Shadow AI: How to Find, Govern, and Fund the AI Tools Your Employees Expense

Shadow AI is the use of AI tools, models, or AI features at work without the approval or oversight of IT and security. Most of it doesn’t arrive through a hacked network or a rogue developer. It arrives on a corporate card or an expense report, one $20 subscription at a time, bought by people who are trying to get their work done faster.

That makes shadow AI a joint problem for IT, security, and finance. This guide covers how it differs from shadow IT, the six places it hides, how to find it, how to write a policy people will follow, how to approve tools quickly, and how to control the spend. It ends with a 90-day rollout plan and the metrics worth tracking.

TL;DR

Shadow AI is mostly a purchasing problem. Zylo’s 2026 data shows expense-based SaaS spend up 267% year over year, with ChatGPT now the most expensed app.
Blanket bans tend to push use out of sight. A fast approval path plus a sanctioned alternative works better.
Use six detection channels together. Expense and card data, SSO and OAuth logs, endpoint and browser signals, network logs, SaaS discovery, and employee surveys each catch what the others miss.
Tier tools by the data they touch. A three-tier model (approved, conditional, prohibited) is easier to enforce than a long list of rules.
Fix the expense policy, not just the AI policy. Finance sees every charge first, so recurring AI charges should trigger a review.
Control spend as well as risk. Duplicate seats, unused licenses, and usage-based API bills are a real cost leak.
Pair governance with lifecycle management. Inventory, approvals, access reviews, and offboarding are what keep the rules true after the first audit.

What Is Shadow AI?

Shadow AI is the use of AI tools, AI agents, or AI features inside an organization without the approval, monitoring, or involvement of IT and security teams (IBM, 2026). The classic example is an employee pasting customer data into a free chatbot from a personal account. The broader example is an approved SaaS app that quietly switches on a new AI feature after an update.

Shadow AI vs. Shadow IT

Shadow AI is a subset of shadow IT with a different risk profile. Shadow IT covers any unapproved hardware, software, or cloud service. Shadow AI adds a question that older shadow IT didn’t raise: what happens to the data that goes into the prompt?

	Shadow IT	Shadow AI
What it is	Any unapproved app, device, or service	Unapproved AI tools, models, agents, or AI features
Typical entry point	Team signs up for a file-sharing or project tool	Employee buys a chatbot, coding assistant, or image tool on a card
Main risk	Unmanaged data storage and access	Sensitive data entered in prompts, possible retention or training use
Behavior	Mostly passive storage and workflow	Can write code, summarize files, and act through connectors
Detection difficulty	Moderate	Higher, because AI features hide inside approved apps
Cost pattern	Per-seat subscriptions	Per-seat plus usage-based tokens and API charges

If you want the general version of this problem first, our guide to shadow IT and why employees bypass IT covers the fundamentals. This article assumes you’re already convinced and want to deal with the AI-specific parts.

Shadow AI Examples

These are the patterns we see most often in mid-sized companies:

Personal chatbot accounts: A marketer drafts campaign copy in a free ChatGPT, Claude, or Gemini account, with customer names included.
Expensed individual subscriptions: A developer buys a $20 coding assistant and submits it as a software expense.
Departmental purchases: A sales team buys an AI note-taker for call recordings without a data review.
Embedded AI features: A project tool turns on an AI summarizer that reads every task and comment.
Browser extensions: An AI writing plugin reads everything typed into web forms, including internal systems.
API keys and automation: An analyst connects a personal API key to a script that sends spreadsheet data to a model provider.
Meeting bots: A free AI notetaker joins customer calls through a calendar invite.

Why Shadow AI Shows Up on Expense Reports

AI tools sell themselves to individuals. Sign-up takes a minute, pricing starts low, and the benefit is visible on the first day. A card or an expense claim is the lowest-friction way to pay, and that means finance systems see the evidence before IT does.

