Shadow AI: what it is, how to find it, and a 30-day response plan
Shadow AI is employees using AI tools, such as free chatbots or AI browser extensions, that their company hasn't approved or can't see. It creates data, compliance and cost risks, but banning AI rarely works. The fix is visibility first, then a short list of approved tools and a clear policy.
This guide covers what shadow AI is, examples by team, the risks, how to find it, a 30-day response plan and why bans backfire. Every statistic comes from an independent survey or an official source, and every source is listed at the end. Last checked October 23, 2026.
What is shadow AI, and how is it different from shadow IT?
Shadow AI is any use of artificial intelligence for work that the company hasn't approved, doesn't know about or can't see: a personal chatbot account, an AI browser extension, an AI notetaker connected to a work calendar, or an AI feature switched on inside an approved app. It is a kind of shadow IT, the wider category of software and services used for work without IT's approval, but it behaves differently in four ways:
- Data leaves with every prompt. An unapproved file-sharing app stores what people upload. An AI tool processes whatever is pasted into a prompt, and on a personal plan the company has no contract with the provider about what happens to it.
- There is nothing to buy or install. Many AI tools run in a browser and have a free plan, so purchase approvals and software install controls never see them.
- Approved apps gain AI features. An update can add an AI assistant to a tool IT approved years ago, so the list of AI tools in use changes without anyone signing anything.
- Output feeds decisions. AI drafts emails, code, contract summaries and performance notes that people act on, so an unchecked mistake travels further than a stray file.
How common is AI use at work, and how much of it is hidden?
Roughly four to six in ten US workers now use AI on the job, depending on how the question is asked, and a large share of that use happens outside company rules. Four independent surveys:
| Survey | Who was asked | Finding |
|---|---|---|
| Gallup, May 6 to 20, 2026 | 22,573 employed US adults | 52% use AI in their role; 30% a few times a week or more; 15% daily |
| US Census Bureau, Household Trends and Outlook Pulse Survey, March 13 to 30, 2026 | About 12,500 US adults | About 56% of workers have used AI on the job for at least one of 11 tasks |
| Pew Research Center, February 17 to 23, 2026 | 5,119 US adults | 38% of employed adults say they use AI chatbots for tasks at work |
| KPMG and the University of Melbourne, November 2024 to January 2025 | More than 48,000 people in 47 countries | 58% of employees intentionally use AI at work; 31% use it weekly or daily |
The figures differ because the questions differ: using AI in your role (Gallup), having used AI on the job for any of a list of tasks (Census Bureau), using AI chatbots for tasks at work (Pew Research Center) and intentional use at work (KPMG and the University of Melbourne). Each source is listed at the end of this guide.
How much of that use is invisible to the company? In the KPMG and University of Melbourne study, 57% of employees said they hide their use of AI and present AI-generated work as their own, almost half admitted using AI in ways that contravene company policies, and only 40% said their workplace has a policy or guidance on generative AI use. In Gallup's May 2026 survey, one in five US employees were unsure whether their organization had integrated AI tools at all.
Intelogos is preparing its own work data report; until it's published, this guide relies on the independent surveys above. For more data on AI at work and workplace monitoring, see our employee monitoring statistics.
What are common shadow AI examples by team?
Shadow AI shows up wherever someone has a repetitive reading, writing or coding task and a deadline. The examples below are illustrative: composites of common patterns, not reports of real incidents at any company.
| Team | Illustrative example | What's at stake |
|---|---|---|
| Finance | An analyst pastes a supplier contract into a free chatbot to summarize the payment terms, then pastes the unreleased quarterly forecast to draft the commentary | Confidential terms and unreleased financial results on a personal account the company can't audit or delete |
| Customer support | Agents install a free AI writing extension that can read every page in the browser and drafts replies from the open ticket, including customer names and order details | Customers' personal data processed by a provider the company has no agreement with |
| Sales | A rep connects an unapproved AI notetaker to their work calendar, and it joins, records and transcribes customer calls | Call recordings stored outside company systems, and consent questions under call-recording laws |
| Engineering | A developer signs in to a coding assistant with a personal account inside the code editor, sending proprietary source code with each request | Source code, and any secrets in it, leaving the company under terms nobody reviewed |
| HR and people managers | A manager pastes performance notes into a chatbot and asks whether to put someone on a performance plan or let them go | A decision about a person resting on AI output nobody reviewed, the kind of use California's SB 947 regulates from July 1, 2027 |
What are the risks of shadow AI?
