Shadow AI : What are the Risks for Your Company’s Data?

The use of ungoverned AI tools exposes organizations to risks that cannot be easily detected. How can you maintain control over your data?

Let’s take the example of an employee tasked with reviewing a contract containing confidential contractual terms. In order to save time, they upload it to an artificial intelligence tool that was not approved by your company and request a summary. A few seconds later, AI generates an overview. However, without realizing it, the employee may have disclosed confidential information to an external entity.

This is essentially the danger of shadow AI or phantom AI, which is the use of artificial intelligence tools in the workplace without the organization’s approval or official governance. Employees are often driven by a desire for efficiency, but these practices create risks that are difficult to manage, since they can go unnoticed.

Sensitive data outside the company’s control

A contract uploaded to an AI tool could contain information about your clients, pricing, suppliers and business strategies. However, the practices of the AI entity that receives this information may not have been verified by your organization.

Depending on the tool, its settings and the applicable agreements, this information could be processed or stored on external servers located overseas or even in countries considered adversaries. Your data remains in your systems, but a copy is now stored in an environment where you do not have the same level of control.

A development team that shares source code with an AI assistant also risks exposing the company’s intellectual property. Where the code contains personal information, this raises compliance issues, particularly with regard to Law 25.

The use of agentic AI takes the risk to another level. For example, an employee could create an agent to automate certain tasks and grant it access to internal documents and applications. Since the AI agent is capable of making decisions and acting independently, it could disclose sensitive information to an external entity to complete its task even if the employee did not expressly ask it to do so. Without the appropriate safeguards, there is a risk that an AI agent could perform tasks that go beyond what was requested or authorized.

The risks of sharing sensitive data

Simply sharing data with an external tool does not automatically mean that the data will be compromised. However, this action can expand an organization’s attack surface, which is the sum of possible points that could be used to compromise systems and information.

Let’s imagine that an employee uses a personal account to access an AI assistant. Over the course of several weeks, they upload internal documents and client information. If this account is compromised, its history could reveal sensitive information.

A cybercriminal could use this information to launch a targeted phishing attack, impersonate a supplier or facilitate an IT intrusion. The company’s information could also be compromised where the AI provider is the victim of a security incident.

Shadow AI: a blind spot for business leaders

Business leaders themselves may prioritize productivity gains without paying the same attention to information security.

For example, a company planning to enter a new market will analyze the financial risks before investing. So why not apply the same thorough approach when adopting technology that could access its most sensitive information?

In reality, this lack of supervision is widespread. According to IBM’s Cost of a Data Breach Report 2025, 63% of the organizations surveyed that had experienced a data breach reported that they had not put in place an AI governance policy or were still in the process of developing one.

The AI features built into your company’s software also warrant special attention. Even where tools are provided by an approved supplier, they may not have undergone a security assessment.

How can you regain control without slowing innovation?

Systematically banning the use of AI tools is not a sustainable response. The best approach is to understand how employees use the tools, assess the risks and offer them secure solutions tailored to their needs.

You should focus on four initiatives.

• Take stock of current AI usage. Which AI tools are used in your organization? Who uses them? What information is shared with the tools? This exercise should also include the AI features integrated into existing software.
• Establish clear rules. An acceptable AI use policy should specify the authorized tools, data categories that can be shared with the tools and required approvals. It should also take into account the actual needs of your teams.
• Build a monitoring and response framework. Data loss prevention (DLP) solutions in particular can help identify certain instances of sensitive information transmission. Your organization should also know how to respond if it detects unauthorized use or data exposure.
• Train employees. AI users should understand why certain practices pose risks and know what steps they should take. Even if your policy is clear, it will have no impact unless employees are informed and trained.

You must also ensure that staff know the rules. You can’t blame an employee for failing to follow instructions that were not properly communicated.

Security policies and tools will not eliminate the risks of shadow AI. As technology evolves, so do your employees’ habits. Therefore, it’s important that you keep pace with changing AI usage and regularly reassess risks.

The management team must take the lead and determine the risk level the company is willing to accept. Security remains a shared responsibility, but leaders must ensure that everyone is aware of the guidelines and has the resources to take action.

The objective is not to eliminate all risks, but to understand which risks the organization faces and make the necessary decisions.

Would you like to better protect your business against the risks associated with shadow AI? Contact us!