The numbers support this. Zylo’s 2026 SaaS Management Index, based on more than 40 million licenses and $75 billion in spend under management, found that expense-based SaaS spend increased 267% year over year and that ChatGPT is now the most expensed application (Zylo, 2026). The same report found AI-native application spend up 108% overall and 393% in organizations with more than 10,000 employees, and that business units control 81% of SaaS spend while IT directly manages 15%.

MIT’s Project NANDA reached a similar conclusion from the employee side. Its 2025 report, as covered by Fortune, found workers at more than 90% of companies using personal chatbot accounts for daily tasks, while only 40% of companies had official LLM subscriptions (Fortune, 2025). The report was described as preliminary, so treat the exact percentages as directional.

Usage is also moving in a more governed direction at some companies. Netskope’s 2026 Cloud and Threat Report found personal-account use of generative AI fell from 78% to 47% in a year, while company-managed account use rose from 25% to 62% (Netskope, 2026). That shift shows what works: when a managed option exists, many people use it.

The Six Ways Shadow AI Gets In

Knowing the entry points tells you where to look and which control fits each one.

Expensed or card-paid subscriptions. The charge appears in finance data under a vendor name, often with a personal email on the receipt.
Free-tier personal accounts. No charge, no corporate record, and the most common source of data leakage.
AI features inside approved SaaS. The vendor is approved, but the new AI capability never went through review.
OAuth connections and integrations. An employee grants an AI app access to email, calendar, or drive through “Sign in with Google.”
Browser extensions and desktop apps. Installed on a device, invisible to finance, and often invisible to the SaaS inventory.
API keys and agents. Scripts, automations, and coding agents that call models directly and bill by usage.

The Risks of Shadow AI

The risks fall into four groups. Data and compliance usually get the attention, and cost and identity are often the ones that surprise teams later.

Data Leakage

Prompts often contain the most sensitive thing an employee is working on. Samsung is the best-known example: engineers pasted internal source code into ChatGPT in 2023, which led the company to restrict generative AI tools on its networks and devices (TechRadar, 2023).

IBM’s 2025 Cost of a Data Breach Report puts numbers on the broader pattern. One in five organizations reported a breach linked to shadow AI, and organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs. Only 37% had policies to manage AI or detect shadow AI (IBM, 2025). The research covered 600 organizations that experienced breaches between March 2024 and February 2025, so it describes breached companies and not all companies.

Compliance and Legal Exposure

Several rules apply even when nobody in IT knew the tool existed:

GDPR and similar privacy laws: Sending personal data to a provider without a data processing agreement or a lawful basis is a compliance problem regardless of intent.
Sector rules: Health, finance, and public-sector data carry their own restrictions on where data can go.
EU AI Act: Article 4 requires providers and deployers to take measures to support AI literacy among staff and others using AI systems on their behalf. A 2026 amendment changed the wording, and the current text says the obligation doesn’t require guaranteeing a specific literacy level for any individual (European Commission AI Act Service Desk, 2026). You can’t build a literacy program around tools you don’t know about.
Customer contracts: Many enterprise contracts restrict sharing customer data with third-party processors, and a chatbot is a third-party processor.

Our overview of IT compliance standards covers the frameworks that auditors will map shadow AI to.

Cost Leakage

Shadow AI wastes money in four ways. The same function gets bought by five people on five cards. Annual plans auto-renew for people who stopped using the tool. Team plans get bought when an existing enterprise plan already covers the need. Usage-based API charges grow without a budget owner.

These are the same patterns behind general SaaS waste, which we cover in how to eliminate SaaS waste and maximize ROI. AI adds usage-based billing on top of seat-based billing, which makes forecasting harder.

Identity and Access Gaps

Every AI tool an employee signs into is an identity. Tools connected through OAuth can keep reading mailboxes and drives after the employee moves teams. Tools that sit outside single sign-on don’t get disabled when someone leaves. Gartner’s research points the same way: it predicts that by 2030 more than 40% of global organizations will suffer security and compliance incidents from unauthorized AI tools, and it found that 69% of surveyed cybersecurity leaders have evidence or suspect employees use public generative AI at work (Infosecurity Magazine, 2025).

