---
title: "Shadow AI"
description: "Shadow AI is unsanctioned AI use inside organisations — the AI-era version of shadow IT. Why it's everywhere, what makes it risky, and what controls actually fit."
url: "https://sonomos.ai/glossary/shadow-ai/"
source: "https://sonomos.ai/glossary/shadow-ai/"
---

# Shadow AI

Employees using AI tools at work without organisational sanction — the AI-era version of shadow IT.

## In depth

Shadow AI is unsanctioned AI use inside an organisation: a paralegal pasting a contract into ChatGPT, an engineer routing customer data through a personal Claude account, a marketer summarising a confidential roadmap with a free Gemini tab. Shadow AI is widespread because the tools are free, fast, and a single browser tab away. In UpGuard's 2025 State of Shadow AI survey of about 1,000 US and UK employees, 81% said they use AI tools their employer has not approved. The risk is not the tool itself; it is the absence of any control point between the employee and the model.

## Examples

- An associate pasting deposition excerpts into a personal ChatGPT account to draft questions.
- A finance analyst using Gemini to summarise customer churn data outside the firm's approved BI stack.
- An engineer routing production logs through Claude to debug a flaky test, including PII in error messages.

## How Locke handles shadow ai

Locke covers shadow AI on the surfaces it screens — the AI websites in its catalog, and the command-line and API traffic its local proxy sees — sanctioned or not, without depending on a corporate proxy or admin console. Detection runs locally, so privacy is preserved even when the AI itself isn't approved.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Prompt Leakage

  The unintended disclosure of sensitive information through the content of a prompt sent to an AI model.
- Privacy Layer for AI

  A control point between a user and an AI service that detects, transforms, or blocks sensitive data before it reaches the model.
- Data Loss Prevention (DLP)

  A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.

## Reading on this topic

- [Can My Employer See My ChatGPT Prompts? A 2026 Guide](https://sonomos.ai/blog/can-my-employer-see-my-chatgpt-prompts-2026/)