Shadow AI: The Business Risk of Unsanctioned AI Tools, and How to Govern It

Shadow AI is not an attack. It is an employee pasting a client contract into a personal chatbot account to get a quick summary, or uploading a spreadsheet to a free tool to clean it up. Nobody intends harm. The problem is that company data has left the systems the company controls, under terms the company never agreed to.

IBM Canada describes shadow AI as the use of AI tools and applications in the workplace without formal approval or oversight from a company's IT department (IBM Canada). That is a governance problem first: who decided this tool was acceptable, what data went into it, and who is accountable if something goes wrong?

This post covers the unsanctioned-use side of the problem: what the published evidence shows, how Canadian privacy rules apply, and the four controls that address it. If you are looking for adversarial threats such as prompt injection and data poisoning, see our companion post on AI security threats every enterprise should prepare for.

Three sources, using different methods, describe the same pattern: employees are using AI tools their employers did not provide.

In the 2024 Work Trend Index from Microsoft and LinkedIn, Microsoft reported that 78% of AI users are bringing their own AI tools to work, a pattern it calls BYOAI (Microsoft WorkLab). Microsoft's survey covered 31,000 full-time employed or self-employed knowledge workers across 31 markets, fielded in February and March 2024. Microsoft also found that 52% of people who use AI at work are reluctant to admit to using it for their most important tasks.

Closer to home, an IBM-commissioned study released in September 2025 found that while 79% of full-time office workers said they use AI at work, only 25% rely on enterprise-grade AI tools (IBM Canada Newsroom). According to IBM, the rest rely on a mix of personal and employer tools (33%) or entirely on personal apps (21%). IBM's methodology note says the study was conducted by Censuswide among 4,000 full-time office workers who are not sole proprietors and are familiar with AI tools, in the United States, Canada, Mexico and Brazil; the release does not say how many of them were in Canada.

LayerX, now part of Akamai, reported in October 2025 that 77% of employees paste data into GenAI prompts and that 82% of those pastes come from personal accounts (LayerX / Akamai). LayerX also reported that 40% of files uploaded to GenAI tools contain sensitive PII or PCI data, and that GenAI tools alone account for 32% of all corporate-to-personal data transfers. LayerX's figures are drawn from browsing telemetry from its own enterprise customers. LayerX's report page also says nearly half of employees use GenAI tools, and neither page says whether the 77% is measured against all employees or only those using GenAI (LayerX report page). Treat these as a vendor's view of its own customer base, not a census of the workforce.

Usage figures show exposure. Breach figures show what that exposure can cost.

IBM's 2025 Cost of a Data Breach Report found that one in five organizations reported a breach due to shadow AI, and only 37% have policies to manage AI or detect shadow AI (IBM Newsroom, July 2025). IBM reported that organizations that used high levels of shadow AI observed an average of $670,000 in higher breach costs than those with a low level or no shadow AI; IBM's own summary of the report states that figure as USD 670,000 (IBM Think). IBM also found that security incidents involving shadow AI led to more personally identifiable information (65%) and intellectual property (40%) being compromised, compared to the global average of 53% and 33% respectively. IBM's 2025 report is based on data breaches experienced by 600 organizations globally from March 2024 through February 2025.

In its Canadian release, IBM Canada stated, citing the 2025 Cost of a Data Breach Report, that in the past year shadow AI added nearly CA$308,000 per data breach (IBM Canada Newsroom).

Writing about the 2026 edition, an IBM Think article by Oussama Kiassi says that IBM reported security incidents involving unapproved AI use rose from 20% to 43% of organizations (IBM Think). The same IBM article notes that the 2026 Cost of a Data Breach Report examines organizations that experienced data breaches, and IBM's July 2026 release says that study is based on breaches at 602 organizations globally between March 2025 and February 2026 (IBM Newsroom, July 2026). In other words, these percentages come from studies of breached organizations, not of all organizations.

In May 2023, Fortune reported, citing Bloomberg, that Samsung Electronics was banning employees from using programs like ChatGPT in their work (Fortune). Fortune wrote that Korean media had reported in early April 2023 that Samsung was restricting ChatGPT use after several employees uploaded sensitive data, and that one employee reportedly asked ChatGPT to help fix a faulty database, uploading confidential source code in the process, while another shared an entire meeting to have the chatbot create meeting minutes.

According to Fortune, Samsung later clarified that the ban would be temporary. Fortune also reported, citing Bloomberg, that Samsung pledged in its memo to create its own tools for translation and document summary. The ban came with a plan for an alternative.

When an employee pastes customer data into a personal AI account, PIPEDA's accountability principle still applies to the business: an organization is responsible for personal information under its control.

Under PIPEDAPIPEDA — Personal Information Protection and Electronic Documents ActA Canadian federal privacy law protecting personal information collected, used, or disclosed in electronic commerce., an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing (PIPEDA, Schedule 1, clause 4.1.3). The same clause says the organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party. An employee's personal chatbot account comes with no contract between your company and the provider, so there is nothing to point to as that comparable level of protection.

PIPEDA also requires organizations to implement policies and practices that include training staff and communicating to staff information about the organization's policies and practices (clause 4.1.4(c)), and to make employees aware of the importance of maintaining the confidentiality of personal information (clause 4.7.4). Shadow AI is, in part, a training and awareness gap, and these clauses already address training and awareness.

