Shadow AI
Shadow AI is the use of AI tools inside an organisation without the knowledge or approval of those responsible for security and risk. An employee pastes confidential data into a consumer chatbot; a team wires an unapproved agent into live systems. It is the AI successor to Shadow IT, and the exposure is the same in kind but larger in scale: data leaves the perimeter, decisions go unlogged, and no one can say afterwards what happened.
In practice
In regulated sectors it has already become a board-level concern, with the first SEC disclosure triggered by unauthorised AI use, rather than a cyberattack, filed in 2026. A ban does not hold, because the tools are free and the productivity gain is real, so the working answer is a sanctioned, logged option that is easier to use than the unsanctioned one.