How to Detect Shadow AI

No single method finds everything. Each channel sees a different slice, and the gaps between them are where shadow AI hides. Start with the channel that’s already available to you, which is usually finance data.

Channel	What it catches	What it misses	Effort
Expense and card data	Paid subscriptions, team plans, API billing	Free tiers, personal-card purchases, embedded AI features	Low
SSO and OAuth logs	Sign-ins with company identity, granted app permissions	Personal-email accounts with no corporate grant	Low to medium
Endpoint and browser signals	Extensions, desktop apps, visited AI sites	Personal devices and phones	Medium
Network, DNS, and CASB logs	Connections to known AI domains	Personal devices off network, tools inside approved apps	Medium
SaaS discovery and inventory	Apps in use, license counts, duplicates	Usage that never touches a company system	Medium
Surveys and interviews	Intent, reasons, tools nobody logged	Anything people won’t admit	Low

Torii’s guide to detecting shadow AI lists a similar mix, including expense reviews, OAuth logs, extensions, traffic, and interviews (Torii, 2025).

Channel 1: Expense and Card Data

This is the fastest first pass, and it’s the channel this article focuses on because it’s the one most guides skip.

Pull 12 months of card and expense data. Export transactions with merchant name, description, amount, cardholder, and date.
Search for AI merchant names. Start with the common ones: OpenAI, ChatGPT, Anthropic, Claude, Perplexity, Midjourney, Cursor, GitHub Copilot, Gemini, Grammarly, Otter, Fireflies, Jasper, Notion AI, and Canva.
Look for payment-processor descriptors. Many subscriptions bill through app stores or processors, so a charge may read “APPLE.COM/BILL” or a payment-processor prefix. Match amounts and recurrence, not only names.
Flag recurring patterns. The same amount on the same day each month, or a yearly charge, indicates a subscription.
Group by function. Tag each charge to the problem it solves: writing, coding, meeting notes, design, research, and data analysis.
Contact the cardholder. Ask what data goes in and who else uses the tool. Treat it as a discovery conversation.

A common finding is that three people on one team pay separately for the same function. That’s both a cost problem and a signal that the team needs an approved tool.

Channel 2: SSO and OAuth Logs

Review your identity provider’s list of connected apps and granted scopes. Look for AI tools with access to mail, calendar, documents, or code repositories. Sort by scopes granted, because a tool with read access to all mail matters more than a tool with a basic profile.

Channel 3: Endpoint and Browser Signals

Inventory browser extensions and desktop apps through your device management tool. Check extension permissions, especially anything that can read all sites. This channel catches software that never produces an invoice.

Channel 4: Network, DNS, and CASB Logs

If you run a secure web gateway or CASB, filter for known AI domains. This shows who connects and how often. It won’t show what was typed, and it won’t see personal devices on home networks.

Channel 5: SaaS Discovery and Inventory

A SaaS management system correlates identity, finance, and device data into one inventory of apps. This is where duplicates and unused licenses become visible. Our comparison of the best SaaS management tools covers the category if you’re choosing one.

Channel 6: Surveys and Amnesty Interviews

Ask people what they use and why. Announce an amnesty window so that disclosure isn’t punished. Ask three questions: which tools do you use weekly, what kind of data goes in, and what would make the approved option good enough. The answers also tell you what to approve first.

Build a Governance Framework

Good shadow AI governance links policy to approved tools, technical visibility, employee education, and clear ownership. Without the last piece, the policy sits in a wiki and nothing changes.

Step 1: Assign Ownership

Shadow AI crosses three functions, so decide who owns what before writing anything:

IT: Owns the inventory, the approved list, and access lifecycle.
Security: Owns data classification, vendor risk review, and incident response.
Finance: Owns purchasing rules, expense policy, and spend reporting.
Legal or privacy: Owns data processing agreements and regulatory interpretation.
Department heads: Own the business case for new tools in their teams.

Name one accountable person. Committees without an owner produce policies without enforcement.

Step 2: Tier Tools by Data Risk

A three-tier model is simple enough to enforce and flexible enough to scale. Classify by the data the tool touches, not by the brand.

