What is shadow AI?
Shadow AI is staff using AI tools the business did not approve, usually a personal account, with company or client information pasted in. The work may look finished. The data left a door you do not control.
Also called: shadow IT
In plain English
Someone gets a better draft at home and starts pasting client questions into a free chat. You see the polished email and not the paste. That is shadow AI. It is the same pattern as shadow IT, a personal app holding the real process.
How an owner would use it
Ask what people actually use. Offer a company tool that is not painful, and a clear ban on client lists in personal accounts. If the approved tool is so locked down that nobody can draft a sentence, they will route around it.
Common mistakes
Banning AI in a memo while the busy season stays impossible just moves the pasting out of sight. Shaming a person who found a faster draft, without giving them an approved place, does the same. Do not upload a client's full return to 'see what the bot says.' Do not assume a free tier keeps your files private because the marketing sounded friendly. Read the vendor's current data terms.
A worked example
A three-person CPA office
The good draft came from a personal account
This is an illustration, not a customer result. A preparer has been pasting client notes into a personal chat to rewrite emails. The office picks one company workspace, turns memory of client facts off, and says personal accounts are for lunch ideas, not returns. They do not pretend the old pastes can be pulled back.
Related terms
Prompts and guides
Questions owners ask
What is shadow AI?
It is unapproved AI use on company work, most often a personal chat account that has been given client or customer information.
How do I reduce shadow AI without spying on phones?
Ask in the open, provide one approved tool, and make the forbidden paste list specific. Check the work product for facts the approved tool never received.
Is shadow AI the same as an AI policy violation?
If you have a policy, yes, it is a break of that policy. If you have no policy, it is still data leaving through a door you did not choose. Write the policy after you know what people are already doing.
Product guides are on AI apps for business.