Digital Lexicon Hub

The use of AI tools, models or features by employees without approval or oversight from IT, security or the AI governance function.

Staff pasting customer data, contracts or code into unapproved AI tools can breach confidentiality and GDPR duties without anyone noticing, so finding shadow AI is usually the first step of an AI governance program.

A firm reviews 30 days of DNS and proxy logs, finds 14 AI services in use, approves 3 under enterprise contracts with data retention controls, blocks uploads of tagged files to the rest through DLP and publishes an acceptable use policy.

Blocking tools outright often pushes use to personal devices and accounts, which are harder to see. Network discovery also misses AI features switched on inside already approved SaaS products, which need contract and settings reviews.

Shadow AI is a subset of shadow IT focused on AI services, including chat assistants, browser extensions and AI features enabled inside existing tools. Detection draws on firewall application inspection, DNS filtering, cloud access security brokers and data loss prevention to see where data flows. Responses include an approved tool list, Third-Party Risk review of vendors, staff training and controls in the AI Management System that reduce the risk of Data Exfiltration.