In December 2023, the Office of the Privacy Commissioner of Canada and its provincial and territorial counterparts issued Principles for responsible, trustworthy and privacy-protective generative AI technologies (OPC). Those principles say all parties should recognize that they are responsible for compliance with privacy legislation. For organizations using generative AI systems, they say to use anonymized or de-identified information within prompts rather than personal information where possible and reasonable, and, where personal information must be entered into a prompt, to only do so where authorised.

The Government of Canada's Guide on the use of generative artificial intelligence, written for federal institutions, states that public servants must not input personal information into publicly available online generative AI tools (Government of Canada). The guide explains that the suppliers of some generative AI tools may inspect input data or use it to further train their models, and that risks can arise from input data being stored on servers not controlled by the government. Although the guide is aimed at federal institutions, it is a clear public statement of the risk that private-sector policies can adopt.

The exposure is not limited to personal information. NIST's Generative AI Profile (NIST AI 600-1, July 2024) lists intellectual property as a distinct generative AI risk, including eased exposure of trade secrets (NIST AI 600-1). Source code, pricing models, product plans and deal terms are not personal information, so privacy law may not cover them, but losing control of them can still cost you.

No single control solves shadow AI. Each of the four below closes a different gap, and they work best together.

Provide sanctioned alternatives. Give employees an approved tool that covers the jobs they are using personal tools for, under a business agreement that sets out how your data is handled, retained and used. Before you approve a tool, read its data-use and retention terms for the specific plan you are buying. NIST AI 600-1 suggests organizations enumerate organizational GAI systems for incorporation into an AI system inventory, and inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists (NIST AI 600-1).

Write a short, usable policy. NIST also suggests organizations establish transparent acceptable use policies for GAI that address illegal use or applications of GAI. A useful policy answers three questions in plain language: which tools are approved, which categories of data may never go into any AI tool without approval (personal information, client confidential material, source code, unreleased financials), and who to ask when a new use case comes up. Borrow the Government of Canada's simple rule as a starting point: do not enter sensitive or personal information into tools the organization does not manage.

Train people on the why, not just the rules. Microsoft's 2024 Work Trend Index found that only 39% of people globally who use AI at work have gotten AI training from their company (Microsoft WorkLab). Training should show staff what happens to data in an unmanaged tool, how to use the approved tool well, and how to strip or anonymize details before prompting. Because employees may be reluctant to admit AI use, make it safe to disclose: an amnesty-style inventory exercise can surface the use cases you need to support.

Add technical controls that match the policy. Discovery, data loss prevention, and audit logging can help you see AI usage and enforce the data rules. As one documented example, Microsoft's documentation says Windows computers onboarded to Microsoft Purview can be configured with Endpoint data loss prevention policies that warn or block users from sharing sensitive information with third-party generative AI sites accessed through a browser (Microsoft Learn). The same documentation describes other AI apps that are detected through browser activity and categorized as Generative AI in the Defender for Cloud Apps catalog, and says that, for supported AI apps, prompts and responses are captured in the unified audit log. Microsoft is cited here only as a documented example, not a recommendation; evaluate options against your existing security stack. Then audit on a schedule. IBM's 2025 report found that of the organizations that have AI governance policies in place, only 34% perform regular audits for unsanctioned AI (IBM Newsroom, July 2025).

A practical sequence for a Canadian business can look like this:

First, find out what is in use: run an anonymous survey and review whatever network or browser logs you already have to build an inventory of the AI tools staff actually use, and for what.

Next, choose sanctioned tools: pick the approved tools that cover the most common use cases, review their business terms, and document the decision so you can demonstrate compliance, as the privacy regulators' principles expect.

Then, set the rules: publish a short acceptable use policy and run short, role-specific training sessions.

Finally, enforce and review: turn on monitoring or DLP in warn mode first, review what it catches, then tighten rules where the data is most sensitive.

If you are unsure where you stand, the AI readiness assessment is a quick place to start. HCC's AI Governance & Compliance service can help you build the inventory, policy and accountability framework, and HCC's Corporate AI Training can help your staff use approved tools safely and well. For the broader workforce side, see AI upskilling: building an AI-literate workforce.

Microsoft WorkLab — 2024 Work Trend Index: AI at Work Is Here. Now Comes the Hard Part IBM Canada Newsroom — IBM Study: Shadow AI Use Surges as Canadian Workers Outpace Employers in AI Adoption Akamai (LayerX) — AI Is Now the #1 Data Exfiltration Vector in the Enterprise and Nobody's Watching LayerX — The LayerX Enterprise AI & SaaS Data Security Report 2025 IBM Newsroom — IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications IBM Think — 2025 Cost of a Data Breach Report: Navigating the AI rush without sidelining security IBM Newsroom — IBM Study: One in Four Malicious Breaches are AI-Enabled IBM Think — Every AI agent followed the rules, and the data still leaked Fortune — Samsung threatens to fire employees if they leak data to A.I. chatbots like ChatGPT (May 2, 2023) Office of the Privacy Commissioner of Canada — Principles for responsible, trustworthy and privacy-protective generative AI technologies Justice Laws Website — PIPEDA, Schedule 1 Government of Canada — Guide on the use of generative artificial intelligence NIST — AI 600-1, Generative Artificial Intelligence Profile Microsoft Learn — Microsoft Purview data security and compliance protections for generative AI apps