Shadow AI programmes usually sit at level zero and describe themselves as level three. Shadow AI programmes are graded here by one test: what question can you answer today, with evidence, without asking anyone to self-report.
Each level below carries the question it answers, the work it takes, and the published figures on what staying beneath it costs. The earlier version of this page, at shadow AI governance: finding unapproved AI use, made the policy case; this rewrite grades the programme.
Level zero: the incident tells you, and the 2026 figures price that
Shadow AI runs unmeasured at level zero, and blindness has a price. In the IBM and Ponemon 2026 Cost of a Data Breach study, shadow AI incidents rose from 20% to 43% of breached organisations year on year, and those incidents carried an average cost of $5.39 million against $4.63 million for breaches without them.
Consequences follow shadow AI data out of the door. Shadow AI incidents produced data loss or compromise in 49% of cases and a regulatory fine in 21%, against a global average breach cost of $4.99 million, itself up 12% and a record.
Policy coverage moved backwards while shadow AI exposure rose. Only 32% of breached organisations had AI policies in place, down from 37% the year before, and just 19% reported that their AI governance and security teams coordinate. A memo, in other words, is what level zero already tried.
Level one: count the tools, and accept what counting cannot see
Counted means naming the shadow AI services in use without asking staff. Four telemetry sources get you there, and each one has a gap the others cover.
| Source | What it counts | What it cannot see |
| Network and proxy logs | Consumer assistants by domain, with user counts | Assistants embedded in approved software, unmanaged devices, plain API traffic |
| Identity and single sign-on | Corporate accounts, OAuth grants, scopes, approvers | Personal accounts, which carry a large share of workplace use |
| Endpoint and managed browser | Which application received a paste or an upload | Personal phones, screenshots, anything off managed devices |
| Expense and procurement | Paid subscriptions and seat counts, twelve months back | The entire free tier, where most exposure sits |
Account ownership is why counting shadow AI stalls. Netskope’s 2026 Cloud and Threat Report found 47% of workplace generative AI users working through personal, unmanaged accounts, either exclusively or alongside approved tools, so half the population leaves no enterprise record to count.
Blocking is the reflex at this level, and the shadow AI data shows how widely it is used: 90% of organisations now block at least one generative AI application, up from 80%, with the average organisation blocking ten. Blocking without a named alternative moves the same work to a phone, which is why level one is a waypoint rather than a destination.
Level two: classify what left, because destination is not exposure
Classified means saying what data went where, rather than which site someone visited. Volume makes that necessary: prompts sent to software-as-a-service generative AI applications rose from 3,000 to 18,000 per organisation per month, a fivefold increase, in the same Netskope data.
Shadow AI violations are concentrated and specific. The average organisation records 223 incidents a month of users sending sensitive data to AI applications, the top quartile around 2,100, and uploads of regulated data, meaning personal, financial or healthcare information, are the largest category at 54%, with intellectual property, source code and credentials behind it.
Shadow AI classification is ordinary language work done carefully. Named entity recognition finds people, account numbers and client names; entropy and pattern checks find keys and credentials; code detection finds source fragments. Each needs thresholds tuned on a labelled sample of your own traffic rather than a vendor default, and each alert needs the matched span stored beside it so a reviewer can confirm the call without guessing.
Paraphrase is the failure mode that separates real classification from keyword blocking. A user who rewrites a confidential paragraph before pasting it defeats exact matching, while embedding similarity against a corpus of sensitive documents still catches it, which is why semantic matching belongs in the design rather than in a later phase.
Output detection is the one claim to refuse. Detectors that guess whether text was AI-generated carry high false positive rates, and published research in Patterns in 2023 by Weixin Liang and colleagues at Stanford found such detectors systematically misclassifying writing by non-native English speakers, so no disciplinary process should rest on one.
Agents and service accounts are the shadow AI nobody counts
Human use is the easy half. A team that wires a model API into a pipeline creates traffic that looks like any other outbound call, authenticated by a key in a secrets store rather than by a person in the identity provider, and no proxy report will name it.
Three signals find that population. Spend on model API keys appears in cloud billing rather than in expense claims; secrets scanners find provider keys committed to repositories; and outbound connections from build and production networks to model endpoints show up in flow logs if anyone looks.
Scope is what makes agentic use different from a chat window. An assistant that reads a mailbox, writes to a ticketing system and calls a payment API holds standing permissions, so the governance question moves from what data was pasted to what the agent is allowed to do when nobody is watching. Record the tool, its credentials, the systems it can reach and the human who owns its actions, or the inventory describes half the estate.
Level three: decide, and leave a record that survives the decision
Governed means every discovered shadow AI tool has an owner, a status and a date. Three outcomes close a finding: sanction, substitute or stop.
Sanctioned tools enter the AI system inventory with purpose, owner, risk classification and review date, and with the vendor’s training and retention terms attached to the entry rather than remembered in a thread. Substitution is the outcome that reduces shadow AI rather than relocating it, and it works when the block page names the approved equivalent. Stopping requires the OAuth grant revoked, the workspace deleted, the vendor’s deletion terms confirmed and the date recorded.
Contract terms belong in the record at the moment of sanctioning, because they are the part people forget and the part a regulator asks about. Three clauses decide the risk: whether prompts and uploads train the vendor’s models, how long content is retained after deletion, and which sub-processors receive it. A tool that trains on inputs by default and offers an enterprise tier that does not is a procurement task rather than a ban.
