Every AI governance program eventually hits the same wall. The policy is approved, the review board meets, the approved-tools list is published, and yet most of the AI actually being used in the organization never passed through any of it. Employees summarize client calls in personal chatbot accounts, install AI browser extensions, connect assistants to mailboxes through OAuth, and increasingly build their own agents with low-code tools. This is shadow AI, and in 2026 it is the largest gap between what governance documents say and what really happens.
This playbook explains why shadow AI has grown into a board-level issue, how it differs from classic shadow IT, and how to run a structured program that discovers it, triages it by risk, and brings it into governance without driving usage further underground.
Why Shadow AI Became a Governance Priority
The scale is hard to ignore. A ManageEngine study conducted by Censuswide in May 2025, surveying 350 IT decision makers and 350 employees at US and Canadian organizations with at least 500 staff, found that 93% of employees admitted entering information into AI tools without approval, 32% had entered confidential client data without confirming approval, and 85% of IT leaders said employees adopt AI tools faster than IT can assess them. Only 54% of IT leaders said they had clear, enforced policies with active monitoring.
Other surveys use narrower definitions and land on lower but still material numbers. 1Password’s 2025 annual report, based on a survey of more than 5,000 knowledge workers in North America, Europe and Singapore and reported by Infosecurity Magazine, found that 27% had worked with AI tools their company had not authorized and 37% said they did not always follow company AI policies. Convenience and productivity were the most cited reasons, and common uses included summarizing customer call notes and analyzing customer data.
A May 2026 research note from the Cloud Security Alliance, which compiles mostly vendor telemetry and vendor-sponsored surveys, adds that a majority of connections to generative AI tools use personal rather than corporate accounts, that the number of generative AI SaaS applications tracked by one security vendor grew several-fold during 2025, and that unauthorized AI tools often stay active for many months before detection. The note flags that these numbers come from different sources and periods, so treat them as directional. The direction, though, is unmistakable.
Three developments made the problem sharper in 2025 and 2026:
- From chat to action. Early shadow AI was mostly copy-and-paste into chatbots. Today’s tools connect to mail, files and business systems, and agents can take actions, execute code and hold credentials.
- Protocols that bypass old controls. Agents talking to tools over the Model Context Protocol or agent-to-agent protocols create traffic patterns that traditional web filtering and data loss prevention were not designed to inspect.
- Regulatory inventory expectations. AI laws in the EU, Korea, Vietnam and several US states assume organizations know which AI systems they deploy. You cannot classify, assess or disclose what you cannot see.
How Shadow AI Differs From Classic Shadow IT
It is tempting to reuse the shadow IT playbook: discover SaaS apps, block the risky ones, sanction the rest. That is necessary but not sufficient, because shadow AI has characteristics that classic SaaS did not:
- It is embedded. AI features appear inside tools you already approved, often switched on by a vendor update rather than a procurement decision.
- It is personal. Usage frequently happens in personal accounts on corporate devices, or on personal devices entirely, out of reach of SSO and corporate logging.
- It is generative. The risk is not only where data is stored but what the model outputs and what decisions people make based on it.
- It is agentic. An employee-built agent with delegated permissions behaves more like a new non-human identity than an app.
Blocking alone does not fix shadow AI. The single most effective control is giving people a sanctioned tool that is genuinely good enough for the job, then making the governed path easier than the ungoverned one.
The Shadow AI Program in Five Phases
The program below is designed to run over roughly a quarter for a mid-sized organization, then continue as a steady-state process. Adjust the pace to your size and regulatory exposure.
Phase 1: Set the Frame (Weeks 1–2)
Before any discovery, decide what you will do with what you find. If employees expect punishment, they will hide usage and your inventory will be fiction. Publish a short amnesty-style message: the goal is to understand needs and provide safe tools, and self-reported usage will not lead to disciplinary action.
- Appoint an executive sponsor and an AI asset owner responsible for the inventory.
- Agree on a data classification mapping for AI use: which data classes may go into which tool categories.
- Define triage categories (approve, approve with conditions, replace, block) and who decides.
- Draft or refresh a concise AI acceptable-use policy written in plain language.
Phase 2: Discover (Weeks 2–6)
Use several discovery channels at once, because each sees a different slice of usage:
- Network and SSE telemetry. Secure web gateway, CASB or security service edge logs reveal traffic to known AI domains, including personal-account logins.
- Identity and OAuth audits. Review third-party app grants in your identity provider and collaboration suites. AI assistants with mailbox or drive scopes are a priority finding.
- Browser extension inventory. Endpoint management can list installed extensions; AI writing, meeting and summarization extensions are common and often request broad page access.
- SaaS feature review. Check admin consoles of approved SaaS platforms for AI features and their default settings, including data retention and training opt-outs.
- Agent and automation platforms. Inventory agents and flows built on low-code and agent builder platforms, along with the connectors and credentials they use.
- Expense and procurement data. Small recurring card charges for AI subscriptions are a reliable signal of team-level adoption.
- Self-reporting. A short survey asking what people use, for which tasks and with what data often surfaces the most useful information about unmet needs.
Phase 3: Triage by Risk (Weeks 5–8)
Consolidate findings into a single register and score each item. A simple scoring model works well when it combines four factors:
- Data sensitivity: public, internal, confidential or regulated data involved.
- Autonomy: read-only assistance, drafting with human review, or autonomous actions.
- Access scope: no integration, single-app integration, or broad delegated access across systems.
- Decision impact: personal productivity, customer-facing output, or decisions affecting people’s rights or money.
High scores on any two factors warrant immediate review. A personal chatbot account used to draft social posts is low priority; a browser extension with access to every page in a CRM, or an agent with write access to finance systems, is high priority regardless of how few people use it.
