Skip to main content
Simkins & Elgazar
Contact us

How to Find and Control Shadow AI in Your Company

Ask your team, then check app consents, browser extensions and network logs. Control shadow AI with an approved list and an easy way to request tools.

By Maximilian Simkins. Published . 9 min read.

Topics: shadow AI, AI inventory, AI governance, NIST AI RMF, small business

To find shadow AI in your company, ask your team which AI tools they use for work, then check where those tools leave a trace: apps connected to work accounts, browser extensions and, if you have a tool that logs it, web traffic. To control it, publish a short approved list, stop new apps from connecting to company data without a check, and give people a quick way to ask for a tool.

Most of the work is the first sweep. After that it is a short check on a schedule.

What counts as shadow AI?

Shadow AI is any AI tool used for work that whoever runs your IT doesn't know about. The UK's National Cyber Security Centre (NCSC) files it under shadow IT: "Shadow IT can also include AI technologies used without permission, often referred to as shadow AI." One of its examples is "unmanaged AI services, such as chatbots, being used with corporate data."

In a small company that can mean a free personal chatbot account, an AI browser extension, or an app someone connected with their work Google or Microsoft sign-in. It also covers AI features switched on inside software you already pay for. NIST's Generative AI Profile (NIST AI 600-1) suggests deciding up front how to treat those: "Define any inventory exemptions in organizational policies for GAI systems embedded into application software" (GV-1.6-002).

Why do people use AI tools nobody approved?

Usually because the approved route is slow, unclear or missing. The NCSC says "shadow IT is rarely the result of malicious intent" and "It's normally due to employees struggling to use sanctioned tools or processes to complete a specific task."

That should shape how you go looking. If admitting to a tool gets someone in trouble, the next person keeps quiet. The NCSC's advice is to "take a positive and no-blame approach to people who have been forced into adopting shadow IT."

Where do you look first?

Start with people, then check the admin consoles you already have. Asking turns up the free accounts and copy-paste habits that no log will show. The consoles catch the apps and extensions people forgot to mention.

Where to lookWhat it can show youWhat it misses
Ask the team (a short survey, or ten minutes in a team meeting)Tools, free accounts, and what kind of data goes inAnything people forget or would rather not say
Microsoft Entra admin center, Enterprise appsApps people have consented to, and what each can accessAI used in a browser tab without a work sign-in
Google Admin console: Security > Access and data control > API controls > Accessed appsThird-party apps that have accessed Google Workspace dataSame as above, and new apps for their first 24 to 48 hours
Google Admin console: Devices > Chrome > Reports > Apps & extensions usageExtensions installed on managed Chrome browsers, with install counts and permissionsBrowsers you don't manage, and personal devices
Microsoft Defender for Cloud Apps, if you have it: Cloud apps > Cloud discovery > Discovered apps, filtered to Generative AIAI apps seen in the traffic it receivesTraffic it doesn't receive
Card statements and expense claimsPaid AI subscriptionsFree tiers

Write what you find in one place. The NIST AI RMF makes this its own outcome (GOVERN 1.6: "Mechanisms are in place to inventory AI systems"), and NIST AI 600-1 suggests listing generative AI systems in that inventory (GV-1.6-001). For a small team, five columns do the job: the tool, who uses it, what for, what data goes in, and your decision (approve, approve with limits, replace, or block).

That inventory is also the first step of an AI acceptable use policy. If you haven't written one yet, our post on how to write an AI acceptable use policy for a small team picks up from here.

What does shadow AI look like when it goes wrong?

This is a public case, not one of our engagements. In December 2023, the Victorian Department of Families, Fairness and Housing (DFFH) in Australia told the state's privacy regulator, the Office of the Victorian Information Commissioner (OVIC), that a Child Protection worker had used ChatGPT while drafting a report for the Children's Court. OVIC's investigation report, published in September 2024, found that the worker "entered a significant amount of personal and delicate information into ChatGPT, including names and information about risk assessments relating to the child."