The main shadow AI risks are data exposure, compliance with new rules on AI in employment decisions, weaker intellectual property protection, unchecked output, and paying twice for tools that overlap. Most of them come less from AI itself than from use the company can't see, so it can't set terms, train people or review decisions.
Data exposure
Free and personal plans of AI tools can come with different data terms from business plans, for example on whether conversations may be used to train models and how long they are kept, and when an employee uses a personal account, the company has no contract with the provider at all. Almost half of the employees in the KPMG and University of Melbourne study admitted using AI in ways that contravene company policies, including uploading sensitive company information into free public AI tools.
Compliance, including California's rules for AI in HR decisions
Decisions about people are where shadow AI meets employment law.
- California. From July 1, 2027, SB 947 bars an employer from relying solely on an automated decision system when making a disciplinary or termination decision. If an employer primarily relies on one, a human must corroborate the decision with the underlying data or other information, the employee may request a description of their data the system used, and the employer must give a written notice (Labor Code sections 1520 to 1526.7). The law defines an automated decision system broadly: a computational process derived from machine learning, statistical modeling, data analytics or artificial intelligence that issues simplified output, such as a score, classification or recommendation, used to assist or replace human discretionary decision-making. A manager who acts on a chatbot's recommendation from a personal account may be using one, and a company can't corroborate a decision or give notice about a use it doesn't know happened. Our guide to California's AB 1883, AB 1331 and SB 947 covers all three laws.
- European Union. The EU AI Act lists as high-risk the AI systems intended for recruitment and selection, for decisions on promotion or termination, for allocating tasks based on individual behavior or personal traits, and for monitoring and evaluating the performance and behavior of workers (Annex III, point 4). Under the act as amended in July 2026, the high-risk rules for those systems apply from December 2, 2027 (Article 113), and Article 4 requires providers and deployers of AI systems to take measures to support the AI literacy of the staff who use them (Regulation (EU) 2024/1689, consolidated text).
Whether a specific use is covered by either law is a question for counsel.
This is general information, not legal advice. Laws vary by location and change often; consult your own counsel before acting on it.
Intellectual property
The US Copyright Office concluded in January 2025 that AI-generated output can be protected by copyright only where a human author has determined sufficient expressive elements, and that providing prompts alone is not enough (Copyright and Artificial Intelligence, Part 2). Work an employee produces mostly with AI may therefore be hard to protect. Trade secrets raise a different problem: under federal law, information is a trade secret only if its owner has taken reasonable measures to keep it secret (18 U.S.C. § 1839(3)), and pasting source code or a formula into a tool the company has no agreement with doesn't help show that it did.
Unchecked output
In the same KPMG and University of Melbourne study, 66% of employees said they rely on AI output without evaluating its accuracy, and 56% said they have made mistakes in their work because of AI. When use is hidden, nobody knows which deliverables need a second look.
Paying twice for overlapping tools
When a company already pays for an AI assistant but staff don't know it exists, or prefer a different one, teams expense personal subscriptions to tools that do the same job. Gallup found in May 2026 that one in five US employees were unsure whether their organization had integrated AI tools. Matching the tools people actually use against the licenses you pay for and the AI subscriptions in expense reports shows where you're paying twice.
How do you find shadow AI in your company?
You find shadow AI by combining two or three methods, because each one sees a different slice: network logs see traffic on your network, identity and expense data see sign-ups and purchases, endpoint analytics see what's used on work computers wherever they are, and asking employees reaches personal devices. The table compares methods, not products.
| Method | What it sees | What it misses |
|---|---|---|
| Network and DNS logs (firewall, web proxy, DNS resolver) | Which AI domains devices on the office network or VPN contact, and how often | Home networks without the VPN, phones and personal devices; AI features inside approved apps that use the app's own domain; time spent in each tool |
| SaaS management and CASB (cloud access security broker) tools | AI apps people sign in to with company accounts through single sign-on or OAuth, AI subscriptions in expense and procurement data and, for a CASB, the traffic routed through it | Free accounts opened with a personal email, traffic that bypasses the proxy, and desktop apps outside its coverage |
| Browser extension audits | AI extensions installed in managed browsers and the permissions they ask for, such as reading every page | Unmanaged browsers and personal profiles, AI websites and desktop apps, and how much an extension is actually used |
| Endpoint app and website analytics | Desktop apps and websites used on work computers with an agent installed, on or off the office network, with time spent and by team | Personal phones and computers without the agent; what people type or paste, if the tool records usage only |
| Asking employees (an anonymous survey or an amnesty) | Tools and use cases people disclose, including on personal devices, and why they use them | Whatever people choose not to mention, which the hiding figures above suggest is a lot |
Most companies start with what they already have, such as network logs and expense reports, then add endpoint analytics and a short survey to cover remote work and the reasons behind each tool.
