What is shadow AI, and how do you manage it?

Shadow AI is the use of AI for work without the company's required approval or oversight. To manage it, identify the tools and employee-built apps in use, assess the information and actions involved, and either approve them with defined controls or move the work to a suitable alternative.

Copy link to headingWhat counts as shadow AI?

Shadow AI can involve a personal AI subscription used for work or an app a department builds without the required review. Include employee-built agents as well. An agent uses a model to choose and carry out actions through connected tools, so the review must cover its permissions alongside the information it receives.

Approval needs to cover the intended use. Your company might allow an assistant to summarize public material without permitting employees to upload confidential contracts. Buying an approved tool does not authorize every use.

These illustrative situations call for different reviews:

Situation	What needs review
An employee uploads customer support exports to a personally purchased assistant.	Whether the provider and account are approved to receive that information.
Employees share an unreviewed app that answers questions about internal documents.	The app's data access and which colleagues can retrieve answers.
Someone connects an approved assistant to a business system with unapproved write access.	The new permission to change records and who can exercise it.

Bring-your-own AI figures do not establish shadow AI prevalence. Microsoft and LinkedIn's 2024 Work Trend Index reported that 78% of AI users brought their own AI tools to work. That describes AI users in the 2024 research, not all employees or a current estimate of unapproved use.

Copy link to headingHow do you find unapproved AI use?

Ask employees which tasks they use AI for and what they would lose if a tool disappeared. Give them a clear way to disclose existing use and request review, including uses they are unsure about. Explain how the review works and which details they need to provide.

Ask teams about both purchased tools and things they have built. Include personal subscriptions used for work, shared prototypes, and agents that run without someone opening a chat window. Record the person responsible and the task each tool performs.
Compare disclosures with records you are authorized to review, including company purchases and app connections. Existing device or network records may provide other leads.
Follow up on the actual workflow. Ask the employee to explain what information enters the tool, where results go, and which connected systems it can access. Confirm whether the use fits an existing approval before treating it as a new violation.

Record which teams and accounts each check covers.

Discovery source	What it can reveal	What still needs checking
Company purchasing records	Paid subscriptions bought through company purchasing or expense processes	Free tools and unreimbursed personal subscriptions may not appear. The purchase does not establish what data employees use.
Connected-app permissions	Which apps have access to company systems and what permissions they hold	Granted access does not prove use. Employees may also copy data or upload files without a connection.
Employee walkthroughs	How a tool fits the task, what information enters it, and where the result goes	The demonstration may omit other uses or differ from how colleagues use the same tool.

An empty result from one source does not establish that no AI is in use. Follow up on gaps between the records and employees' accounts of their work.

Keep the resulting inventory specific enough to act on. An entry such as "AI writing tool" needs an account or app identifier, a responsible person, and the work it supports. Avoid collecting sensitive prompt contents when a description of the data involved is enough for the initial review.

Copy link to headingWhich uses need attention first?

Prioritize the possible consequence of the use. Treat a private experiment with public information differently from an agent that can alter customer records, even if neither went through approval.

IBM's 2025 Cost of a Data Breach Report found that one in five studied breached organizations experienced breaches linked to shadow AI. This describes organizations that had suffered a breach; it does not estimate the chance that any company using unapproved AI will be breached.

For each discovered use, establish:

What information has entered the tool? Distinguish public material from confidential business information and personal data, and identify the provider or account that received it.
What can the tool do? Separate reading records from changing them, sending messages, or making commitments on the company's behalf.
Who can access it? Check the people allowed to use the app and whether shared access exposes information beyond its intended audience.
How does the business use its results? Determine whether a person checks the output or another process relies on it automatically.

If the review suggests sensitive information or credentials have been exposed, involve the security team promptly and follow the company's incident process. Restrict further use as appropriate while preserving the records needed to understand what happened.

Copy link to headingHow do you bring useful AI use under oversight?

Choose a response for each discovered use and tell the affected team what it means for their work. The review may lead to approval, changes to the tool, or an approved replacement. If the exposure cannot be made acceptable, stop that use and agree on how the task will continue.

