DEFINITION
Shadow AI
Employees using AI tools at work without organisational sanction — the AI-era version of shadow IT.
In depth
Shadow AI is unsanctioned AI use inside an organisation: a paralegal pasting a contract into ChatGPT, an engineer routing customer data through a personal Claude account, a marketer summarising a confidential roadmap with a free Gemini tab. Shadow AI is widespread because the tools are free, fast, and a single browser tab away. Surveys consistently find that 50–80% of professionals use AI at work even when their employer has not approved it. The risk is not the tool itself; it is the absence of any control point between the employee and the model.
Examples
- An associate pasting deposition excerpts into a personal ChatGPT account to draft questions.
- A finance analyst using Gemini to summarise customer churn data outside the firm's approved BI stack.
- An engineer routing production logs through Claude to debug a flaky test, including PII in error messages.
How Locke handles shadow ai
Locke covers shadow-AI scenarios by default: it works on every AI tool, sanctioned or not, without depending on a corporate proxy or admin console. Detection runs locally, so privacy is preserved even when the AI itself isn't approved.
See the productRelated terms
- Prompt Leakage
The unintended disclosure of sensitive information through the content of a prompt sent to an AI model.
- Privacy Layer for AI
A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.
- Data Loss Prevention (DLP)
A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.