How does Intelogos show which AI tools teams use?
Intelogos is a workforce analytics platform that shows how work time is spent across apps and websites, without screenshots or keystroke logging, and lets managers ask questions about it in plain language. It records the AI apps and websites people use on work computers like any other tool and groups them in a built-in AI time category for AI tools and assistants. On the Tools page, you can filter to the AI category and to a department to see which AI tools that department uses and for how long, and the Time Categories chart on the Dashboard and Profile pages shows the time spent in AI tools next to other kinds of work.
What it doesn't capture matters as much. Intelogos doesn't take screenshots. Intelogos doesn't record what people type; it records only whether keyboard or mouse input happened. So it shows that a team spent hours in an AI tool, not what anyone pasted into it; that part is for your policy and training. It covers work computers with the Intelogos agent installed, not personal phones. An AI tool Intelogos doesn't recognize yet lands in the Other time category until someone moves it to AI on the Tools page, so review Other during your inventory. The Tools page is available to owners, and to admins and managers with the App Management permission.
The same data powers software utilization tracking across every app your teams use, and IT teams can see how the rest of the product fits their work on the Intelogos for IT and security teams page.
How do you build a 30-day shadow AI response plan?
A 30-day shadow AI response plan moves from inventory to policy to approved tools to review, one week each. The goal at the end of the month isn't zero unapproved AI; it's knowing what's used, having approved tools for the main jobs and a date for the next review. To see where your company stands before you start, take the free AI readiness assessment.
- Week 1: inventory. Combine two or three methods from the table above and list every AI tool in use, which teams use it, roughly how much and for what. Add the AI subscriptions in expense reports and the AI licenses you already pay for. Run a short anonymous survey, and say up front that the inventory is for choosing tools, not for discipline; otherwise people won't tell you what they use. Sort each tool into approve, approve with conditions, replace or stop.
- Week 2: policy. Write a short AI acceptable use policy: which tools are approved, which data must never go into an AI tool (customer personal data, employee records, passwords and keys, unreleased financials, source code outside approved tools), when to disclose AI use, when output needs a human check, and that decisions about people never rest on AI output alone. The free AI acceptable use policy template covers each of these and includes an approved AI tools register. Have HR and counsel review it.
- Week 3: approved alternatives. For each main use case in your inventory, such as writing, summarizing, coding and meeting notes, give people an approved option on a business plan with company sign-in, cancel the personal subscriptions it replaces, and train people on the policy. Ask managers to back the approved tools: in organizations that make AI tools available, Gallup found that 78% of employees who strongly agree their manager supports AI use are frequent users, against 44% of those who don't.
- Week 4: review. Repeat the week 1 inventory and compare. Is use moving to the approved tools? Which unapproved tools remain, and why? Update the register, answer the questions people raised, and set a quarterly review, because new AI tools and new AI features in existing apps keep arriving. To track whether the approved tools are being used and paying off, see how to measure AI adoption and the AI ROI calculator.
Should you ban AI tools at work?
A blanket ban rarely works: it stops the employees who follow the rules and pushes the rest onto personal devices and accounts, where the company sees nothing. Block narrowly, approve broadly, and make the approved path the easy one.
The research points the same way:
- Restrictions hold back the people who follow them. In a survey of about 18,000 Danish workers in 11 occupations, run from November 2023 to January 2024, workers who expected ChatGPT could halve the time on some of their tasks but didn't plan to use it most often pointed to employer policies: 42% said they needed training and 36% said their employer actively restricts its use (Humlum and Vestergaard, PNAS).
- Rules without tools don't stop use. In the KPMG and University of Melbourne study, almost half of employees admitted using AI in ways that contravene company policies, and 57% said they hide their AI use.
- Clear policies bring use into the open. In Gallup's February 2026 survey of 23,717 employed US adults, among employees whose organizations make AI tools available, 68% of those who strongly agree their organization has clear AI policies used AI frequently, against 47% of those who don't.
- The time savings are real for many workers. In the Census Bureau's March 2026 survey, of workers who used AI at work in the previous week, 31% said it saved them one to two hours they would otherwise have needed, 15% said three to four hours and another 15% more than four.