The output was wrong in a way that mattered. OVIC found the report "included personal information that was not accurate" and that the use of ChatGPT "had the effect of downplaying the severity of the actual or potential harm to the child." Fortunately, the deficiencies "did not ultimately change the decision making of either Child Protection or the Court." Entering the information also "disclosed this information to OpenAI," which released it "from the control of DFFH."

The department did have an acceptable use policy and training modules. What it lacked was anything aimed at this tool: "there were no departmental rules in place about when and how these tools should or should not be used. Nor were there any technical controls to restrict access to tools like ChatGPT." OVIC found the department had contravened two Information Privacy Principles and called the contraventions "serious."

The scale is the part that applies to a small company. DFFH's audit logs showed only who visited the site, not what they typed. They showed "nearly 900 employees" had accessed ChatGPT between July and December 2023, "almost 13 per cent" of a workforce of around 7,000. A review of the worker's unit found 100 cases "with indicators that ChatGPT may have been used." In April 2024 the department emailed the nearly 900 employees asking for examples of safe use, and "only ten employees responded."

OVIC issued a compliance notice with six required actions. They included a direction to Child Protection staff, due by 24 September 2024, not to use web-based GenAI text tools in their official duties, and IP or DNS blocking of a named list of tools. OVIC's reasoning on a policy-only approach: DFFH had "almost no visibility on how GenAI tools are being used by staff," and in child protection the risks "are too great to be managed by policy and guidance alone."

Three things carry over. A written policy without a way to see use is not control. Logs show who visited a site, so you still have to ask people what they put into it. And the answer to high-risk data can be a block, which is why the next section is selective, not blanket.

How do you stop new tools from connecting to company data?

Change the default that lets anyone connect any app. In Microsoft 365, "By default, all users are allowed to consent to applications for permissions that don't require administrator consent." Microsoft recommends allowing user consent "only for applications that have been published by a verified publisher." The setting is under Identity > Applications > Enterprise apps > Consent and permissions > User consent settings.

Microsoft's page has two catches. The change only applies to future consents ("Existing consent grants remain unchanged"), so you still need to review the apps already connected. And it suggests turning on the admin consent workflow, so a person who hits the block can ask for a review instead of giving up or finding another way.

Google Workspace works the same way. For third-party apps you haven't configured, the default is "Allow users to access any third-party apps." You can limit that to apps that only request basic sign-in info, or to "Don't allow users to access any third-party apps," and set individual apps to Trusted, Limited or Blocked. A blocked app "Can't access any Google service."

For browser extensions on managed Chrome, the setting "Block all apps, admin manages allowlist, users may request extensions" lets people install only the extensions you allow, and request others.

If you have Defender for Cloud Apps, you can mark an AI app Unsanctioned. Microsoft's documentation says "When an app is marked as unsanctioned, it's automatically blocked across devices that are onboarded to Defender for Endpoint," and you can choose to warn users instead of blocking. The same guide sets up a policy to "Generate an alert when a new Generative AI app is used," which covers the next tool someone tries.

Should you block every AI tool you didn't approve?

No. Block where the data risk is real and give people a decent approved option for the rest. The NCSC says to "Avoid unnecessary lockdowns of enterprise IT" and to "Implement an effective and simple process for addressing users' requests, which should be put in place as quickly as possible."

Look at the table again: every check in it misses personal devices and unmanaged browsers. If the only answer is a ban, the work moves to places you can't see. The Entra and Chrome settings above both come with a request path built in. Turn it on, and answer requests within days.

How do you keep it under control after the first sweep?

Repeat the check on a set date, and again when a vendor switches on a new AI feature in software you use. The AI RMF asks for "Ongoing monitoring and periodic review" with roles defined, "including determining the frequency of periodic review" (GOVERN 1.5). For a small team, one named owner and a quarterly reminder is a reasonable start.

Keep each dated inventory and the console exports next to it. When a client or auditor asks how your team uses AI, that folder is the answer.

If you'd rather not run the first sweep alone, our AI solutions page covers the AI governance, policy and documentation work we do.

Sources

Talk to a principal.

Small, direct and responsive. Both principals do the work on every project; no layered overhead.

Send a messageDownload the capabilities statement