What Is Shadow AI? Risks, Examples and How to Govern It (2026)

Somewhere in your company right now, someone is pasting a customer list into a chatbot on a personal account. Someone else switched on an AI note taker that joins every sales call. And a team lead who got tired of waiting for IT has built a working internal app on a public AI app builder, with real customer data in it, on a URL nobody in security has seen. That is shadow AI, and in 2026 it is less a fringe problem than the default way AI enters most organizations.

This guide explains what shadow AI is in plain English, what it looks like in each department, the risks that actually matter, and why banning AI tends to make things worse. Then it covers the form most guides miss: business teams building entire apps with AI, and how to give them a governed way to do it.

What is shadow AI?

Shadow AI is the use of AI tools, models or AI-built applications at work without the approval or oversight of IT and security. It covers chatbots used on personal accounts, AI features switched on inside approved software, browser extensions, AI coding assistants, and increasingly, whole apps and internal tools generated by public AI app builders.

IBM's research team defines it narrowly as workers who "download or use unapproved internet-based AI tools." The meaning has widened as AI moved from answering questions to building things.

Shadow AI is rarely malicious. People use these tools because they are useful and fast, and because the approved path is slow or missing. That shapes the fix.

Shadow AI vs shadow IT

Shadow AI is a kind of shadow IT, the long-standing problem of employees using software IT has not approved. The difference is what the tool does with your data.

What is shadow AI in cyber security?

For a security team, shadow AI is an unmonitored exit for data and an unreviewed entrance for code. Data loss prevention, access control, logging and incident response all assume you know which systems hold your data. Shadow AI breaks that assumption. You cannot revoke access to an account you never knew existed, and you cannot patch an app you never reviewed.

How common is shadow AI?

Very. The numbers below come from large surveys over the last few years, so check the year on each.

• Most AI users bring their own tools. Microsoft and LinkedIn's 2024 Work Trend Index found that 75% of knowledge workers used AI at work and 78% of AI users were bringing their own AI tools to work.
• Much of it is unapproved. A Salesforce survey of more than 14,000 workers in late 2023 found that over half of employees using generative AI at work did so without formal approval from their employer, and nearly 7 in 10 had never received training on using it safely.
• Security leaders see it. Gartner reported in November 2025 that 69% of cybersecurity leaders it surveyed had evidence or suspected that employees were using public generative AI at work, and predicted that by 2030 more than 40% of global organizations will suffer security and compliance incidents due to unauthorized AI tools (Infosecurity Magazine).
• It is getting better, slowly. Netskope's Cloud and Threat Report 2026, covering October 2024 to October 2025, found that 47% of generative AI users still used personal accounts, down from 78% a year earlier, while use of company-approved accounts rose from 25% to 62% (CIO Dive).

That last point is the encouraging one. Where companies provide approved tools, people move to them. Shadow AI shrinks when the sanctioned option is good, not when the unsanctioned one is forbidden.

Examples of shadow AI by department

If you are asking "what is an example of shadow AI?", the honest answer is that every department has several. These are the patterns that come up most.

The most cited real case is Samsung. In 2023, according to Korean media reports, engineers pasted confidential source code into ChatGPT while trying to fix errors. Samsung then put a temporary ban on generative AI tools and was reported to be building its own (The Register). Note the second half of that story: the long-term answer was an approved alternative.

The shadow AI most guides miss: whole apps built by business teams

Most writing about shadow AI is about chatbots and data pasted into prompts. That was the 2023 problem. The 2026 version is bigger: business teams are now building entire applications with public AI app builders such as Lovable, Bolt, v0, Emergent and Replit.

These are good tools, and the people using them are doing what the business asked: solving a problem without waiting six months. An operations manager describes a field inspection app in a sentence and has it working an hour later. Nobody filed a ticket.

The trouble starts the next week:

• Nobody owns it. The app lives on one person's personal or team account. When they change roles, it becomes an orphan holding live data.
• It is disconnected. It has its own database, its own sign-in and its own copy of customer data, instead of using your identity provider and systems of record.
• It is off-brand. It does not use your design system, so customers and employees see something that looks like it came from another company.
• It is not reviewed. No one checked access rules, secrets or where the data is hosted.

The security point is not hypothetical. In 2025, a researcher found that 170 projects built with Lovable had database tables exposed because row-level security policies were missing or insufficient, revealing data such as emails, phone numbers, payment status and API keys. It was logged as CVE-2025-48757 (Superblocks analysis). The lesson is not that one builder is unsafe. It is that apps generated quickly and deployed without review will carry mistakes that a security review would catch, and shadow apps by definition skip the review.

This matters most for internal tools and dashboards, where the data is the most sensitive. We look at that side in more depth in our guides to an AI internal tool builder and an AI dashboard builder.

Shadow AI risks

The shadow AI risks that matter fall into six groups. The first two get the headlines; the last two are where the long-term cost sits.

1. Data leakage

Anything typed or uploaded into an AI tool leaves your control. Depending on the plan and settings, it may be retained, reviewed by the vendor or used for training. Cisco's 2024 Data Privacy Benchmark Study of 2,600 privacy and security professionals found that 48% admitted entering non-public company information into generative AI tools.

