Skip to main content
Welcome to Deloitte
If we have selected the wrong experience for you, please change it above.
Perspective:
Perspective
01 Sep 2026
5 minute read

The risk hiding in plain sight

How organizations can identify, govern, and respond to unapproved AI use

Shadow AI is emerging as a growing risk as employees adopt unapproved AI tools outside formal governance processes. This perspective explores the data privacy, cybersecurity, compliance, and governance challenges it creates and the practical steps organizations can take to respond proactively.

Eliza Lozan

Shadow AI is becoming a growing challenge as employees use unapproved AI tools outside formal governance processes. While often adopted to improve productivity, these tools can create significant risks across data privacy, cybersecurity, compliance, and governance.

As AI adoption accelerates and regulatory expectations evolve, organizations need greater visibility into how AI is being used across the business. A proactive approach combining clear policies, monitoring, due diligence, and secure alternatives can help reduce risk while enabling responsible AI adoption.

Explore the key dimensions of Shadow AI

How Shadow AI takes root

Shadow AI often begins when employees seek faster, easier ways to complete tasks and approved tools do not fully meet their needs.

Find out more

The risks of Shadow AI

Shadow AI can expose sensitive data, create compliance gaps, introduce bias, and reduce organizational visibility and control.

Find out more

A proactive path forward

Discover practical steps organizations can take to identify, govern, and manage Shadow AI effectively.

Find out more

What organizations need to know

Shadow AI refers to the use of AI tools, applications, or features without formal organizational approval or oversight. It often emerges when employees look for faster, more efficient ways to complete tasks, but use tools outside approved governance and security frameworks. 

When AI use happens outside visible and controlled channels, organizations can face increased exposure across data privacy, cybersecurity, compliance, and governance. Sensitive information may be entered into external tools, controls may be bypassed, and leaders may have limited visibility into how AI is being used across the business.

Organizations should take a proactive approach to understanding where Shadow AI exists, what risks it creates, and how it can be governed more effectively. This includes improving visibility, strengthening policies and controls, raising employee awareness, and enabling secure, approved alternatives that support responsible AI adoption.

Get in touch

Eliza Lozan

Eliza Lozan

Deloitte - Middle East
Eliza is the Privacy Governance & Compliance Leader for Deloitte Middle East and a legal specialist with great experience working with privacy compliance in both Europe and the Middle East. Eliza has broad experience and in-depth knowledge within various areas in privacy and cyber security, and aims at making her legal advice pragmatic, business and solution-oriented. Eliza provides cyber risk services to clients in both the public and the private domain and across many different industry sectors. She has run several privacy programs. Eliza mainly advises on privacy, especially with focus on GDPR, new KSA Personal Data Protection Law, privacy by design, marketing, ISO standards and provides risk assessments and analyses on privacy and cyber security matters. Eliza furthermore advices within third party risk management, hereunder international transfer for personal data and works on drafting data processing agreements, transfer impact assessments (TIA) and other relevant IT contracts. Eliza has assisted several companies and public authorities with adjusting to the new DPO role, providing DPO as a service where Eliza has undertaken the DPO role for the clients, conducted DPO reporting to management, conducted data mapping, GAP analysis and implementing the requirements of the GDPR both in their manual processes and IT systems.

Did you find this useful?

Yes
No

Thanks for your feedback

Your feedback is important to us

To tell us what you think, please update your settings to accept analytics and performance cookies.

Need help updating cookies?