Governance and risk

What is Shadow AI really costing you?

Your people didn’t stop using AI. They stopped using yours. Shadow AI is the predictable outcome of organisational friction, not employee resistance.

Somewhere in your organisation, company work is being completed in free consumer AI tools on personal devices. Not because your people are careless, but because the approved path is harder than the ungoverned one, and people tend to take the easier route.

Shadow AI, defined

Shadow AI is the use of ungoverned consumer AI tools to complete company work. It is not a training failure and it is not defiance. It is a workflow outcome. Policy memos prohibit it; they do not remove the friction that causes it, so the behaviour continues out of sight.

A liability that is hard to bound

When work moves to ungoverned tools, client records, code and contract terms leave governed infrastructure. This is the Unfunded Liability of Shadow AI Data Breaches, and its defining feature is that it is difficult to budget for, difficult to bound and, once realised, difficult to reverse.

Three properties make it a board-level exposure. Privacy penalties scale with turnover, so the potential cost is hard to cap in advance. Leaked intellectual property cannot be recalled once it is out. And a single incident can cost more than the entire AI programme was expected to return. Unlike a licence cost, none of this appears on a schedule until it arrives.

The decision this informs

The instinct is to treat Shadow AI as a policy problem and issue a firmer memo. The more accurate question is whether it is a policy problem or a workflow problem. The evidence points to the second: people are not choosing risk, they are choosing the easier way to get work done.

That reframes the intervention. Reducing Shadow AI is less about prohibition and more about making the secure, corporate-approved path the easiest path, so compliance happens by default rather than by enforcement.

Before an incident makes the cost visible for you, measure where your approved AI path creates the friction that sends work into ungoverned tools.