From Shadow IT to Shadow AI

When I was consulting, one of the biggest headaches I’d hear about was shadow IT—employees using their own software and tools outside of what the company officially approved. For example, Dropbox accounts, Google Docs, or random SaaS tools that weren’t approved by IT. The whole thing was messy, risky, and gave leadership anxiety.

Fast forward to today, and I’m starting to hear more and more about the next evolution: shadow AI.

This is when employees spin up their own AI projects without any oversight. They sign up for ChatGPT, download tools they find online, or experiment with models they don’t fully understand. None of it is connected to company systems, none of it is standardized, and no one at the leadership level really knows what’s going on.

And here’s the problem:

• These tools aren’t streamlined, which means duplicate work happens all the time.
• They often don’t integrate with existing systems, so knowledge gets siloed.
• And worst of all; there are serious security and compliance risks when sensitive data gets fed into tools that aren’t approved.

So why do people keep doing it?
Because it’s too tempting not to. AI makes their jobs easier, faster, and sometimes even more fun. Employees don’t want to wait six months for leadership to roll out a unified AI strategy, they’re trying to solve problems now. Meanwhile, leadership slows things down because they’re worried (rightly so) about risk, compliance, and long-term sustainability.

This tug-of-war is creating an interesting moment: innovation is happening in the shadows, while leadership is struggling to catch up with guardrails.

So the question becomes: What should companies actually do about shadow AI?

• Do they crack down and ban unapproved tools?
• Do they speed up their own AI rollouts so employees have safer options?
• Or do they find a middle ground that allows experimentation without breaking things?

Just something I was thinking about at 5:15AM today :)