How unapproved AI use actually gets discovered

Shadow AI is use nobody recorded. It is not usually defiance. It is a person with work to do, a tool that helps, and either no policy to consult or an approval route that costs more than the task is worth.

The governance question is not how to forbid it, which has been tried and moves use out of sight. It is how it comes to light, and what you do on the day it does.

The five ways it surfaces

Expenses. A subscription on a corporate card, or several of the same one across departments, is the single most reliable signal in most organisations. It is also the one nobody looks at, because finance is not looking for AI tools and governance is not looking at expense lines.

Network and identity logs. Traffic to AI service domains, or single sign-on grants to third-party applications. This is the closest thing to genuine discovery, and it is a security function capability rather than a governance platform one. Note its limits: it sees the connection, not what was sent.

The output itself. Someone notices that a document reads differently, that a policy has been misstated in a fluent paragraph, or that three colleagues produced suspiciously similar analyses. This surfaces the highest-risk uses, and it surfaces them late.

Someone asking a question. A colleague asks whether they may paste customer data into a tool. That question is a disclosure, and how it is received determines whether anyone asks the next one. Treating it as an admission is the most expensive reaction available.

An incident. The worst route: a customer receives something wrong, a decision cannot be explained, a regulator asks. The use is discovered and the harm has already happened.

Ranked by cost, the order is expenses, logs, question, output, incident. Most organisations invest in none of the first three and are discovered by the last two.

Why the vendor-update route is worse than the personal-subscription route

Unapproved personal use is at least a choice a person made and can be asked about. A summarisation feature switched on by a vendor for all tenants involved no decision by anyone in your organisation, so there is no one to ask and nothing to find in expenses. It does not appear in network logs as a new destination, because the traffic goes to a supplier you already use. Meanwhile the deployer duties in Article 26 attach on use, and Article 26(7) requires that workers and their representatives be informed before a high-risk AI system is used in the workplace, which is an ordering a silent Tuesday rollout has already failed.

The only defence is a habit rather than a control: people reporting features they notice. That habit depends on it being free to report and on nothing bad happening to those who do.

What to do on the day

The instinct on discovering unapproved use is to stop it. Sometimes that is right, and it is rarely the first move.

• Establish what went in. Personal data, customer data, health data, confidential commercial information. This determines whether there is a data protection question that is more urgent than the AI question.
• Establish what the output did. Informed a person's own thinking, or reached a customer, or fed a decision about someone. The third case is the one that may engage incident reporting, and the Article 73 clock runs from awareness, which is now.
• Record it. An unapproved system that is now known and recorded is in a materially better position than one that is known and still absent from the register.
• Decide about the future, not the past. Approve it, replace it or stop it. Punishing the past guarantees the next instance is not reported, and the next instance may be the one that matters.

The measure that tells you how you are doing

Count how many register entries originated from someone volunteering them, rather than from an audit or an incident. A rising number means the route is cheap and safe to use. A number near zero does not mean there is no shadow AI. It means you are relying on the two most expensive discovery routes.

As of 24 September 2026.