For a tool that can remain, make approval concrete. Specify the permitted data and account, then address any permissions that exceed the task. Record who must complete the changes and what the reviewer needs to see before use resumes.

Picture a support lead who has built an unreviewed reply-drafting agent. It connects to the support system through a shared account, and ticket exports sit in an external AI service. Colleagues want to keep using it because it pulls the ticket and the relevant policy into one draft. The review needs to confirm whether the team is allowed to share ticket data with that AI provider. It also needs to check whether the shared account lets the agent see more tickets than the team handles. Until the review is complete, the team can keep using its existing reply process.

If reviewers approve a limited pilot, name the person responsible for moving the app into the company-managed environment. Configure its connection for the permitted tickets and remove any permission to send replies. Support staff would then review each draft in their existing workflow. Before access resumes, the reviewer should see evidence that the agent cannot retrieve a ticket outside the permitted set or send a reply on its own.

Record the pilot's owner and conditions so colleagues know which use has been approved. Revoke the old connection once the transition is complete, and separately assess the handling of any exports already sent to the original service. Moving the app does not remove those copies. If reviewers choose a replacement, confirm it lets staff complete the original task before closing the transition.

Banning AI establishes a rule without revealing what employees are using. Pair restrictions with discovery and a usable approval route. When several teams disclose similar workarounds, use those findings to decide whether the approved options meet the business need.

Copy link to headingHow do you measure progress?

More discovered tools can reflect better visibility. For example, employees may disclose tools they have used for months when their department first joins a review. Record that change in coverage alongside the tool count. The increase alone does not establish that unapproved use has grown.

Track how long requests wait for a decision and which unresolved uses involve sensitive data or permission to change records. Count completed reviews separately from completed remediation. In the support-agent example, approving a migration plan would not establish that the old connection had been revoked. Verify the agreed changes before treating that work as complete.

Copy link to headingWhat can an approved platform control?

Once an employee-built app is approved, platform controls can help enforce the conditions of that approval. In the support-agent example, the team needs to control who can open the app and how it connects to the support system.

Copy link to headingControl employee access with Vercel Passport

If employees use the support agent through a web app, the team can require sign-in through the company's identity provider. Vercel Passport enforces that check before visitors can view a protected deployment and is available on Enterprise.

The app still needs to enforce what signed-in employees can see and do. For example, permission to open the app should not expose tickets outside an employee's allowed customer accounts.

Copy link to headingManage service connections with Vercel Connect

Vercel Connect manages the credentials an app uses to access other services through OAuth connections or stored API keys. The available connection methods depend on the service and connector.

For the support agent, the team would configure a supported connection using an approved account and check its ticket access and reply permissions. Storing the original shared credential in a managed connection would leave its permissions unchanged. Restrict those permissions to the drafting task as part of the transition.

These controls apply only to apps configured to use them. Continue discovery for AI use elsewhere. Keep reviewing drafts based on what an error would cost, because sign-in and managed credentials can’t catch mistakes in a reply.

Copy link to headingFrequently asked questions

Copy link to headingIs shadow AI the same as shadow IT?

Shadow AI is a form of shadow IT focused on AI used outside company oversight. Reviewing it also requires attention to the information given to models and any actions that connected agents can take.

Copy link to headingIs personal AI use always shadow AI?

No. Employees may use a personally chosen tool for work when the purpose, account, and information fall within company approval. Personal activities on company devices may be subject to separate workplace rules.

Copy link to headingCan approved tools be used in unapproved ways?

Yes. Approval may apply only to certain data or activities, such as drafting text from public sources. Uploading restricted records or adding permissions beyond that approval requires another review.

Copy link to headingDoes banning AI solve shadow AI?

No. Prohibiting AI sets a rule but does not reveal whether employees follow it. Companies still need ways to identify AI use, assess it, and provide acceptable options for the work employees need to do.

Copy link to headingWhat should an employee do about an unapproved tool?

Stop adding company information or expanding the tool's access until its status is clear, and contact the designated IT or security team. Explain the task, what data has been used, and any connected accounts. If exposure is suspected, follow the incident process and preserve relevant records for the review.