Phase 4: Decide and Provide (Weeks 7–12)
For each triaged item, choose one of four outcomes:
- Approve when the tool meets security and contractual requirements. Move it to corporate accounts with SSO.
- Approve with conditions such as data class limits, disabled training, retention settings or mandatory human review.
- Replace with a sanctioned alternative that covers the same need. This is often the best answer for popular personal chatbots.
- Block when risk is unacceptable and no conditions can mitigate it, and explain why in plain language.
The Cloud Security Alliance note cites a vendor finding that unauthorized use drops sharply when sanctioned alternatives are available, and ManageEngine’s respondents asked for exactly that: practical policies, official tools relevant to their tasks and better education on risks. Most shadow AI is a symptom of unmet demand. Prioritize an enterprise-grade assistant, approved meeting summarization and a governed way to build simple agents, because these cover the most common tasks employees report.
Phase 5: Enforce and Sustain (Week 10 Onward)
- Configure SSE or CASB policies to allow approved tools, block personal-account logins on corporate devices where appropriate, and apply inline data loss prevention to prompts and uploads.
- Restrict OAuth consent so that new AI apps requesting sensitive scopes require admin approval.
- Govern agents as non-human identities with owners, least-privilege credentials, expiry dates and logging, and route MCP traffic through a gateway where possible.
- Add AI features to vendor review and renewal checklists so embedded AI is caught when it is switched on.
- Review the register monthly and report trends to the governance board quarterly.
Roles and Responsibilities
Shadow AI sits between security, IT, legal, data and the business, which is exactly why it falls through the cracks. Make ownership explicit:
- AI asset owner (often in the AI governance office or CIO organization): maintains the register, runs triage meetings and tracks decisions.
- Security: operates discovery tooling, DLP and SSE policies, and assesses vendor security.
- Identity team: governs OAuth consent, service identities for agents and credential lifecycle.
- Legal and privacy: reviews contractual terms on retention, training and data residency, and maps usage to regulatory obligations.
- Business champions: represent user needs, pilot sanctioned alternatives and spread good practice in their teams.
What a Useful AI Acceptable-Use Policy Covers
The policy is the anchor for everything else, and it should fit on two pages. Strong policies answer the questions employees actually have: Which tools can I use, with which kinds of data? Do I need to review AI output before sending it to a client? Can I connect an assistant to my mailbox? Can I build an agent, and who must approve it? What should I do if I pasted something sensitive by mistake? Include short examples of acceptable and unacceptable use for each data class, a clear route for requesting a new tool with a promised response time, and a no-blame reporting path for mistakes. A policy that promises a decision on new tool requests within days, and keeps that promise, removes much of the motivation for going around it.
A Hypothetical Worked Example
Imagine a hypothetical professional services firm with 2,000 employees across offices in North America and Asia-Pacific. Its governance board approved an AI policy a year ago, but leadership suspects actual usage is much broader.
In discovery, network telemetry shows heavy traffic to several consumer chatbots, most via personal accounts. An OAuth audit finds a meeting-notes assistant with calendar and mailbox access granted by more than a hundred staff. The extension inventory surfaces an AI writing extension with permission to read all web pages, including the firm’s document management system. The agent platform review finds a dozen flows built by a finance analyst that read invoices and post entries to the ERP using the analyst’s personal credentials. A staff survey reveals that the most common need is summarizing long documents and drafting client emails.
Triage puts the finance agents and the writing extension at the top: both combine sensitive data with broad access. The agents are rebuilt under a service identity with read-only ERP access and human approval for postings. The extension is blocked and replaced by the assistant built into the firm’s approved productivity suite. The meeting-notes tool is approved with conditions after contractual review of retention and training terms, and moved to SSO. Consumer chatbot use is redirected to an enterprise assistant, with clear guidance on which data classes it may handle. Within a quarter, the firm’s register reflects reality, and the board receives monthly metrics instead of guesses.
Metrics That Show Progress
- Share of AI traffic going to approved tools via corporate accounts.
- Number of high-risk register items open versus resolved.
- Median time from discovery of a new AI tool to triage decision.
- Percentage of agents with a named owner, least-privilege credentials and logging.
- Employee awareness of the AI policy, measured through short pulse surveys.
- DLP events involving AI destinations, trended over time.
Pitfalls to Avoid
- Leading with prohibition. Blanket bans push usage to personal devices where you have no visibility at all.
- Discovering once. New tools appear weekly. Discovery must be continuous, not a one-off audit.
- Ignoring embedded AI. Approved platforms adding AI features is now the most common route for unreviewed AI.
- Treating agents like apps. Agents need identity governance, not just application approval.
- Policies nobody reads. A two-page plain-language policy with examples beats a twenty-page legal document.
Outlook
Over the next two years, shadow AI will shift from people using unapproved chatbots toward people creating unapproved agents. As agent builders become standard features of productivity and business platforms, the number of autonomous workflows will far exceed what manual review can handle. Expect governance to move toward automated guardrails: policy enforced at AI gateways, identity platforms that treat agents as first-class identities, and continuous discovery feeding the AI register automatically. Regulators are also likely to ask harder questions about how organizations know their AI inventories are complete.
Conclusion
Shadow AI is less a compliance failure than a signal of demand. The organizations that handle it well treat discovery as a listening exercise, triage by real risk rather than tool popularity, and make the governed path the easiest path. Combine multi-channel discovery, a simple risk score, sanctioned alternatives and identity-based controls for agents, and your AI register will finally describe the AI your people actually use.
How Hanoi Technology Can Help
Hanoi Technology helps organizations discover unsanctioned AI, build a living AI register and deploy governed alternatives and agent controls.