What is shadow AI and how should CISOs govern employee use of generative AI?

Shadow AI is the use of AI tools by employees outside the systems and processes their organisation has approved, a form of shadow IT that the UK National Cyber Security Centre (NCSC) examined in a blog post published on 7 September 2026. The NCSC's advice to organisations is to reduce the risk rather than assume it can be eliminated, by giving staff approved AI tools that meet their needs and building a culture in which people are open about what they use.

The NCSC traces the problem to a gap in pace: workplace AI use has grown quickly, while the policies and guidance meant to manage its risks have not always kept up.

How common is shadow AI?

Common enough that most organisations should assume it is already happening. The NCSC cites a study in which nearly three-quarters of employees, 71%, said they had used AI tools their employer had not approved.

It expects the trend to strengthen as AI becomes cheaper and easier to get, and warns that where security policy cannot meet business needs, staff will keep adopting new AI services before the organisation has assessed them.

What are the security risks of shadow AI?

The main risks are data leaving the organisation's control and new footholds for attackers. According to the NCSC, feeding company or customer data to unapproved AI likely raises the risk of data breaches, intellectual property loss and regulatory failures, because the provider may store, retain or train on that data.

The NCSC made a related point in March 2023 about public chatbots: queries are stored and almost certainly used to develop the service, and stored queries could be hacked, leaked or accidentally exposed. It added that a question can be sensitive because of who asks it and when, not only because of the data it contains.

Unapproved agents are a sharper version of the problem. The NCSC notes that an attacker who exploits a flaw in an AI agent inherits the data, services and privileges the agent can legitimately reach, and it judges attackers highly likely to use loosely guarded agents to exploit weaknesses in corporate IT.

Should companies ban generative AI tools?

Outright bans have been tried, but the NCSC does not recommend that people stop using AI and expects shadow AI to persist regardless. Samsung offers one reported example: in May 2023, after sensitive internal data was leaked to ChatGPT, it temporarily restricted generative AI on company-owned devices and on other devices running on its internal networks.

TechCrunch reported that in an internal Samsung survey, about 65% of participants said generative AI tools carried a security risk, and that several large banks had also restricted staff use of ChatGPT. Samsung described its restriction as temporary while it built a secure environment for generative AI.

The NCSC's 2023 position still reads as the balanced one: people who want to experiment with LLMs should be able to, in a way that does not put organisational data at risk. Any restriction a security team imposes should therefore arrive together with an approved alternative that does the same job.

How should CISOs govern employee use of generative AI?

Govern it like any other data flow: know what is in use, provide sanctioned options, and set clear rules for what data may go where. The NCSC's 2023 recommendations remain the simplest baseline, telling staff not to put sensitive information into public LLMs and not to submit queries that would cause problems if they became public.

Culture comes next. The NCSC argues that open communication about security makes staff much less likely to reach for shadow services, and that organisations which understand why people use unapproved AI are better placed to offer secure alternatives. Its summary is blunt: you cannot manage what you do not know.

When choosing approved tools, check contract terms on data use. The NCSC says organisations need to understand how data used for fine-tuning or prompt augmentation is managed, and OWASP lists user guidance on keeping sensitive information out of prompts among its mitigations for data disclosure.

For agents that staff connect to work systems on their own, the NCSC's agentic AI advice applies: never give an agent unrestricted access to sensitive data or critical systems. In practice, a workable programme combines a published list of approved AI services, a short data classification rule for prompts, a fast route for requesting new tools, and periodic discovery of unapproved AI traffic.