Shadow AI: How to Find It, Manage the Risk, and Set a Policy People Follow

By Steven R. Combs

In this guide

1. What shadow AI is, and how it differs from shadow IT
2. Why it keeps growing
3. Examples by industry
4. The risks that matter
5. How to find shadow AI
6. Protection tools and what each one covers
7. Sanctioned alternatives, so shadow use drops
8. A policy people follow
9. Texas and TRAIGA
10. A 30-day response plan
11. Where this leaves your firm
12. Quick answers

If your firm hasn’t approved an AI tool, your people picked one anyway.

That’s the short answer to most shadow AI questions. Shadow AI is any AI tool, feature, or browser extension that employees use for work without the organization’s knowledge or approval. It isn’t a sign of bad people. It’s a sign that free AI sits one browser tab away and the approved option, if there is one, is harder to use. The fix isn’t a ban. It’s finding what’s in use, deciding what to sanction, giving people something good to use instead, and writing a short policy they’ll read. This guide walks through each step, and there’s a free AI acceptable use policy template at the end of section 8.

1. What shadow AI is, and how it differs from shadow IT

Shadow IT is any technology people adopt without IT’s involvement. Shadow AI is the same habit applied to AI tools, with one difference that matters: the data goes in as prompts, files, and meeting audio, and it can be kept, logged, or reused according to terms nobody at your organization has read.

A spreadsheet macro built outside IT is shadow IT. A personal ChatGPT account used to tighten a client memo is shadow AI. The macro stays on your machine. The memo text left your environment the moment someone pasted it in.

Three things make shadow AI harder to spot than the shadow IT of ten years ago:

• It often needs no install. A browser tab is enough.
• It arrives inside tools you already approved. An AI summary switched on in a SaaS product you’ve paid for since 2019 is still AI you haven’t reviewed.
• The risky part is the content, not the app. Two people can use the same tool, one with a public marketing draft and one with a privileged document.

That last point is why a blanket block rarely solves the problem. What you’re managing is which data goes where, not which logos appear in a report.

2. Why it keeps growing

I think three forces drive most of it.

Free tiers are good now. A person with a deadline and a free account gets a real first draft in seconds. Compared with waiting on an IT request, it isn’t close.

AI is showing up inside software by default. Notetakers join calls, email clients offer rewrites, design tools generate images. Many of these features are on unless someone turns them off.

And approved options often lag. If the firm hasn’t picked a sanctioned tool, or picked one that’s hard to reach, people route around it. Nobody has to be reckless for this to happen. They just have work to finish.

3. Examples by industry

These are patterns, not case studies. None of them involves bad intent, and each one needs a different fix. For a longer set, the shadow AI assessment findings page covers what reviews turn up at law firms, energy companies, and medical practices.

Law firms. A personal AI account used to draft or tighten text that contains client facts. An AI notetaker added to a client call by an attendee. A browser extension that reads whatever is on the screen in the document management system. Discovery documents uploaded to a consumer tool to summarize them faster.

Energy and oil and gas. Field photos, inspection notes, or equipment readings dropped into a consumer AI app for a quick write-up. We covered the operational side in our post on shadow AI and pipeline safety.

Private equity portfolio companies. Deal room material or board decks pasted into a public tool to prepare a summary. Different portfolio companies adopt different tools, so the sponsor has no single view.

Medical device and clinics. Transcription or summarization apps used on notes that may contain patient or trial information. This is where regulated data meets the lowest friction tools.

Any industry. AI features that switched on inside approved SaaS, and browser extensions installed by one curious employee.

4. The risks that matter

I’d rank the risks by how often they turn into a real problem, not by how dramatic they sound.

Confidentiality. Prompts and uploaded files leave your environment. Whether the provider keeps them, reviews them, or uses them for training depends on the product tier and its terms. Consumer and business versions of the same tool can differ.

Regulated data. Client, patient, or personal data handled outside approved systems can create obligations you never planned for, and it makes breach analysis harder because nobody knows what went where.

Privilege and professional duties. For lawyers, ABA Formal Opinion 512 (July 29, 2024) addresses competence, confidentiality, client communication, supervision, and fees when using generative AI tools. It’s the reference point for why a firm can’t treat this as a personal productivity choice. This isn’t legal advice, and your ethics counsel should read the opinion for your jurisdiction.

Intellectual property. Proprietary methods, source code, and unpublished work can end up in tools whose terms you haven’t reviewed.

Retention and eDiscovery. AI chat history sitting in a personal account is outside your retention policy and outside a legal hold, until someone asks where it is.

Inaccurate output. Fabricated citations and confident mistakes don’t care who approved the tool. Review rules matter for sanctioned tools too.

5. How to find shadow AI

You can learn a lot in a week with tools many Microsoft 365 organizations already own. Our practical discovery checklist covers the seven checks in detail. Here’s the overview.

Cloud discovery. Microsoft’s Defender for Cloud Apps catalog includes a Generative AI category covering large language model apps, and it can show which of them are in use in your organization. You can set policies that alert on new generative AI app use. Blocking an app on devices depends on integrating with Defender for Endpoint. Check which Defender licenses your tenant holds before you plan around this.

Network and DNS logs. Firewall, proxy, and DNS logs show which AI domains people reach. They won’t show what was typed, but they show where to look.

App consent in Entra. In the Entra admin center, Enterprise apps lists applications added by user or admin consent, and each app’s Permissions page shows what was granted. A person may have granted an AI tool access to their mail or files without anyone noticing. Admins can revoke permissions, though revoking doesn’t stop a user from consenting again unless you also configure how users consent to applications.

Browser extensions. Inventory what’s installed through your browser management tooling. Extensions that read page content deserve the closest look.

AI features inside approved SaaS. List the products you already pay for and check what AI features they enabled, and under what data terms.

