What it means
Shadow AI is the AI-era version of shadow IT: staff adopting consumer AI tools on their own initiative, usually because the tools genuinely help and the sanctioned alternative is absent or worse.
The concrete exposure is data. Source code, customer records, contracts and strategy documents pasted into consumer accounts leave the organization's control, and consumer terms frequently differ from enterprise terms on retention and training use.
The secondary risks are quieter: unreviewed AI output entering work products, no audit trail for decisions, and no idea which vendors hold company data.
Prohibition performs badly. Bans push usage onto personal devices where there is no visibility at all, converting a manageable problem into an invisible one. Organizations that provide a sanctioned tool with enterprise terms and clear rules consistently see better outcomes than those that forbid it.
Why it matters
Almost every organization has this whether or not it knows, and surveys consistently find usage far above what leadership estimates. The realistic goal is redirection rather than elimination — the demand is genuine and will route around a ban.
In practice
Provide a good sanctioned option first, then set rules about what data may go into it. Rules without a usable tool produce non-compliance; a usable tool with clear rules produces most of the benefit and most of the control.