2. Compliance and regulatory exposure

Sending personal data to an unvetted processor can breach GDPR, HIPAA, financial services rules or customer contracts, and there is usually no data processing agreement in place. In the EU, the AI Act's AI literacy obligations have applied since February 2025, which is hard to show when you do not know which AI systems staff are using.

3. Security gaps and breach cost

IBM's 2025 Cost of a Data Breach research found that a high level of shadow AI added about $670,000 to the average breach cost, that 63% of the 600 organizations studied had no AI governance policies to manage AI or prevent shadow AI, and that 97% of organizations with an AI-related security incident lacked proper AI access controls. Add the AI-built apps above, with their own databases and secrets, and the attack surface grows quietly.

4. Intellectual property

Source code, product plans and designs pasted into public tools may be retained outside your control. In the other direction, AI-generated content and code can raise ownership and licensing questions your legal team has not reviewed.

5. Wrong answers acted on

A model can be confidently wrong. When an employee uses an unapproved tool to summarize a contract or build a forecast, nobody checks the output, and the mistake goes out under your company's name.

6. Cost and sprawl

Shadow AI is also a budget problem: duplicate subscriptions on expense reports, and a growing pile of half-maintained apps that someone will eventually have to secure, migrate or shut down. Gartner's November 2025 announcement also predicted that by 2030, 50% of enterprises will face stalled AI upgrades or higher maintenance costs from unchecked generative AI technical debt (Process Excellence Network).

Why banning AI does not work

The instinctive response to shadow AI is a ban. It rarely holds. In the same Cisco study, 27% of organizations had banned generative AI at least temporarily, yet nearly half of respondents admitted putting non-public data into these tools. A ban moves usage to personal phones and home laptops, where you have even less visibility, and it tells your most motivated employees that the company would rather they were slower.

Bans have a place for specific high-risk tools. As a strategy, governance wins.

How to govern shadow AI: a practical playbook

Shadow AI governance does not need a large program to start. These seven steps work for a mid-sized company and scale up.

1. Find out what is already in use

Start with discovery, not punishment. Review SaaS and browser extension inventories, network and CASB logs for AI domains, expense reports and OAuth grants. Then ask people directly, with an anonymous survey and an amnesty. You will learn more from the survey than the logs.

2. Classify data, not tools

Write a one-page rule that people can remember. For example: public information can go into any approved tool; internal information only into approved enterprise accounts; customer personal data, health data, source code and financials only into tools that run in your own environment or that legal has approved for that data class.

3. Provide approved tools that are as good as the public ones

This is the step that actually shrinks shadow AI, as the Netskope numbers show. Give people enterprise accounts for the assistants they already like, with training turned off and a data processing agreement signed. If the approved tool is worse, people will go back to the public one.

4. Put everything behind SSO, with audit logs

Every approved AI tool should use your identity provider, so access ends when someone leaves, and should keep audit logs your security team can search. This also covers the app builders: if teams are going to build apps with AI, they should do it in a workspace tied to company identity, not personal accounts.

5. Keep sensitive work on AI you host

For regulated data or core IP, the safest option is AI that never sends prompts to a third-party API: models deployed in your own cloud account or on-premises. Open-weights models have become good enough for much of this work. Our guide to the on-premise AI app builder covers the trade-offs.

6. Create a review path from prototype to production

This is the step that deals with shadow apps. Make it easy to say "I built something useful, please make it official." A light review covers identity, data access rules, secrets, hosting and ownership, then the app either moves onto supported infrastructure or is retired. Without this path, every successful prototype becomes either shadow IT or wasted effort. Our enterprise mobile app development guide includes the checklist IT will apply.

7. Train people and review the policy quarterly

Short, practical training on what not to paste beats a long policy nobody reads. Revisit the approved list quarterly; the tools change faster than annual policy cycles.

Where RapidNative fits

We make RapidNative, an AI app builder from GeekyAnts, the team behind NativeBase and gluestack. It is one example of the governed alternative described above, for teams that want to build apps with AI without creating shadow apps.

Available today, teams can generate native iOS and Android apps from a prompt, a Figma design, a screenshot or a document, with database, sign-in, storage and realtime included. Apps can call your existing APIs or your own Supabase, and you can export standard React Native, Expo and TypeScript code that you own and can put through your normal code review. Design-system and component skills keep apps on-brand.

Under an enterprise agreement, RapidNative adds SSO, custom component libraries and Figma MCP, and can be deployed in your own cloud or fully on-premises with self-hosted open-weights models such as DeepSeek, Qwen, GLM, Devstral or gpt-oss, so prompts, code and data do not reach a third-party AI API. The enterprise edition is also adding web apps and customer portals, dashboards on your databases, internal tools with approval workflows, and an admin console with audit logs and model and publish policies. Those are coming soon, not available today.

The playbook above works with whatever tools you approve.

Shadow AI is a signal, not just a threat

Shadow AI tells you where your people need AI and where your approved tools fall short. Treat it as demand. Find what is in use, set simple data rules, give people approved tools that are genuinely good, keep sensitive work on AI you control, and build a clear path for AI-built apps to become supported ones. The companies that handle shadow AI well will not be the ones with the strictest bans. They will be the ones where the governed way is also the easiest way.