Expense reports and corporate cards. Subscriptions show up here even when nothing shows up in network logs.

A short anonymous survey. Two minutes, no names. Ask what people use, what for, and what the approved option is missing. People will tell you if they trust it won’t be used against them.

The point of discovery isn’t a hit list. It’s a triage table: for each tool, decide whether to sanction it, replace it, or block it.

6. Protection tools and what each one covers

No single control covers everything, and the shadow AI protection tools page compares the options in more detail. Here’s how I think about the layers.

DLP and posture management both matter here, and they do different jobs. DLP watches data as it moves. Posture management checks what’s already sitting in the room. We cover that in the DSPM guide linked below. Microsoft Purview’s Data Security Posture Management (DSPM) includes an AI observability view, and Microsoft’s documentation describes it as an inventory of AI apps and agents with activity in the last 30 days.

7. Sanctioned alternatives, so shadow use drops

A ban without an alternative trains people to hide their use. Pick tools that fit real work, and make them easy to reach.

Cocha advises clients on both Claude and Microsoft products.

With that said, here’s what the vendors themselves document, and it’s worth reading in the original. Microsoft states that for Microsoft 365 Copilot, prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation large language models, and that Copilot surfaces only data a user can already view. Anthropic states that commercial product inputs and outputs aren’t used for model training by default, with feedback as the exception. Terms differ between consumer and business tiers, so read the tier you’d actually buy.

Two practical notes. First, a sanctioned tool is only as safe as the permissions behind it. Copilot respects the access a person already has, so oversharing in SharePoint becomes an AI problem fast. Second, if your firm runs both, decide which data classes go where. Our Claude vs Copilot guide compares them side by side.

8. A policy people follow

An AI acceptable use policy works when it’s short enough to read and specific enough to follow. Ten sections cover most of it: approved tools, data classes and what goes where, prohibited uses, no personal accounts for work data, browser extensions and AI notetakers, human review of output, client or customer disclosure, incident reporting, training, and who owns it and how often it’s reviewed.

We built a free AI acceptable use policy template in Word, with a law firm addendum covering privilege, client consent, and engagement letters. Edit it, put your name on it, and ship it. This isn’t legal advice, and a firm should have its own counsel review the final version.

NIST’s AI Risk Management Framework (released January 26, 2023) is a useful backbone if you want your policy to map to a recognized structure. It’s voluntary, and NIST published a Generative AI Profile in July 2024 to help organizations identify risks specific to generative AI.

9. Texas and TRAIGA

Texas has an AI law now. Governor Abbott signed HB 149, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), on June 22, 2025, and it took effect January 1, 2026. This section covers the basics only. Read the enacted text, which is on the Texas Legislature’s site, before you rely on any detail.

According to law firm summaries of the final bill, TRAIGA applies to people who do business in Texas, offer products or services to Texas residents, or develop or deploy AI systems in the state, and it focuses on specific harmful uses rather than regulating AI broadly. The same summaries report that the Texas Attorney General has exclusive enforcement authority, that there’s no private right of action, and that the AG must give notice and a 60 day cure period before acting. Several summaries also note that following a recognized risk framework, such as NIST’s Generative AI Profile, can help an organization show it acted responsibly.

How does that connect to shadow AI? You can’t document or govern AI use you don’t know about. An inventory and a written policy are the practical first steps, whatever the statute’s final reach for your business. We’ll cover TRAIGA in more depth in a dedicated post. This isn’t legal advice.

10. A 30-day response plan

Days 1 to 7: find it. Run the discovery checks in section 5, send the anonymous survey, and build the triage table.

Days 8 to 14: decide. For each tool, sanction it, replace it, or block it. Name an owner for each decision. Brief your leadership on what you found.

Days 15 to 21: offer something better. Roll out or confirm the approved tools. Fix the access problems that would make an approved assistant overreach, starting with the broadest SharePoint and Teams exposure.

Days 22 to 30: write it down and train. Adopt the policy, run a short session on what goes where, and set a review date. Schedule the discovery checks to repeat monthly, because new tools appear constantly.

Don’t wait for a perfect answer on every tool before moving. Doing the first week well usually changes your priorities for the rest.

11. Where this leaves your firm

Start with the question you can answer fastest: what’s already in use? Then give people a sanctioned option and a one page policy. Banning without those two things mostly pushes the use out of sight.

If you want a structured look at where your Microsoft 365 environment stands before you roll out an approved assistant, that’s what the AI Readiness Snapshot is for. It’s a starting point for the conversation, not a remediation. For the detection side, start with our discovery checklist. For the data side, read the DSPM guide.

12. Quick answers

What is shadow AI?

AI tools, features, or extensions people use for work without the organization’s knowledge or approval, including personal accounts and AI features that switched on inside approved software.

What’s an example of shadow AI?

A lawyer pastes client facts into a personal AI account to tighten a draft, or an AI notetaker joins a client call that nobody approved.

Is shadow AI the same as shadow IT?

It’s related. Shadow IT is any unapproved technology. Shadow AI adds the issue that prompts and files can leave your environment and be handled under terms nobody reviewed.

How do you detect shadow AI?

Combine cloud discovery, network logs, app consent reviews in Entra, a browser extension inventory, a check of AI features inside approved SaaS, expense reports, and an anonymous staff survey.

What are the risks of shadow AI?

Confidentiality, regulated data handling, professional duties such as those in ABA Formal Opinion 512, intellectual property, retention and eDiscovery gaps, and inaccurate output.

How do you prevent shadow AI without banning AI?

Offer sanctioned tools that fit real work, write a short policy, train people on what data goes where, and repeat discovery monthly.

Do we need an AI acceptable use policy?

Most organizations that allow any AI use benefit from one. Start with our free template and have counsel review it.