Blocking still has a place: specific tools whose data terms you can't accept, extensions that can read every page, uses you've ruled out entirely, such as AI deciding who is disciplined or let go, and data that must never leave approved systems. Pair each block with an approved alternative, so the need behind it doesn't go underground.
Frequently Asked Questions
Is ChatGPT shadow AI?
Only when it's used for work without the company's approval. ChatGPT is the chatbot US adults most often say they use among those Pew Research Center asked about (44% in its February 2026 survey). A personal account used with work data, outside any policy, is shadow AI; the same tool on a business plan the company approved, used under its AI policy, is not.
How do you avoid shadow AI?
Give people approved AI tools for the jobs they already use AI for, a short policy that says which data never goes into AI and when output needs a human check, and training; then review usage every quarter. Bans alone don't work: almost half of the employees in the KPMG and University of Melbourne study admitted using AI against company policies. The free AI acceptable use policy template is a starting point.
How is shadow AI detected?
By combining methods: network and DNS logs, SaaS management and CASB tools, browser extension audits, endpoint app and website analytics, and asking employees. Each misses something: network logs miss remote work outside the VPN, and most technical methods miss personal phones. Intelogos covers the endpoint part: it groups the AI apps and websites used on work computers in an AI time category, so you can see which AI tools each department uses and for how long, without screenshots and without recording what people type.
Sources
Every statistic and legal statement in this guide is based on the source below. All sources were checked on October 23, 2026.
Surveys
- Gallup, "Organizational AI Adoption Jumps Six Points", July 20, 2026: Gallup Panel web survey of 22,573 employed US adults, May 6 to 20, 2026, margin of error ±0.9 percentage points. 52% use AI in their role, 30% a few times a week or more and 15% daily; 47% say their organization has integrated AI tools; one in five are unsure whether it has.
- Gallup, "AI in the Workplace: What Separates Adopters and Holdouts", April 12, 2026: Gallup Panel web survey of 23,717 employed US adults, February 4 to 19, 2026, margin of error ±0.9 percentage points. Among employees in organizations that make AI tools available, frequent use by those who strongly agree their organization has clear AI policies (68% against 47%) and that their manager supports AI use (78% against 44%).
- US Census Bureau, "About a Third of Workers Who Used AI in the Last Week Said They Completed Tasks One to Two Hours Faster", August 11, 2026, figures revised September 24, 2026: the March 2026 Household Trends and Outlook Pulse Survey. About 56% of workers have used AI on the job for at least one of 11 tasks, and the hours saved by workers who used AI in the previous week. Collection dates (March 13 to 30, 2026) and about 12,521 respondents are from the source and accuracy statement.
- Pew Research Center, "Americans and AI 2026: Chatbots, smart devices and views on impact", June 17, 2026: American Trends Panel survey of 5,119 US adults, February 17 to 23, 2026. 38% of employed adults use AI chatbots for tasks at work; 44% of adults say they use ChatGPT.
- KPMG and the University of Melbourne, "Trust, attitudes and use of artificial intelligence: A global study 2025", April 2025 (full report): more than 48,000 people in 47 countries, November 2024 to January 2025. 58% of employees intentionally use AI at work and 31% use it weekly or daily; almost half admit using AI in ways that contravene company policies; 57% hide their use of AI; 66% rely on AI output without evaluating its accuracy; 56% have made mistakes in their work because of AI; 40% say their workplace has a policy or guidance on generative AI use.
- Anders Humlum and Emilie Vestergaard, "The unequal adoption of ChatGPT exacerbates existing inequalities among workers," PNAS 122(1), e2414972121, published December 30, 2024: survey of about 18,000 workers in 11 occupations in Denmark, November 2023 to January 2024, linked to Danish register data. Section 4.2 gives the training (42%) and employer restriction (36%) figures.
Law and official guidance
- SB 947 bill text: Chapter 859, Statutes of 2026, approved by the Governor on September 30, 2026; Labor Code section 1520 (the definition of an automated decision system) and section 1522 (sole and primary reliance and human corroboration), operative July 1, 2027.
- Regulation (EU) 2024/1689, the EU AI Act, consolidated text of July 27, 2026 (EUR-Lex), including the amendments made by Regulation (EU) 2026/1744 of July 8, 2026: Article 4, Article 113 and Annex III, point 4.
- US Copyright Office, "Copyright and Artificial Intelligence, Part 2: Copyrightability", January 29, 2025.
- 18 U.S.C. § 1839(3) (Legal Information Institute): the federal definition of a trade secret.