Shadow AI at work: the hidden risk when employees use ChatGPT without approval.

What shadow AI actually means

Shadow AI is the unsanctioned use of any AI tool or application by employees without the formal approval or oversight of IT or management. It's a subset of the older "shadow IT" problem, which covers any unapproved software, hardware, or service running inside a business; shadow AI narrows that to AI tools specifically. The most common example is an employee using a public chatbot like ChatGPT to speed up text editing or data analysis, without anyone in leadership knowing it's happening.

Microsoft's enterprise AI governance guidance splits the problem into two distinct forms. The first is unsanctioned general-purpose AI apps: chat assistants, browser extensions, and task tools employees adopt on their own because they're useful. The second is unmanaged AI agents deployed inside a company's own systems that were never registered or brought under any policy, a newer and less visible version of the same problem as businesses start building their own automations. Cloudflare's definition lands in the same place: nonsanctioned usage or integration of AI by employees and contractors, typically invisible until someone goes looking at network traffic and DNS queries to find it.

The important distinction for a small business owner is that shadow AI usually isn't malicious. It's a workaround. Someone found a faster way to do their job and used it, the same way people used to email spreadsheets to personal accounts before cloud storage got easy.

How common it is at companies like yours

A Zapier-commissioned survey of US workers, fielded in May 2026, found that 89 percent of workers have entered company data into an AI tool, and 79 percent have entered especially sensitive information, things like HR data, logins, API keys, or customer and employee personal information, into an AI chatbot. That survey sampled workers at companies with 500 or more employees that already provide paid AI tool access, so the figures describe larger organizations with more formal IT oversight, not small businesses specifically. A small business with looser tool governance and no dedicated IT staff has little reason to expect the number to be lower.

The same survey found that 85 percent of employees say they usually consider whether information is safe before entering it into an AI tool. That's worth sitting with: most of this behavior isn't carelessness, it's a knowledge gap. People think they're being reasonably careful and are wrong about what "careful" requires with a tool they don't fully understand.

Zendesk's 2026 CX Trends Report found that almost half of customer service agents use shadow AI tools, and that shadow AI usage in some industries grew as much as 250 percent year over year. Customer service is exactly the kind of role, high call volume, repetitive writing, constant pressure to move faster, where an employee is most tempted to paste a customer's message into a chatbot for a quick draft reply.

What it actually costs when it goes wrong

IBM's 2025 Cost of a Data Breach Report, based on Ponemon Institute research across 600 organizations studied between March 2024 and February 2025, found that 13 percent of organizations reported a breach of an AI model or application. Of those breached organizations, 97 percent said they lacked proper AI access controls. One in five organizations, 20 percent, reported a breach caused specifically by shadow AI.

The global average cost of a data breach in that report fell to $4.44 million, the first decline in five years, while the average US breach cost hit a record $10.22 million. Organizations with high levels of shadow AI use saw an average of $670,000 in higher breach costs compared with organizations with low or no shadow AI use. Breaches involving shadow AI also compromised more personally identifiable information, 65 percent of cases versus a 53 percent global average, and more intellectual property, 40 percent versus a 33 percent global average.

The report also flags a related problem: shadow data, meaning data stored in systems nobody is formally tracking. Thirty-five percent of breaches in the same study involved shadow data, and those breaches averaged $5.27 million and took 291 days total to identify and contain, 26.2 percent longer to identify and 20.2 percent longer to contain than the average breach. An AI tool an employee adopted on their own is, almost by definition, a place where company data ends up stored somewhere nobody is tracking.

None of these figures are broken out for small businesses specifically; IBM studied organizations of varying sizes globally. But the mechanism doesn't require enterprise scale to apply. It's not the size of the company that drives the extra cost, it's how long the exposure goes undetected and how sensitive the data was.

Why employees go around IT in the first place

IBM's research frames this plainly: employees turn to shadow AI to enhance productivity and speed up work when the approved tools feel insufficient or too slow. That's the same reason people used personal cloud storage or unapproved project management apps before AI tools existed. It's not a new impulse, it's the same impulse aimed at a new category of tool.

