Shadow AI: 64% of Your Employees Are Already Using Unapproved AI

The data: massive adoption, almost zero visibility

• 64% of employees admit to using unauthorized AI tools for work.
• 73% of companies have already integrated AI technologies into their operations.
• But 40% have no internal policies to control the use of AI applications outside authorized processes.
• Shadow AI already affects 65% of European companies.
• 98% of organizations have employees using AI applications with no oversight whatsoever.
• Data breaches linked to Shadow AI cost, on average, $4.88 million per incident.

It's the same pattern we already saw with ungoverned AI agents, but one step earlier: here there isn't even a deployed agent to govern — there are individual employees making tool decisions on their own, without the company ever finding out.

What Shadow AI actually is (and how it differs from an ungoverned agent)

Shadow AI is the use of AI tools — chatbots, browser extensions, mobile apps, coding assistants — by employees without IT or security's knowledge or approval. It's not a poorly managed AI project: it's no project at all. A salesperson pasting a client's data into ChatGPT to draft a proposal, or a developer pasting proprietary code into a free AI assistant to debug it, isn't using a "company agent" — they're using their personal account, under the terms of a consumer product, not a corporate contract.

The difference from the Shadow IT of a decade ago is speed and friction: installing unauthorized software required admin permissions or at least some technical know-how. Using Shadow AI requires only a browser and a personal email account.

The concrete risks

• Sensitive data outside your control. Customer data, financial figures, or proprietary code pasted into consumer tools may be stored or used to train third-party models, under terms of service nobody read.
• Regulatory friction. If that data includes personal information, using an unaudited tool can become a GDPR or AI Act problem, not just a security one — with no record that it even happened.
• Compounded risk from related bad habits. The same employee profile that uses Shadow AI reuses passwords 76% of the time, uses public wifi to work 70% of the time, and accesses corporate resources without a VPN 50% of the time — Shadow AI rarely travels alone.
• Decisions based on unverified output. If nobody knows which tool generated an analysis or a reply to a customer, there's no way to audit whether that answer was even correct.

Checklist to detect and control Shadow AI

1. Audit what's already being used. Review network traffic to known AI domains and corporate card spend on unapproved subscriptions — most companies are surprised by how much they find.
2. Publish a clear, short AI use policy. Which tools are allowed, what kind of data should never be entered into them, and who to ask when in doubt.
3. Offer approved alternatives. If the company doesn't provide a properly licensed AI tool, employees will use the free one. Approving one or two options with an enterprise contract changes behavior without having to chase anyone down.
4. Train staff on what information is sensitive and why it shouldn't leave corporate tools — most risky usage comes from not knowing, not from bad intent.
5. Prioritize the highest-exposure teams (sales, customer support, development) for monitoring and training, instead of trying to cover the whole company at once.

Conclusion

Shadow AI isn't a future risk — it's a present reality in 98% of organizations, most of them unaware of it. The difference between an exposed company and a protected one isn't banning AI, it's giving employees an approved path before they find an unsupervised one themselves.

At Dataverse Solutions we help audit which AI tools are already circulating in your company and design the policy and approved alternatives that make Shadow AI unnecessary.

Frequently asked questions