Guides · ← All guides
Shadow AI: The Free Tools Your Team Uses That Legal Never Reviewed
Last updated: October 13, 2026 · 9 min read
This guide is informational, not legal advice.
Here's a scenario we've seen play out in companies of every size (hypothetical, but assembled from real patterns): the security team completes a careful review of the company's approved AI vendor. Training-data opt-out: on. DPA: signed. Retention: 30 days. Everything checks out. Meanwhile, in marketing, someone has been pasting draft press releases into a free AI writing tool for four months. In sales, a rep uploads call recordings to a free transcription service. In engineering, a contractor debugs with a free code assistant that nobody provisioned. None of these tools went through review. None of them are on the approved list. All of them have terms of service that someone — an employee acting in good faith, trying to work faster — accepted on the company's behalf with one click.
That's shadow AI: AI tools adopted bottom-up, on consumer terms, outside any procurement or legal process. And it's the biggest blind spot in AI vendor risk right now, because every control you've built assumes you know which vendors you have.
Why shadow AI is worse than shadow IT
Shadow IT is old news — the unapproved SaaS app expensed on a personal card. Shadow AI is sharper for three reasons.
First, the data flowing into these tools is different. An unapproved project-management app holds task lists. An unapproved AI writing tool holds whatever the employee pasted into it: customer names, financial figures, unreleased product details, internal strategy. The prompt box is a universal intake valve for sensitive data, and it has no field validation.
Second, the terms are worse. Enterprise AI contracts get negotiated: DPAs, training exclusions, retention limits. Consumer free tiers get none of that. The clickwrap terms on a free AI tool are the vendor's standard consumer deal — which, across the industry, is the tier most likely to reserve training rights on inputs. Your employee didn't just skip procurement. They accepted the weakest data terms the vendor offers.
Third, it's invisible to the usual controls. Procurement sees invoices; free tools have none. IT sees SSO logins; consumer signups use personal Google accounts. Legal sees vendor questionnaires; nobody sent one. The entire governance apparatus is built around the assumption that adoption leaves a paper trail. Free AI tools don't.
How to find your shadow AI (a practical sweep)
You can't govern what you can't see. Run this sweep quarterly — it takes an afternoon, and the first run is always the most alarming:
1. Survey the team — anonymously. Send a short, blame-free survey: "Which AI tools do you use for work, including free ones and personal accounts?" Anonymity matters. People won't confess to policy violations on a named form; they will on an anonymous one. Promise no punishment for past use — you're mapping, not prosecuting. In our experience, the survey alone surfaces 60–70% of shadow tools.
2. Check expense reports and card statements. Look for small recurring charges from AI companies — the $20/month subscriptions people expense without a procurement ticket. Each one is a tool someone adopted individually.
3. Ask IT for DNS and network logs. Which AI domains get traffic from company devices? You're looking for the long tail: domains nobody recognizes, alongside the approved tools. This catches the tools people forgot to mention in the survey.
4. Check browser extension inventories. AI browser extensions — summarizers, writing assistants, meeting notetakers — are a major shadow-AI vector. They often request broad permissions ("read and change data on all websites") and exfiltrate page content to the vendor. If your device management can list installed extensions, review it.
5. Review OAuth grants. "Sign in with Google" grants to AI apps show up in the workspace admin console. A quarterly review of third-party app access turns up tools that never appeared anywhere else.
Consolidate everything into one list: tool name, who uses it, what data goes into it, which tier. That list is your actual AI vendor footprint — and for most companies, it's two to three times the approved list.
Triaging what you find
Not every shadow tool is an emergency. Triage the list into three buckets:
Approve and provision. Tools the team genuinely needs, from vendors with acceptable terms. Move these onto company accounts, paid tiers with better data terms, SSO, and the approved list. This is the happy path — the employee found something useful, and you just formalized it.
Replace. Tools doing a job your approved stack already covers. The usual story: someone didn't know the approved tool existed, or found it slower. Migrate them and close the account.
Ban and remediate. Tools with unacceptable terms handling sensitive data — training on inputs with no opt-out, no deletion mechanism, data shared broadly. For these, the response has three parts: stop the usage, delete the data (submit deletion requests to the vendor — most consumer tools have them, buried in settings), and document what data was exposed so you can assess whether customer or employee notification is needed.
Work the ban bucket first. It's the smallest and the most urgent.
The policy that actually works
Most AI acceptable-use policies fail the same way: they say "don't use unapproved AI tools" and provide no fast path to approval. Employees route around the policy because the policy routes around their deadlines. A policy people bypass is decoration.
What works is approval-lite: a request form with five fields (tool name, URL, what data you'll put in it, who's the vendor, free or paid), a 48-hour SLA on review, and a default-allow posture for low-risk uses. The review itself is the 20-minute training-policy check from our companion guide — run it once per tool, record the answer, and most tools get approved with conditions (paid tier only, no customer data, opt-out enabled).
Publish the approved list where people actually look — not a PDF in a shared drive, but a pinned message, a wiki page, a Slack channel. And include the verdicts, not just the names: "Approved for internal drafts, not customer data" is actionable; a bare tool name isn't.
One more element that matters: a clear statement that personal-account usage for work data is out. The "I'll just use my personal ChatGPT account" workaround defeats every control — no SSO, no admin visibility, no company DPA, no offboarding wipe when the employee leaves. If work data goes into an AI tool, it goes through a company-provisioned account. Full stop.
Why this is a terms problem, not just a security problem
Security teams tend to frame shadow AI as a data-loss problem: sensitive data leaving the building. That's true, but incomplete. The deeper issue is contractual. Every shadow signup is an employee accepting terms on the company's behalf — granting the vendor a license to company data, agreeing to arbitration, accepting the vendor's liability cap — without authority and without review.
That's why the fix isn't just blocking domains (though DNS filtering for the worst offenders is reasonable). The fix is bringing the shadow tools into the same terms-review discipline as the approved ones: baseline the terms, check the training clause, track changes. A shadow tool you know about, on reviewed terms, with the opt-out enabled, is just a tool. The danger was never the AI. It was the not knowing.
FAQ
Is shadow AI really that common?
In our observation, yes — and it correlates with company AI enthusiasm, not company size. The more a leadership team talks about AI adoption, the more employees experiment on their own. Top-down AI mandates without bottom-up tooling produce shadow AI almost by design.
Should we just block all unapproved AI domains?
Blocking is a backstop, not a strategy. Determined employees use personal devices and hotspots; blocking without an approval path just moves the usage somewhere you can't see it. Pair technical controls with a fast approval process.
What about AI features inside approved tools?
The gray zone. Your approved CRM ships a new AI feature trained on your data — is that shadow AI? Not exactly, but it deserves the same review: check the feature's data terms, find the opt-out, track the change. Vendor feature launches are one of the most common sources of surprise training-policy changes.
Who owns this problem — security, legal, or IT?
All three, which is why it usually belongs to no one. Our recommendation: give it a named owner with a quarterly cadence. The sweep described above is a half-day exercise; the cost of not running it is discovering your exposure during a customer audit.
Related: how to check any vendor's training policy in 20 minutes →