Shadow AI is the use of AI tools by staff without the organization's approval. The UK NCSC describes it as AI technology that is not captured in an organization's approved systems and processes. It is a form of shadow IT.
- Also Called2other namesunapproved AI use · shadow AI use
- Related Terms3linked entriesGenerative AI · AI agents · Data exfiltration
What Is Shadow AI?
The UK National Cyber Security Centre (NCSC) describes shadow AI as the use of AI technology which is not captured in an organization’s approved systems and processes. NCSC says it is a form of shadow IT, which means technology used outside what the organization has approved.
For example, an employee pastes work text into a public AI chatbot that the organization has not approved. The organization may not know it happened.
Why Do Staff Use Unapproved AI Tools?
NCSC says organizations’ policies and guidance have not always developed at the same pace as AI adoption. When approved options do not meet what the work needs, staff can turn to other tools.
What Risks Does Shadow AI Create?
NCSC names three main risks.
- Data exposure. NCSC says giving shadow AI access to company or customer data likely increases the risk of data breaches and intellectual property loss.
- Loss of control. NCSC says data sent to consumer services may be stored, retained or used to improve the service, and the organization loses visibility of it.
- Attacker opportunities. NCSC says AI systems contain complex vulnerabilities that attackers can exploit to reach the data, services and privileges the tool has.
OWASP, which publishes a top-ten list of risks for large language model applications, explains what kinds of data are at stake. It says sensitive information can include personal identifiable information, financial details, health records, confidential business data, security credentials and legal documents.
What Can an Organization Do About Shadow AI?
NCSC says the goal is to reduce the risk, because shadow AI is unlikely to disappear completely. It puts the core problem plainly: you cannot manage what you do not know. The steps below combine the NCSC blog with the user advice in OWASP LLM02:2025.
- Find out what staff use and whyNCSC says firms that know why people use shadow AI can spot risks and offer safe alternatives.
- Talk openly about securityNCSC says open communication makes staff less likely to turn to shadow IT, including shadow AI.
- Offer approved tools that fit the workNCSC says staff need AI tools that meet their needs while the risk stays managed.
- Tell staff what not to pasteOWASP advises guidance on avoiding sensitive input, with training on safe use.
- Publish clear data rulesOWASP advises clear policies on data retention, use and deletion, and an opt out from training.
- Limit what each tool can reachOWASP advises least privilege. NCSC warns an attacker gains the access an AI agent has.
Shadow AI is a close cousin of shadow IT, so the same asset discovery habits help. See also asset discovery and shadow IT.
Do Official Bodies Define Shadow AI?
NCSC does, in its blog on the hidden risks of shadow AI. The OWASP page on sensitive information disclosure does not use the term. This page relies on NCSC for the definition.
Is Shadow AI the Same as Shadow IT?
Not exactly. NCSC calls shadow AI a form of shadow IT. Shadow IT is the wider idea of unapproved technology. Shadow AI is the part that involves AI tools.
Does Shadow AI Always Mean Data Theft?
No. Shadow AI describes the lack of approval and visibility. NCSC links it to higher risk of data exposure, but it does not say every case leads to harm.
Our blog covers an unmanaged shadow AI agent. Related terms: generative AI, AI agents and data exfiltration.
Also Called.
- Nameunapproved AI use
- Nameshadow AI use
Questions.
-
What is shadow AI?
Shadow AI is the use of AI tools by staff without the organization's approval. The UK NCSC describes it as AI technology not captured in an organization's approved systems and processes.
-
Why do staff use unapproved AI tools?
The NCSC says policies and guidance have not always developed at the same pace as AI adoption. When approved options do not meet what the work needs, staff can turn to other tools.
-
What risks does shadow AI create?
The NCSC names data exposure, loss of control over data sent to consumer services, and attacker opportunities through vulnerabilities in AI systems.
-
How can an organization reduce shadow AI?
The NCSC recommends a transparent cyber security culture, understanding why staff adopt unapproved tools, and providing secure approved alternatives. It says you cannot manage what you do not know.
Sources
In Our Research
- 1 From Shadow IT to Shadow AI: Clawdbot (Moltbot/Openclaw) and the Rise of Unmanaged Agent Gateways January 2026
- 2 NCSC Annual Review 2026 Explained: What Changed Since 2025 and What AI-Powered Ransomware by 2028 Means November 2026
- 3 AI cyber threats in 2026: what the FBI and ENISA report October 2026
- 4 OWASP LLM Top 10 for 2025: the ten risks explained October 2026
- 5 AI Gateway Exploitation: How Attackers Are Targeting LiteLLM, RAGFlow, and Kestra to Steal Your Model Provider Keys August 2026
- 6 Shadow IT: Why the Assets Your IT Team Doesn’t Know About Are Your Most Dangerous Entry Points July 2026