At the start of September, the National Cyber Security Centre (NCSC) sounded the alarm over the growing presence of “shadow AI” in UK workplaces.
Britain is one of the Europe’s top adopters of generative AI, with around 36% of UK businesses officially using the technology. However, the actual number of UK workers regularly using AI tools — from ChatGPT to coding assistants and AI agents — may be much higher than company adoption figures suggest. Another survey, conducted by Microsoft at the end of 2025, saw 71% of UK employees admit to using an unapproved consumer AI tool at work. And the problem of shadow AI use only appears to be growing.
New data gathered by Turbotic found this month that 88% of senior decision-makers in UK businesses suspect the presence of shadow AI within their organisation. IT departments were the most likely offenders when it came to the use of unauthorised AI at 36%, followed by customer service at 30%, marketing at 28%, and sales at 27%.
With UK organisations keen to scale AI beyond the pilot stage, it’s alarming just how many organisations lack insight into which tools their employees are using, what data is being put into them, or the degree to which AI may be influencing business decisions. Even more concerning is the fact that more than a quarter of respondents (all of whom were directly involved in their organisation’s AI initiatives and deployment decisions) were unfamiliar with the term. Clearly, there is a growing gap between AI adoption and AI risk awareness. The bigger the gap, the more shadow AI rushes in to fill the space.
If organisations want to successfully and safely embed AI into their day-to-day operations, they cannot afford to keep treating visibility, governance, and trust as if they’re of secondary importance to deployment and adoption.
Most importantly, the responsibility for bridging this gap cannot sit with workers. Shadow AI is a leadership issue, and the businesses that successfully mitigate shadow AI usage will be the ones creating an environment where people know what they can use, what they can’t, and why.
What is shadow AI?
Shadow AI refers to the use of AI tools for business that aren’t captured within the organisation’s approved systems and processes.
This rarely takes the form of a single rogue application. Shadow AI grows one small, understandable decision at a time across teams of people trying to hit deadlines and keep their heads above water.
The digital landscape is suffused with AI products that are increasingly the default choice. Meeting recorders and note takers automatically join calls and store transcripts your IT department never sees. Coding assistants on developer machines blur the carefully constructed boundaries around your company’s proprietary code. Browser extensions are installed in a matter of seconds (or automatically) and see everything on an employee’s screen. Without adequate oversight, all of these tools can be sources of shadow AI.
Why is shadow AI growing?
A 2025 study found that over half (58%) of businesses were requiring their staff to use AI tools. One-in-ten said they would fire anyone who refused. However, the widening gap between companies’ appetite for AI and companies’ visibility and oversight when it comes to AI usage is creating the perfect storm of shadow AI usage. Another report by the British Chambers of Commerce found that only one-in-ten UK firms that use AI have their own bespoke or proprietary systems; the overwhelming majority use off-the-shelf, generic tools with limited insight.
As a result, IT teams are often left in the dark as to which AI apps are being used. In turn, employees can easily and unknowingly expose their organisation to very real risks when it comes to data security, compliance and company reputation.
The risks of losing sight of AI usage
When an employee puts sensitive or proprietary company information into an unmonitored AI tool, the company effectively loses control over that data. This can quickly result in GDPR violations and other forms of non-compliance with serious consequences.
Shadow AI creates new avenues for hackers to exploit thanks to AI tools’ novel security vulnerabilities. Malicious actors can successfully exploit one of these vulnerabilities — say, in an unauthorised AI agent whereby an employee has given broad and unsupervised access to company systems — to gain access to all the same privileges, data, and services as the agent.
Putting aside security and compliance, there’s also an issue of quality. Alongside regulatory and compliance breaches, one of the leading fears highlighted by decision-makers in the Turbotic report centred on the risk of shadow AI leading to inaccurate or unreliable AI-generated information influencing business decisions. End products unwittingly created using AI tools can contain serious errors, “hallucinated” references, and other quality control issues, the financial and reputational consequences of which can be severe.
Blaming employees and banning AI: What not to do
Business leaders who are aware of the growing problem posed by shadow AI usage are understandably concerned. The temptation may be to ban certain AI tools and reprimand staff for unauthorised AI usage. But blanket bans are not the answer. Prohibition creates shadow AI, not controlled, responsible usage. People will use unapproved tools under the radar, further obscuring the issue from IT teams and leadership. The risk only grows from there.
Approaching the issue of shadow AI from a punitive or prohibitive stance, or treating it as a problem of employee behaviour, misses the point.
Workers’ lives in 2026 are increasingly defined by and built around AI usage. Companies continue to encourage or make AI usage mandatory; every preexisting digital tool is now replete with AI features; and any productivity gains as a result of using AI are frequently used to justify reductions in headcount and/or increased workloads. Organisations push their staff to do more with less, hailing AI as a cure-all. But without responsible adoption, trust, and oversight, all this does (in addition to creating a burnt-out workforce) is encourage the use of unauthorised AI tools.
Bringing AI out of the shadows
Responsible AI adoption means bringing unauthorised AI usage out of the shadows. Companies must develop an understanding of which unauthorised AI tools are being used within their technology estate, why employees need them, and then evaluate if and how to implement a company-approved version. This should be underpinned by an enforceable AI policy that establishes clear practices for data hygiene, uploads, exceptions, and ownership.
The employees using shadow AI aren’t doing it out of spite or laziness. More likely than not, rising workloads, pro-AI company stances, and widespread layoffs have created a real need for these tools. The fact that employees are turning to unauthorised solutions is a shortcoming of decision-makers and their efforts to encourage AI deployment without the necessary oversight, governance, and training to ensure it happens safely and responsibly.
Shadow AI is a serious problem when it comes to properly managing the risks of AI use, and encouraging more adoption without the requisite visibility, governance, and trust will only make the problem harder to manage as deployments scale.
Theo Bergqvist
A seasoned entrepreneur and business leader with more than 25 years of experience building, scaling, and transforming companies in AI, gaming, digital platforms, and enterprise IT, Theo Bergqvist is the CEO and Co-founder of Turbotic, one of Europe’s most recognized AI companies, and serves as an advisor to leading firms including Evoke, LeoVegas, and Fortuna Entertainment, as well as an advisory board member to Handelsbanken Fonder.