Tier	Meaning	Data allowed	Example conditions
Tier 1: Approved	Reviewed, contracted, SSO-enabled	Internal and confidential data per the contract	Enterprise plan, data processing agreement, no training on company data
Tier 2: Conditional	Allowed for low-risk use only	Public or non-sensitive content	No customer data, no source code, no personal data
Tier 3: Prohibited	Not allowed for work	None	Fails security review, no data controls, or unacceptable terms

Keep a published list of Tier 1 and Tier 2 tools, and update it monthly. A list that’s out of date pushes people back to guessing.

Step 3: Write an AI Acceptable-Use Policy

Keep it to two pages. People read short policies. Cover these sections:

Scope: Who and what it applies to, including contractors and embedded AI features.
Approved tools: Where to find the list and how to request additions.
Data rules: What can never be entered, such as customer personal data, credentials, unreleased financials, and source code in non-approved tools.
Accounts: Company accounts only, with SSO where available.
Output responsibility: Humans review AI output before it goes to customers or into production.
Purchasing: All AI subscriptions go through the intake process, including those under a spending threshold.
Incident reporting: Who to tell if sensitive data was entered by mistake, with no blame for fast reporting.

Illustrative policy language (a template to adapt, not legal advice):

“Employees may use only AI tools listed as Tier 1 or Tier 2 in the AI tool register. Tier 2 tools may be used only with public or non-sensitive information. Do not enter customer personal data, credentials, source code, or unreleased financial information into any tool that is not Tier 1. Request new tools through the AI tool request form. Report accidental disclosures to security within one business day.”

Step 4: Create a Five-Day Approval Fast Path

Shadow AI grows where approval takes six weeks. Commit to a response time for low-risk requests and publish it. A five-business-day target for standard requests works for many mid-sized teams.

Use one review checklist so every request gets the same questions:

Check	What to ask
Data handling	Is customer or company data used for model training? Can training be turned off by contract?
Retention	How long are prompts and outputs stored, and can they be deleted?
Security	SOC 2 Type II or ISO 27001? Penetration test summary available?
Privacy	Data processing agreement, sub-processor list, and data location?
Identity	SSO and SCIM support, role-based admin controls, audit logs?
Access scope	What OAuth scopes or integrations does it request?
Commercial terms	Pricing model, minimum seats, auto-renewal, exit and data export terms?
Overlap	Does an approved tool already do this?

Auto-approve requests that match an existing approved tool, and route only new categories to full review.

Step 5: Provide a Sanctioned Alternative

Blocking a tool without offering a replacement just moves the behavior to personal devices. For each popular use case, such as writing, coding, meeting notes, and research, offer one approved option. Netskope’s shift from 78% to 47% personal-account use, and from 25% to 62% company-managed use, is what that approach looks like in practice.

Step 6: Fix the Expense and Purchasing Rules

Finance is the first line of detection, so give them rules that work:

Recurring software charges require an intake ticket ID, even when paid on a personal card and reimbursed.
Receipts must show the account email, so finance can see whether it’s a company account.
AI-category merchants trigger an automatic flag for review, using the merchant list from the detection step.
Monthly report from finance to IT lists new recurring software charges.
Spending limits on individual cards reduce the chance of a surprise annual plan.

Step 7: Apply Technical Controls Where They Matter

Technical controls support the policy and don’t replace it:

Enforce SSO for approved tools and disable personal sign-ups where the vendor allows tenant restrictions.
Use data loss prevention rules on the highest-risk data types.
Restrict OAuth consent so employees can’t grant broad scopes to unreviewed apps.
Review browser extension allow-lists on managed devices.

Step 8: Train People on Specific Habits

Short, role-based training beats long compliance modules. Show engineers what code is safe to paste, show sales what customer data to strip, and show finance which charges to flag. This also helps meet AI literacy expectations under the EU AI Act, which expects measures suited to people’s roles.

Step 9: Review on a Schedule

Run a quarterly review of the register: remove tools nobody uses, re-tier tools whose terms changed, and check for new AI features in approved apps. Gartner’s analyst guidance also recommends adding generative AI risk evaluation to existing SaaS assessment processes.

Control the Cost of AI Subscriptions

Governance reduces risk, and the same data lets you cut waste. Once you have an inventory, four cost levers appear.

Consolidate Duplicate Seats

If five people pay separately for similar tools, move them onto one team plan. Fewer vendors also means fewer contracts to review.

Reclaim Unused Licenses

Zylo found organizations leave an average of 36% of SaaS licenses unused against recommended utilization. AI tools follow the same pattern: enthusiasm peaks in the first month and then falls. Check usage before each renewal, and drop seats that haven’t logged in for 60 days.

Put Usage-Based Spend Under a Budget Owner

Token and API charges scale with use, not seats. Assign each API key to a named owner and a cost center, set alerts at spend thresholds, and review monthly. Our guide to SaaS license management and renewal strategies shows how to build the renewal calendar that catches annual auto-renewals before they hit.

Worked Example (Illustrative)

This is a hypothetical example to show the arithmetic, not a real company or measured result. A 200-person company finds 34 individual AI subscriptions on expense reports. Twelve are for the same writing assistant, nine are for the same coding assistant, and the rest are scattered across note-takers, image tools, and research tools. IT approves one team plan per category, moves users over a month, and cancels the rest. The company now has four contracts instead of 34, each with a data processing agreement, SSO, and one renewal date. Even if the per-seat price doesn’t change, the company gains visibility, and it can negotiate once instead of 34 times.

Where ZenAdmin Fits in a Shadow AI Program

ZenAdmin isn’t an AI security product. It doesn’t inspect prompts, run data loss prevention, or monitor what employees type into a model. A complete shadow AI program needs those controls from a security vendor if your risk profile calls for them.

What ZenAdmin does cover is the asset and SaaS lifecycle layer that keeps the program true after the first audit. Based on ZenAdmin’s SaaS management capabilities:

Program need	What ZenAdmin provides
Know which apps are in use	A view of every app in use across the organization, including shadow IT
Tie spend to usage	Reconciliation of Xero, FreshBooks, and Zoho Books user data with actual SaaS usage, producing audit-ready spend reports before renewals
Spot waste	Usage monitoring to find underutilized licenses before they renew, and flags for duplicate or redundant tools
Fast, tracked approvals	Employee software requests through Slack and Microsoft Teams, with approvals in the same channels
Joiner and leaver control	Access provisioning triggered by HRIS events, and access revoked on offboarding, with unused dev tool licenses reclaimed
Ongoing assurance	Scheduled access reviews, with reports showing who has access, when it was granted, and why

Two of these matter most for shadow AI. The request-and-approval flow gives employees a fast path inside the tools they already use, which helps keep people from buying on their own card. The offboarding and access-review controls close the gap where a departed employee’s AI account stays active and keeps its connections.

ZenAdmin also manages the device side of the same lifecycle, including inventory, MDM, and procurement. When someone leaves, device retrieval and access removal can run in the same offboarding workflow.

A 90-Day Shadow AI Rollout Plan

A phased plan beats a big-bang policy launch. This sequence works for mid-sized teams.

Days 1 to 30: Discover

Name the accountable owner and the working group across IT, security, finance, and legal.
Pull 12 months of card and expense data and flag AI merchants.
Export OAuth grants and connected apps from your identity provider.
Run the amnesty survey.
Build the first AI tool register with owner, purpose, data type, users, and cost.

Days 31 to 60: Decide

Review the top 10 tools by usage and spend against the checklist.
Tier each tool and publish the Tier 1 and Tier 2 list.
Pick one sanctioned option for each major use case.
Publish the two-page policy and the request form.
Update the expense policy and brief the finance team.

Days 61 to 90: Enforce and Improve

Turn on SSO enforcement and OAuth consent restrictions.
Migrate users from duplicate subscriptions to approved plans.
Cancel unused licenses and calendar the renewals.
Run short role-based training sessions.
Report the first set of metrics to leadership.

Metrics That Show the Program Works

Track a small set of numbers monthly and show the trend, not just the snapshot.

Metric	What it tells you	Direction you want
AI tools in the register	Visibility	Rising at first, then stable
Share of AI spend on approved tools	Adoption of the sanctioned path	Up
Median approval time	Whether the fast path is real	Down, under your target
Unapproved recurring AI charges found per month	Whether shadow purchasing is shrinking	Down
Duplicate tools per category	Consolidation progress	Down
License utilization	Waste	Up
Orphaned AI accounts after offboarding	Lifecycle control	Zero
Policy incidents reported	Culture of disclosure	Early rise is healthy

Shadow AI Tool Categories to Know

Different tools cover different slices. These are categories, not endorsements, and many vendors overlap.

SaaS management platforms: Discover apps, track spend and licenses, and manage requests and renewals. Torii and CloudEagle are examples that publish shadow AI content.
Identity and device platforms: Control sign-in, OAuth consent, and managed devices. JumpCloud, for instance, markets a shadow AI discovery capability.
Security service edge and CASB tools: Inspect traffic and apply data rules to AI sites.
AI security platforms: Focus on AI agents, prompts, and runtime controls, such as Zenity.
Expense and spend management tools: Flag recurring charges and enforce purchase rules at the card level.
Asset and lifecycle management platforms: Keep inventory, approvals, and offboarding connected, which is where ZenAdmin sits.

Most mid-sized companies get the best coverage from combining a SaaS or asset lifecycle platform with the identity provider they already own, and adding security tooling for the highest-risk data.

Conclusion

Shadow AI is a symptom of demand. People adopt AI tools because they work, and they pay for them because the approved route is slower than a credit card. The programs that succeed accept that and respond with speed: a short policy, a three-tier model, a five-day approval path, a sanctioned tool for each major use case, and finance rules that flag new recurring charges.

Detection is the part that never finishes, because new tools and new AI features arrive monthly. That’s why inventory, approvals, access reviews, and offboarding need to run as an ongoing process and not a one-time cleanup. ZenAdmin handles that lifecycle layer, with SaaS visibility, spend reconciliation, request and approval workflows in Slack and Microsoft Teams, and access removal when people leave, alongside the security tooling your risk profile requires.

Book a ZenAdmin demo to see how it tracks the apps your teams use, ties them to spend, and keeps access current as people join, move, and leave.

Frequently Asked Questions

Is shadow AI illegal?

Not by itself. Using an unapproved AI tool isn’t a crime, but it can create legal exposure. Sending personal data to a provider without a lawful basis or a data processing agreement can violate privacy law, and sharing customer data may breach contract terms. Talk to counsel about your specific obligations.

Should we ban ChatGPT and other AI tools?

Usually not. Blanket bans push use to personal devices and personal accounts, where you have less visibility. Samsung’s 2023 restrictions are often cited, and its memo described them as temporary while it prepared security measures. A better default is to approve a sanctioned option, restrict high-risk data, and keep a fast request path.

What’s the difference between shadow AI and shadow IT?

Shadow IT is any unapproved technology. Shadow AI is the AI-specific subset, where the main concern is what happens to prompts, files, and connected data. It also includes AI features that appear inside apps you’ve already approved.

How do I find AI tools my employees are paying for?

Start with expense and card data. Search for AI merchant names, flag recurring charges, and check payment-processor descriptors. Then compare against SSO and OAuth logs, endpoint inventory, and a short employee survey to find free-tier and embedded tools.

Who should own shadow AI governance?

Name one accountable owner, usually in IT or security, with defined roles for finance, legal, and department heads. Finance matters because it sees purchases first, and legal matters because contracts and privacy rules decide which tools are acceptable.

What should an AI acceptable-use policy include?

Scope, the approved tool list, data rules, account requirements, output review, purchasing rules, and incident reporting. Keep it short enough that people read it, and link to a request form so the next step is obvious.

How often should we review approved AI tools?

Quarterly is a reasonable cadence for most companies. Review usage, contract terms, new features, and any change in the vendor’s data handling.

Related blogs

Back to Blogs