Shadow AI management best practices

  •  
     
  • -Select-
By clicking 'Download PDF', you agree to processing of personal data according to the Privacy Policy.

Thank you!

The PDF link has been sent to your email.

We hope you enjoy reading and sharing these best practices.

AI adoption is growing fast. As employees reach for AI tools across every function, from drafting reports and summarizing legal documents to analyzing financial data and generating code. This adds a new dimension to the shadow application problem that has long challenged enterprises.

According to Forbes, a recent study found that one in two employees use AI tools that have not been sanctioned by their employer, putting PII, financial records, and other proprietary information at risk of exposure through external AI models. Here are eight best practices for managing shadow AI across your organization.

Home »

8 best practices for managing shadow AI

 

Maintain an AI tool inventory

  • Deploy a cloud access security broker to monitor web traffic and identify every AI platform in use, including generative AI tools (ChatGPT, Claude, and Gemini), LLM-powered SaaS applications (Notion AI and Slack AI), and browser-based assistants (Copilot in Edge).
  • Enhance visibility into programmatic AI usage by monitoring DNS requests and egress traffic to known AI API hosts such as api.openai.com, api.anthropic.com, and generativelanguage.googleapis.com.
  • Maintain a registry of AI tools identified through network scans and encourage employees to report any additional tools they use, ensuring visibility into usage that scanning may not capture.
 

Regulate data transfers to shadow AI platforms

  • Track clipboard paste events, large prompt submissions, and browser extension activity as detection signals since sensitive data is more often typed or pasted than uploaded as a file.
  • Log all attempts to transfer files to cloud apps, including blocked attempts, to maintain an evidence trail for compliance reviews and incident investigations.
  • Train employees on the security implications of transferring data to AI tools so they can weigh the productivity gains against the exposure risks before submitting data.
 

Define what data can enter each tier of AI tools

  • Enforce data handling rules for each tier through DLP controls where approved tools operate within signed data agreements, tools with limited access accept anonymized data only, and forbidden tools are blocked entirely.
  • Scan for sensitive data and apply data classification labels across your environment to enforce the appropriate tier restrictions for sensitive data.
 

Monitor personal AI account usage

  • Configure SSO to enforce corporate-only access to approved AI platforms. An employee accessing the same tool via a personal account bypasses your organization's data privacy agreements, triggering compliance violations and exposing sensitive data to uncontrolled vendor retention.
  • Extend visibility to unmanaged devices in your network, which is where employees are most likely to access AI tools through personal accounts without IT team oversight.
 

Manage permissions granted to AI tools

  • Conduct permission analysis to identify AI tools with OAuth access to corporate accounts and revoke access for any tools that fall outside your approved tier.
  • Periodically review OAuth scopes granted to approved AI integrations, prioritizing tools with write access to emails, files, or calendars because these pose a significantly higher data exposure risk than read-only integrations.
 

Address the root causes of shadow AI adoption

  • Employees adopt shadow AI when sanctioned alternatives are unavailable or slow to procure. Closing those gaps reduces unsanctioned usage more effectively than enforcement alone.
  • Maintain and share an up-to-date list of approved tools so employees know what is available instead of reaching for an unapproved alternative.
 

Classify AI tools by risk tiers

  • Evaluate each AI tool in use and classify it as approved, restricted (limited use), or prohibited based on vendor criteria such as data retention and training policies, SSO support, SOC 2 and ISO/IEC 27001 certification, and data residency.
  • Enforce tier decisions using firewall and proxy rules. Use conditional access policies that apply restrictions to tools in the restricted tier, such as disabling file uploads.
 

Establish a shadow AI incident response plan

  • Define and test a response plan for incidents in which data reaches an unapproved AI platform. The plan should cover access revocation, account isolation, and exposure scoping.
  • Revoke OAuth tokens and API connections tied to an unsanctioned tool immediately upon detection as these often grant the vendor persistent access to internal systems beyond the initial data submission.

Frequently asked questions

When employees use AI tools outside the IT team's oversight, the organization is exposed to several active threats:

  • Employees share sensitive data through prompts to unapproved AI platforms, bypassing network monitoring and leaving no audit trail.
  • File uploads to unapproved platforms move data outside the organization's security boundary.
  • Personal account logins operate outside corporate data agreements and retention controls.
  • AI tools connected via OAuth inherit broad access to emails, files, and connected systems without IT team review.
  • AI vendors may retain submitted prompt data for model training without the organization's knowledge.

Shadow AI is difficult to detect because it leaves no procurement record and bypasses standard IT monitoring. Detection requires visibility across multiple surfaces:

  • Monitor outbound web traffic to surface AI platforms with no procurement footprint.
  • Use login control to flag personal account logins to AI services that bypass corporate SSO.
  • Use prompt auditing to track what data is being submitted, not just which tools are being accessed.

Shadow IT refers to any technology used without the IT team's knowledge or approval. Shadow AI is a subset specific to AI tools, but it carries a greater data exposure risk. Most shadow IT tools store data passively. However, AI platforms actively process submitted data and may retain it for model training, potentially exposing it at a scale that is difficult to contain or reverse.

Shadow AI adoption is rarely malicious. Employees reach for unapproved tools when sanctioned alternatives are unavailable, when the approval process takes too long, or when they are simply unaware that unapproved tools pose a sensitive data exposure risk. For these reasons, providing approved alternatives and communicating what is available reduces shadow AI adoption more effectively than enforcement alone.

A shadow AI policy is effective only if it is specific, enforceable, and easy for employees to follow. Key considerations include the following:

  • Classify tools into tiers rather than maintaining a simple blocklist so employees have sanctioned options that meet their needs.
  • Define what data is permitted in each tier. PII, ePHI, financial records, and intellectual property should never enter any tool outside the approved tier.
  • Involve legal and compliance stakeholders from the outset, particularly where the GDPR, HIPAA, and other regulations apply.
  • Make the approved tool list visible and accessible so employees know what is available instead of reaching for an unapproved alternative.
  • Build in a review process since AI tools and vendor data handling terms change frequently.

Continue reading

Get DataSecurity Plus easily
installed, configured and running within minutes.

Download Now  

A unified data visibility and security platform

  • Solutions
  • Regulatory compliance
  • Resources
  • Quick links
  • Related products

Real-time Windows Data visibility and security solution and analysis software

Free Trial Get Quote
Email Download Link