Shadow AI scoring decides which outcome applies, and five attributes carry it: data sensitivity, decision influence, population exposed, vendor terms on training and retention, and whether an approved alternative already exists. Decision influence is the attribute that changes the legal position, because a tool whose output shapes hiring, credit, pricing or discipline can put the organisation into deployer duties, and Article 26(1) of the EU AI Act requires deployers of high-risk systems to use them according to the instructions for use.
Two duties apply before any of that scoring is done. Article 4 has required providers and deployers to take measures supporting AI literacy among staff since 2 February 2025. Article 50 transparency rules became applicable on 2 August 2026, with the marking duty for generative output moved to 2 December 2026 by the Digital Omnibus on AI. An unapproved population is therefore a compliance gap on the day it is discovered, not only a security one.
Level four: measure the programme, or watch it decay
Measured means the shadow AI numbers that matter sit on a dashboard with owners. Four indicators do the work: share of AI use running through enterprise accounts, classified events per thousand prompts, median days from discovery to decision, and the count of sanctioned tools past their review date.
Shadow AI discovery lag is the honest headline metric. Mean time to identify and contain a breach reached 247 days in the 2026 study, reversing five straight years of decline, and organisations that found breaches internally did so in 209 days, about 15% faster than the global average. A programme that cannot state its own discovery lag is reporting on hope.
Coordination is the cheapest fix in the dataset. With only 19% of breached organisations reporting that AI governance and security teams work together, a standing monthly review that puts both in the same room with the same list changes the response time before any tool is purchased.
Reporting cadence decides whether the dashboard changes anything. A monthly pack with four numbers, a quarterly review of sanctioned tools against their review dates, and a named owner for each overdue entry turn measurement into decisions, while an annual slide turns it into decoration.
One caution belongs beside every metric on that pack. The published figures quoted throughout this page describe breached organisations and monitored enterprise traffic, not a random sample of all companies, so they set direction rather than a benchmark your board should be measured against. Your own discovery lag, violation rate and enterprise-account share are the numbers that matter, and only the first month of collection tells you where you actually sit.
What the levels cost, and what each one buys
| Level | Question it answers | Typical effort | Evidence for moving up |
| Zero, blind | None until an incident | None | Shadow AI incidents averaged $5.39m against $4.63m without |
| One, counted | Which AI services are in use | Days, using logs you already hold | 43% of breached organisations reported shadow AI incidents |
| Two, classified | What data left, and in what volume | Weeks, with tuning on your own traffic | 223 sensitive-data incidents a month at the average organisation |
| Three, governed | What was decided, by whom, and when | Weeks, plus standing review capacity | Only 32% of breached organisations had AI policies at all |
| Four, measured | Whether the programme is improving | Ongoing, one dashboard and an owner | Discovery and containment now runs to 247 days |
Govern365.ai is built for the jump from level two to level four, which is where most programmes stall. Findings from whichever surfaces you run arrive as records with a status, an owner and a date: sanctioned with an inventory entry, substituted with the named alternative, or stopped with revocation and deletion evidence attached.
Obligations travel with each record. An entry maps to the duties it triggers under the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework, so a tool that began as a proxy hit ends as a classified system with a literacy record, a human oversight note and a review date. The policy layer above this process sits in our AI acceptable use policy guide.
Frequently Asked Questions
What is shadow AI?
Shadow AI means the use of AI tools inside an organisation without approval, procurement or governance, covering consumer assistants on personal accounts, AI features embedded in approved software, and API integrations built by teams.
How common are shadow AI incidents?
The IBM and Ponemon 2026 study reports shadow AI incidents at 43% of breached organisations, up from 20% the year before.
What do shadow AI incidents cost?
An average of $5.39 million against $4.63 million for breaches without a shadow AI element, with data loss or compromise in 49% of cases and a regulatory fine in 21%.
How do you detect shadow AI?
Shadow AI detection combines network and proxy logs, identity and single sign-on records, endpoint or managed browser telemetry, and expense data. Each source misses something another one catches.
Why are personal accounts the hard part?
Personal accounts leave no enterprise trail. Netskope’s 2026 report found 47% of workplace generative AI users working through personal, unmanaged accounts.
How much sensitive data is actually moving?
Prompt volume rose from 3,000 to 18,000 per organisation per month, with 223 sensitive-data incidents a month at the average organisation and around 2,100 in the top quartile.
What kind of data leaks most often?
Uploads of regulated data, meaning personal, financial or healthcare information, at 54% of violations, followed by intellectual property, source code and credentials.
Does blocking AI tools work?
Partly. 90% of organisations now block at least one generative AI application, but a block without a named approved alternative moves the same work to an unmanaged device.
What does the EU AI Act require about unapproved AI?
AI literacy measures under Article 4 have applied since 2 February 2025. Transparency duties under Article 50 became applicable on 2 August 2026, with generative marking deferred to December 2026. Deployer obligations under Article 26 apply to high-risk use however the tool was acquired.
How should discovered tools be scored?
On data sensitivity, decision influence, population exposed, vendor training and retention terms, and whether an approved alternative exists.
Are AI text detectors reliable enough for enforcement?
No. False positive rates are high, and research published in Patterns in 2023 found detectors biased against non-native English writers.
What metrics show a shadow AI programme is working?
Share of AI use on enterprise accounts, classified events per thousand prompts, median days from discovery to decision, and sanctioned tools past their review date.
