Shadow AI: How to Govern the Unauthorized Use of Artificial Intelligence in the Company

In the digital era, the use of artificial intelligence (AI) tools has become common in companies, but it often occurs without adequate control. This phenomenon, known as Shadow AI, represents a significant risk to security, regulatory compliance, and data management.

Risks of Shadow AI

Many organizations have partial visibility into the use of AI, which can lead to:

  • Unauthorized processing of sensitive data, including personal data and intellectual property.
  • Violations of the GDPR and NIS2, with resulting penalties.
  • Exposure to risks related to the AI Act, which classifies AI systems based on the level of risk.
  • Security debt that is difficult to recover if AI agents are not managed correctly.

How to Build a Shadow AI Governance Program

1. Inventory of AI Tools

The first phase involves creating a complete inventory of the AI tools used in the company. This can be done:

  • Checking OAuth and SSO permissions on Microsoft 365, Google Workspace, and other corporate identity systems.
  • Analyzing network logs, proxies, and DNS to track traffic to domains of public AI providers.
  • Conducting an anonymous survey among employees to identify the AI tools used.
  • Mapping MCP servers and AI agent integrations to detect any internal APIs and model frameworks.

For each AI agent, the inventory must answer five key questions: which AI identities exist, which systems they can reach, what privileges they have, what data they process, and why they perform actions with elevated privileges.

2. Classification of AI Tools

Once the use of AI tools has been mapped, it is necessary to assign them to one of three authorization levels:

  • High level: Corporate-approved tools without further restrictions.
  • Intermediate level: Tools allowed with specific rules, such as the prohibition of processing customer data or proprietary source code.
  • Prohibited level: High-risk or non-compliant tools, typically consumer and without contractual guarantees.

The criteria for classification should include:

  • Whether the provider uses the inputs to train their own models.
  • Whether there are certifications such as ISO 27001, SOC 2, or ISO 42001.
  • Whether the tool acts autonomously or only upon explicit request.
  • Whether it produces logs usable in case of inspection.

3. Risk Assessment

The risk assessment must involve various business areas, including security, legal, compliance, HR, and business units. For each use case, it is necessary to verify:

  • What data enters the system and for what purposes.
  • On what legal basis the data is processed.
  • How long the data is stored and with what security measures.
  • Whether there are data transfers abroad.

Additionally, it is important to verify whether the company falls within the scope of NIS2 and whether the AI Act classifies the system as high-risk.

4. Technical and Organizational Control

To ensure technical and organizational control, it is necessary to implement:

  • Sensitivity labels with encryption for data.
  • DLP specific to the prompts and outputs generated by AI.
  • Browser protections to intercept copy and paste to unauthorized tools.
  • Protections at the single prompt level to prevent unauthorized actions.

5. Training and Awareness

Training the staff is a crucial element to mitigate the risks associated with Shadow AI. Companies must:

  • Provide clear guidelines on the use of AI tools.
  • Offer secure and efficient alternatives to unauthorized tools.
  • Regularly update training on security policies and best practices.

6. Monitoring and Continuous Improvement

Implementing a continuous monitoring system allows for the early detection of unauthorized use of AI tools and the timely adoption of corrective measures. It is also important to periodically review and update the governance program based on emerging risks and technological developments.

Context and Impact of Shadow AI

Shadow AI represents a rapidly growing phenomenon with significant implications for corporate security and compliance. According to the Politecnico di Milano Observatory, only 19% of Italian users of AI tools use exclusively corporate-approved solutions. Globally, more than half of employees resort to unauthorized tools when there is no official alternative. This behavior is often motivated by the need for efficiency and the lack of equally fast and intuitive internal alternatives.

Mitigation Strategies

Banning the use of unauthorized AI tools has proven ineffective. On the contrary, adopting a structured governance program that offers official and secure alternatives proves to be a more effective strategy. The Cloud Security Alliance has developed the AI Controls Matrix, an independent framework that provides 243 security controls distributed across 18 domains, aligned with standards such as ISO 42001, ISO 27001, and the NIST AI RMF.

Inventory and Discovery of AI Tools

To build a complete inventory of the AI tools used within the organization, it is necessary to cross-reference different sources of information. This includes:

  • Analysis of OAuth and SSO permissions: Examining access authorizations on platforms such as Microsoft 365 and Google Workspace to identify third-party apps with elevated privileges.
  • Anonymous employee surveys: Collecting information directly from users about the AI tools they use, ensuring the confidentiality of responses.

Classification of AI Tools

Once the AI tools used have been identified, it is fundamental to classify them based on the level of risk and authorization. Examples of authorization levels include:

  • High Level: Corporate-approved tools with contract, DPA, and contractual guarantees on data processing.

Risk Assessment

  • Is the system classified as high-risk according to the AI Act?

Regulatory Compliance

In Italy, full supervision of the obligations imposed by the AI Act will begin on August 3, 2026. The National Control Authority (ACN) will be responsible for general supervision, while the Privacy Guarantor will manage the aspects related to the GDPR. It is fundamental that companies are prepared to respond to audit requests and demonstrate compliance with regulatory requirements.

Training and Awareness

Training the staff is a crucial element to mitigate the risks associated with Shadow AI. Companies must:

  • Provide clear guidelines on the use of AI tools.
  • Offer secure and efficient alternatives to unauthorized tools.
  • Regularly update training on security policies and best practices.

Governing Shadow AI requires a structured and collaborative approach. By using frameworks such as the Cloud Security Alliance's AI Controls Matrix and adopting cross-cutting risk management practices, companies can reduce the risks associated with the unauthorized use of AI tools and ensure regulatory compliance.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all liability for the improper use of the information published.

In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves independently before making any decision.