What is Shadow AI and how can I manage it at my organisation?

AI tools have now become an integral part of ways of working for many people, with a study by PwC highlighting that 61% of employees globally have used generative AI tools within the last year.  

Employees are now relying on these tools for getting jobs done quicker, streamlining processes, and creating content. The powers of AI tools are transformative. However, it can also come with new challenges.  

Shadow AI is one of these. Posing a significant threat to organisations if not managed effectively.

And it's a growing concern for organisations too. With the 2024 Work Trend Index Annual Report from Microsoft and LinkedIn, published earlier this year, highlighting just how big Shadow AI now is:

Image from Microsoft.com | AI at Work is Here - Now Comes the Hard Part

 

Not only does this highlight just how many people are using AI tools not provided by their organisations, but it shows that it is common among all generations, too. 

 

What is Shadow AI? 

The term Shadow AI refers to AI tools and apps that are used by employees at work, without being rolled out or formally approved by the organisation.  

For example, an employee using Chat GPT to help craft a document, without a formal license or any guidance from IT.

 

How and why does Shadow AI develop within organisations? 

There are a number of reasons why Shadow AI happens within organisations. Usually brought about by the curiosity of certain employees. Some of these reasons include: 

• Feeling overwhelmed or bogged down with repetitive tasks, employees are turning to AI to boost their own productivity and efficiency 

• A lack of effective tools provided within the workplace, leading to employees needing to look elsewhere 

• Slow AI adoption internally, leading to organisations unknowingly pushing employees to seek their own solutions
   

These are just some of the factors that contribute to a rise in Shadow AI within organisations. This lack of management of AI tools can pose a number of risks. 

 

What are the risks of Shadow AI? 

Unmanaged AI and the rise of Shadow AI at work can pose a number of risks and create a lot of challenges for organisations.  

Such as: 

• Data protection
• Lack of control
•  Inconsistent workflows
• Increased strain on IT resource 

One of the key risks is data protection. Employees may be unintentionally sharing or releasing sensitive company information and intellectual property when engaging with these AI tools. Often without reading terms and conditions. Since these tools used by employees aren't officially approved or monitored by IT, there is a risk that information could be accessed by people who shouldn't see it.  

The rise in Shadow AI also creates a lack of control, with IT not being able to say for certain which tools people are accessing and how. Or what information they are sharing. IT needs control over which programmes employees use, to ensure the security of the organisation. And this doesn’t just include AI tools. By managing and approving tools, apps, and software, IT can protect the organisation against potential security threats, ensure compliance and maintain consistent workflows. 

If everyone across the organisation is using different AI tools without any input from the IT department, it is going to create significant inconsistencies. Everyone will be working in a slightly different way, with slightly different workflows. And different systems not talking to or interacting with each other.  

Lastly, Shadow AI can pose a significant challenge to your IT resource. As IT teams may need to spend more time and additional resource identifying and mitigating the use of shadow AI. This may divert attention away from other, more business critical tasks and projects.

 

Identifying Shadow AI in your organisation 

Due to the challenges identified above, it is crucial that organisations understand to what extent Shadow AI is occurring. To protect data and ensure security.  

There are a number of ways to do this, from IT imposing tighter restrictions to ongoing monitoring of downloads or sites visited.  

However arguably the best way to know whether Shadow AI is happening within your organisation is simply, to ask. Whether sending out a survey, auditing tools used, or carrying out a Digital Maturity Assessment, asking employees for their open and honest insight into tools used will help you to identify how much Shadow AI is or isn’t a problem.

 

How to manage Shadow AI in your organisation 

While Shadow AI can pose a threat to organisational data and security, there are a number of key strategies that can be implemented to both prevent it and manage its impact.  

Organisations should start by setting clear guidelines and policies on the acceptable use of AI tools. This might include an approved list of tools or apps, or clear restrictions on what cannot be shared.  

If rolling out licenses for an AI tool company-wide is not an option, you should encourage employees to be open about the AI tools they're using, through assessments, surveys and reviews.  

Furthermore, learning opportunities for staff are one of the key things you can do to manage Shadow AI. Whether that is training teams and raising awareness of the risks of shadow AI and the importance of sticking to approved tools. Or, if that is training on the proper use of them; what to share, what not to share, and how to write good prompts, for example.  

By taking these steps, organisations can keep control over AI usage and ensure everything is secure and compliant. 

 

Managing Shadow AI – Final thoughts  

While it is great that employees are excited and enthusiastic about AI tools, the rise of Shadow AI poses significant risks to data protection, control, and consistencies of working practices across organisations.  

But by implementing clear guidelines and policies, encouraging transparency, and providing appropriate training, organisations can manage the impact that Shadow AI can have. With these measures in place, organisations can maintain security and compliance while employees are able to explore the full, transformative power of AI.