Shadow AI
Shadow agents · Unapproved AI · Ghost agents
Shadow AI refers to AI tools and agents adopted in an organization outside any framework or supervision, and therefore invisible to its governance. A shadow agent goes one step further, because it acts as well as advises, without appearing on any register.
A signal before it is a fault
Shadow AI grows where the organization has not said what is permitted, and teams settle the question themselves. It says at least as much about an unmet need as about disobedience. Banning it settles little and tends to push the usage out of sight: Samsung's decision in 2023 to restrict generative tools after sensitive code was pasted into one illustrates how quickly the subject reaches management. The more durable response treats it as a matter of hygiene, preferring a declared and bounded use to a hidden one even when the hidden one performs better.
The four routes in
- Internal development by a team under pressure.
- A feature that switches on inside a tool already installed.
- A personal tool an employee brings along.
- A supplier automating its own service without telling its client.
How to detect it
Network analysis finds some of it. The decisions themselves reveal more, so start from the map and watch for three signals:
- A processing time that collapses with no explanation.
- Sudden regularity in work that used to vary from one person to another.
- A modest recurring expense outside any identified project budget.
What to do with an agent you find
An agent that has been found does not get deleted on principle. It goes into the inventory with its purpose, its supplier, its data, its users and its contract, then receives a criticality rating, an autonomy level and an owner. Registration is the step that turns it into something that can be governed. The OECD identifies shadow agents as a growing concern among the organizations it interviewed.
Frequently asked questions
Why is shadow AI dangerous?
The main risks are data leaving the organization, decisions nobody knows are automated, and no record to produce when asked. For a shadow agent, add actions carried out with nobody responsible.
Should companies ban ChatGPT and similar tools?
A blanket ban tends to drive usage toward personal accounts. A short list of approved tools, clear data rules and an easy way to request a new tool generally work better.
Where does your organization stand?
ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.
Related terms
Primary sources
Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .