What we do in the AI shadows

What is Shadow AI?

Spoiler alert: employees don’t always do what they’re told. So it’s no surprise that a third of people (31%) using GenAI at work are doing so without their employer’s permission. As the technology evolves, eager employees are using personal, unauthorised GenAI tools to get ahead.

This phenomenon, known as Shadow AI, presents a major issue for the modern workplace. With people bringing in their own AI tools, it creates a gap between an organisation’s AI policy and how employees actually use the technology. It also exposes organisations to major risks, such as data leakage. This makes it difficult for IT teams to measure GenAI usage accurately, meaning internal tools and expensive licenses often go unused.

How common is Shadow AI?

Shadow IT isn’t a new phenomenon. It’s a behaviour that has followed every major wave of workplace technology, from smartphones to cloud software. But GenAI has raised the stakes: 63% of the UK workforce have already used it, and 12% use it every day.

For cybersecurity chiefs, the most troubling group may be those who believe their employer would approve if they knew (22% of GenAI users). This group is still breaking the rules, but they’re too relaxed about how they use the tools, who they tell, and how they handle the data. At the very least, those who know they are in the wrong may be discreet.

Some employees pay for unapproved tools, with one in six GenAI users (17%) paying for their own tools. And UK workers spend an estimated £1 billion a year on tools they use at work, ultimately for the benefit of their employer. 6% of these self-funders spend more than £50 a month, usually using multiple tools.

For employers, greater adoption of approved in-house tools or company-paid licences might seem like a good solution, but our research says otherwise.

In the Financial, Banking, and Insurance industries, where GenAI adoption is relatively high, in-house tools are more common. Here, 28% of people use in-house tools compared with 17% across the UK. And 41% use company-provided external tools compared with 34% overall. That may be helping reduce the use of free-to-use tools, but it hasn’t dented self-paid subscriptions: 19% of GenAI users in Financial Services still pay for their own tool, which is above the all-industry average.

Among those paying for their own GenAI tools to use at work or using a tool that may not be approved, 16% believe they improve their promotion prospects. 21% claim these tools outperform company tools, and 14% say they’re essential to their job, but are not funded by their employer. These workers may feel they’re gaining an advantage over their colleagues.

What should we do about Shadow AI?

So what should business leaders do about Shadow AI? Firstly, they need a clear picture of how GenAI is being used. But controlling this usage is another matter, as it’s almost impossible to track the tools people are using and where exactly they’re using them.

And the answer isn’t simply to introduce stricter rules. Good GenAI governance means being conscious of what people want and helping them to understand what responsible use looks like. By addressing Shadow AI and promoting responsible AI behaviours, organisations can reduce risks, manage GenAI adoption effectively and make better business decisions with confidence.

Ultimately, leaders should focus on creating a governance framework that balances innovation with risk management, ensuring employees feel empowered to use GenAI responsibly.