Shadow AI: How Do You Know What AI Your Business Is Actually Using?

Artificial intelligence has moved into the workplace at extraordinary speed. Employees are using AI to write documents, analyse data, generate code, summarise meetings, create presentations and automate everyday tasks.

For businesses, this creates enormous opportunities for productivity and innovation. But it also creates a new challenge for IT, security and governance teams.

Do you actually know what AI is being used across your organisation?

You may know about the AI platforms that have been formally approved. You probably know which employees have Microsoft 365 Copilot licences. Your development teams may have registered OpenAI projects and API keys.

But that may represent only part of your organisation's real AI footprint.

Employees can access public AI services directly from a browser. Developers can experiment with new AI APIs. Teams can introduce AI-powered SaaS applications without involving IT. Locally installed large language models (LLMs) can run directly on corporate devices, while AI models can also operate inside virtual machines and containers.

The result is a rapidly growing technology challenge known as Shadow AI.

What Is Shadow AI?

Shadow AI describes the use of artificial intelligence tools, models, applications and services within an organisation without the full knowledge, approval or oversight of IT, security or governance teams.

It is, in many ways, the next evolution of Shadow IT.

For years, organisations have struggled with employees adopting cloud applications outside established procurement and IT processes. AI significantly accelerates this problem because access is so easy.

An employee can create an account with an AI service in minutes. A developer can generate an API key and integrate an AI model into an application. A technically advanced user can download and run an LLM locally.

AI capabilities are also increasingly embedded inside existing applications, making the boundary between traditional software and AI-enabled software increasingly difficult to identify.

This means an organisation's actual use of AI can be significantly larger than its list of officially approved AI platforms.

Why Is Shadow AI a Problem?

The problem with Shadow AI is not necessarily that employees are using artificial intelligence.

AI can deliver substantial benefits when it is used appropriately.

The problem is lack of Operational Visibility.

If an organisation does not know which AI tools and services are being used, it becomes extremely difficult to understand the associated risks.

For example, employees may paste confidential business information, customer data or intellectual property into public AI platforms without understanding how that information may be processed or retained.

Developers may create API keys that remain active long after a project has ended. Teams may adopt AI services without considering data residency, regulatory requirements or security policies.

Organisations can also accumulate unnecessary AI costs as projects, subscriptions and API usage grow across different departments.

Without visibility, IT and security teams are left trying to govern an AI environment they cannot fully see.

The AI Visibility Gap

Most organisations already have established processes for understanding their traditional technology environment.

IT Asset Management tools can identify devices and installed software. SaaS management platforms can identify cloud subscriptions. Identity platforms can show users, applications and authentication activity.

But AI introduces a new layer across all of these environments.

An organisation's AI estate may include approved enterprise AI platforms, generative AI services, AI-enabled SaaS applications, locally installed LLMs, developer APIs, AI agents and AI capabilities embedded inside existing software.

Some of these will be centrally managed.

Others will not.

This creates an AI visibility gap between the AI that an organisation knows about and the AI that is actually being used.

Closing that gap is becoming an important part of modern IT operations and AI governance.

You Cannot Govern What You Cannot See

Many organisations are now developing AI governance policies that define how employees should use artificial intelligence.

These policies may specify which AI platforms are approved, what types of information can be processed and how AI-generated content should be handled.

Policies are important, but policies alone do not provide visibility.

An organisation might have a policy stating that only approved AI platforms should be used. But how does it know whether employees are following that policy?

Similarly, a business may require AI projects to be registered with IT or security teams. But how does it identify projects that were never registered?

Effective AI governance therefore needs to begin with a simple question:

What AI exists across our organisation today?

Answering that question requires organisations to move beyond policies and begin developing visibility into their actual AI estate.

From AI Discovery to AI Inventory

The first stage is AI discovery: identifying the AI technologies, applications, services and models that may exist across the organisation.

Different sources can contribute pieces of this picture.

Software inventory data may reveal locally installed LLM tools and AI applications. Cloud and SaaS monitoring can identify known AI platforms. API monitoring can provide visibility into services such as OpenAI. Microsoft 365 environments can provide insight into Copilot adoption and usage.

No single source will necessarily reveal everything.

For example, a locally installed LLM may be visible through endpoint software inventory, while a model running inside a container or virtual machine may require different discovery techniques. Browser-based AI services create another visibility challenge.

The goal is therefore not simply to run a one-time scan for AI software.

It is to progressively build an AI inventory that provides an increasingly complete picture of the organisation's AI estate.

That inventory could eventually help organisations understand what AI technologies exist, where they are being used, whether they are approved, who is responsible for them and whether they require further investigation.

From Discovery to Continuous AI Visibility

Discovering AI is only the beginning.

Once an organisation starts to identify the AI technologies being used across its environment, it can begin building an AI inventory—a structured view of the applications, services, models and other AI technologies that make up its wider AI estate.

The next challenge is keeping that visibility current.

AI environments can change rapidly. New tools appear, employees experiment with new services, developers create new projects and API keys, and AI providers regularly introduce or retire models.

This means AI governance cannot rely entirely on periodic assessments or manually maintained spreadsheets.

Organisations increasingly need continuous operational visibility into their AI environments.

A practical approach can be viewed as a simple lifecycle:

Discover → Monitor → Understand → Govern → Optimise

Discover the AI technologies, applications and services that exist across the organisation, using those findings to build and maintain an inventory of the AI estate.

Monitor the activity, usage, costs, projects, API keys, models and other signals that help reveal how that AI estate is changing.

Understand what those signals mean by bringing information together into useful operational context—identifying risks, unexpected activity, emerging trends and areas that require attention.

Govern AI use based on evidence and visibility, applying organisational policies and controls to approved and unapproved technologies.

Optimise the AI estate by reducing unnecessary costs, addressing unused resources and ensuring AI investments are delivering value.

This continuous lifecycle helps organisations move beyond simply knowing that AI is being used. It provides a framework for understanding what AI exists, how it is being used, what it means for the organisation and where action may be required.

Understanding Your AI Estate

Shadow AI is likely to become an increasingly important challenge as artificial intelligence becomes embedded into more applications, devices and business processes.

The organisations that manage this transition successfully will not necessarily be those that impose the most restrictions on AI.

They will be the organisations that develop the best visibility.

Understanding what AI exists across the business provides the foundation for better security, governance, cost management and decision-making.

For many organisations, however, that leads to the next question:

How do you actually discover AI across an organisation and build an inventory of your AI estate?

In our next article, What Is AI Discovery? How to Build an Inventory of Your Enterprise AI Estate, we will explore the different sources organisations can use to identify AI, the limitations of each discovery method, and how these signals can be brought together to create a practical AI inventory.

CIQ® Cloud is developing this approach through AI Discovery and AI Estate visibility, alongside operational monitoring capabilities for platforms such as OpenAI. The objective is to help IT teams move from simply knowing that AI is being used to understanding what AI exists, how it is being used and where attention may be required.