfire. They push usage further out of sight.
- Make the safe path the easy path. Approved tools, clear data rules and a one-page policy beat a locked door.
- Start with a conversation, not a crackdown.
AI is going to be part of how your team works whether you plan for it or not. The only real choice is whether you can see it.