Shadow AI and the Risks of Employees Using Unapproved AI Tools

Organizations are increasingly using artificial intelligence (AI) to complete a range of everyday tasks, including summarizing documents, analyzing data and engaging with customers. However, as AI adoption accelerates, governance frameworks are struggling to keep pace, leaving organizations exposed. One such exposure is “shadow AI,” where employees use AI tools that have not been approved or governed by their employer. This is rarely malicious and typically stems from efforts to improve productivity before formal AI policies and approved tools have been established. Although AI can help employees find efficiencies, the use of unsanctioned tools can create cybersecurity, privacy, regulatory and intellectual property (IP) risks for impacted employers.

The risks of shadow AI

According to a 2026 Verizon report, 45% of employees regularly use AI on corporate devices, and two-thirds of those users access the services through unsanctioned accounts rather than tools provisioned by their employer. Employees may upload sensitive information, including source code, financial records, HR files, customer information or contracts, without fully understanding how AI platforms handle such data. Many public AI platforms retain user inputs to improve their models or process data through third-party infrastructure, meaning sensitive information may persist in systems outside the organization’s control. As a result, unauthorized use of AI can increase the risk of data breaches and the disclosure of confidential information.

The risks associated with shadow AI are not limited to security. Organizations are typically subject to data protection and privacy laws that govern how sensitive information is collected, processed and shared. Entering protected or confidential information into external AI platforms without appropriate oversight may create compliance risks. In addition, customer contracts, confidentiality agreements and other commercial arrangements may restrict what information companies can disclose to third parties, including unapproved AI services.

Importantly, shadow AI is often driven by convenience, productivity pressures and the absence of approved alternatives rather than malicious intent. As such, unauthorized use may be difficult to distinguish from legitimate business activity.

Potential business consequences

When sensitive information is shared through unapproved AI tools, organizations may face consequences such as data breaches and IP loss. Depending on the nature of the incident, organizations may incur costs for incident response, forensic investigations, legal advice, regulatory inquiries, customer notifications and remediation efforts. Unauthorized disclosures may also damage an organization’s reputation and erode customer trust.

Together, these consequences can result in significant financial losses. In fact, organizations with high levels of shadow AI paid an average of $670,000 more per breach in 2025 than those with low or no shadow AI, according to a recent IBM report.

Coverage implications

AI’s rapid expansion is prompting insurers to reassess whether existing policy frameworks adequately address AI-related risks, including those stemming from shadow AI. Cyber policies have historically responded to AI-enabled incidents, such as data breaches, while technology errors and omissions insurance has responded to claims arising from failures in AI-enabled products and services, without either line expressly referencing AI. This approach, where policies neither expressly grant nor exclude coverage for AI-related losses, is commonly referred to as "silent AI" exposure. However, the Insurance Services Office released standard generative AI exclusion forms for commercial general liability policies in January 2026, signaling a shift toward explicit AI risk allocation rather than implicit coverage. Similar exclusionary language is extending into other coverage lines (e.g., directors and officers, EPLI, and tech E&O), meaning claims stemming from shadow AI may be subject to coverage uncertainty or gaps. Organizations should review their full insurance programs—not just cyber coverage—at renewal to identify new or amended AI-related exclusions before a claim arises.

Risk mitigation strategies

Organizations should also consider the following measures to reduce the risk associated with shadow AI:

• Inventory AI use. Organizations should identify and track the AI tools being used across the business to gain visibility into AI adoption and uncover any unapproved or unauthorized use.
• Establish an AI use policy. Organizations should develop and communicate a comprehensive written AI policy that outlines approved AI tools and sets clear rules on the types of information that may be shared with them. Organizations may wish to follow the National Institute of Standards and Technology Risk Management Framework when developing their approach to AI.
• Provide approved alternatives. To discourage shadow AI and ensure employees have the resources they need to work effectively, organizations should provide approved AI tools that meet genuine business needs rather than prohibiting AI use altogether.
• Vet AI vendors. Organizations should vet AI vendors to evaluate their security controls, privacy practices, data retention policies and contractual terms, including whether user inputs are retained and used to train the vendor’s models.
• Implement technical safeguards. Organizations should deploy a range of technical safeguards, including access controls, network controls, monitoring tools and data loss prevention software, to help identify and limit unauthorized AI use.
• Train employees. Organizations should train employees in the dangers of shadow AI, the benefits and limitations of AI technologies, and their role in protecting organizational data.
• Follow authoritative guidance. Organizations should consider consulting guidance from the Cybersecurity and Infrastructure Security Agency and other cybersecurity authorities when developing AI governance and security practices.

Key takeaways

Shadow AI is a growing exposure that could leave organizations vulnerable to cybersecurity, privacy and regulatory risks, as well as financial losses. Organizations should establish clear AI governance, provide approved alternatives and train employees on the risks of shadow AI to reduce exposure and support the responsible use of AI. They should also review their insurance programs to understand how AI-related losses may be covered and identify any gaps.

Contact us today for more information and to review your coverage.