There's also a trust dimension. IBM Fellow Jerry Cuomo has noted that even when an AI vendor says it isn't intentionally storing user data, that doesn't mean it isn't storing data unintentionally, since crash logs and other system records can retain what a user typed. IBM also reports that on some online forums, employees openly swap tips on how to hide their ChatGPT usage from employers when public LLM use is banned outright. That's a strong signal that a ban alone doesn't remove the behavior; it just removes your visibility into it. In response to enterprise concerns like these, OpenAI has added data retention limits and additional protections for business subscribers, a sign the pressure is real enough that vendors are responding to it.

Four ways to respond, from ban to build

IBM frames the range of responses as roughly four broad approaches, and it's worth laying them out side by side because the right one depends on your risk tolerance and what you can realistically enforce.

Microsoft's enterprise governance guidance recommends a staged technical approach for larger organizations: combining Microsoft Purview Data Loss Prevention, Microsoft Defender for Cloud Apps, Microsoft Entra, and Microsoft Intune to detect and prevent data leakage to shadow AI. Microsoft has also rolled out a Shadow AI detection feature in the Microsoft 365 admin center, currently in public preview, that lets admins view detected shadow AI agents; it requires Microsoft Defender for Endpoint and, for blocking capability, Intune enrollment on managed Windows devices. That's a meaningful stack for a company with a dedicated IT function. For a five-person or fifty-person business without one, it's usually overkill, and the more realistic path runs through policy and a sanctioned tool rather than enterprise device management.

A practical policy small businesses can actually run

IBM's own numbers make the case for having any written policy at all: only 37 percent of organizations currently have policies in place to manage AI or detect shadow AI, and among breached organizations, 63 percent either have no AI governance policy or are still developing one. Even among organizations that do have a policy, only 34 percent perform regular audits for unsanctioned AI use. The bar here is not high.

Zendesk's recommendations translate well to a small business scale. Start with transparency: tell your team plainly how any approved AI tool handles data, so people aren't guessing. Ask, don't just monitor: an anonymous survey about what tools people already use will surface more honest information than a policy memo will, especially since Zapier's data suggests most employees already think they're being careful. Watch for the softer signals too, unexplained productivity spikes or unusual patterns in how work gets done, since those often precede a formal admission that someone found a shortcut. And when an employee's shadow AI habit turns out to genuinely help, fold it into the approved workflow instead of only shutting it down; that's often the fastest way to figure out what your team actually needs versus what a policy assumes they need.

The policy itself doesn't need to be complicated. Name the categories of data that can't go into any public AI tool: client PII, financial account numbers, health information, anything under an NDA. Name at least one sanctioned tool people are allowed to use freely. Put both in writing somewhere every employee will actually read, and revisit it as tools change, because this space moves fast and a policy written today will need updating within a year.

When this is worth solving with automation, and when it isn't

For a lot of small businesses, a clear written policy and a single sanctioned tool solve the actual problem. If your team's shadow AI use is mostly people drafting emails or summarizing documents faster, that's a policy-and-training fix, not an engineering one. Buying enterprise device-management software to lock down shadow AI on five laptops is almost never worth it; the Purview-and-Intune stack Microsoft describes is built for organizations with dedicated security staff to run it.

Where it does become an automation problem is when the underlying task people are routing through an unapproved chatbot, drafting client communications, summarizing intake forms, triaging inbound requests, is a real, recurring workflow that deserves a proper, sanctioned tool instead of a workaround. At that point the fix isn't a stricter policy, it's building the sanctioned version people were trying to get to in the first place: an AI Automation or Workflow Automation build that handles the task inside systems your business actually controls, with an approval step where one's needed and a clear record of what data went where. That's a different project than writing a policy, and it's worth being honest about which one you actually need before spending money on either.

If you're unsure which side of that line your business is on, it's worth mapping out where AI tools are already touching your operations, sanctioned or not, before deciding whether the answer is a memo or a build. The guide on what an AI agent actually is is a good next stop if you're trying to tell the difference between a chatbot someone picked up on their own and a genuine AI agent worth building properly, and the guide on agency vs in-house vs DIY covers who should actually own that build once you decide it's warranted.