The term is modeled on 'shadow IT' — the long-standing phenomenon of employees using unsanctioned software. Shadow AI has emerged as AI coding assistants, chatbots, and autonomous agents became accessible without any procurement process. An engineer might pipe proprietary code into an external AI API, a team might deploy an AI agent with no security review, or a department might use a consumer AI tool that retains training data.
The risks are concrete: proprietary source code sent to external models may be retained and used for training, violating IP agreements; agents acting without oversight may introduce vulnerabilities; and costs incurred outside approved channels may be invisible until a large bill arrives. Shadow AI also produces inconsistent results because different team members use different tools with different quality.
Addressing shadow AI requires making the sanctioned alternative more convenient than the unsanctioned one. Heavy-handed bans typically drive usage underground rather than eliminating it. Organizations that publish clear AI tool policies, provide approved tools with adequate capability, and create lightweight escalation paths for new tool requests tend to see better compliance.