Shadow AI Discovery: A Practitioner Q&A for UK GRC Teams

This FAQ answers the questions UK governance, risk and compliance teams ask when they realise staff are using AI tools nobody signed off. It covers what shadow AI is, how to find it without spying on people, how it differs from classic shadow IT and how to govern it once you know it exists. Written for security and compliance leads in regulated organisations who need a defensible inventory before they can build an AI Security or ISO 42001 programme.

What is shadow AI and why is it a security risk?

Shadow AI is any AI tool used inside your organisation without security or governance oversight. It covers the obvious cases, staff pasting client data into a public chatbot and the quieter ones, a developer running a coding assistant in the terminal or a marketing team subscribing to an AI writing service on a corporate card.

The risk is not the tool itself but the absence of control around it. These tools process sensitive data through third-party models you have not assessed. They can produce biased or unexplained outputs that feed business decisions. Depending on the vendor, their terms may grant rights over your data that you would never accept in a signed contract. None of this is visible if you have not mapped it.

The pattern is familiar to anyone running security in this market. As one practitioner put it on Hacker News in February 2026: “Now they’re quietly running Claude Code in the terminal because the official Copilot can’t even forma [sic] a CSV properly. CISOs are terrified right now.” You cannot govern what you have not mapped, and shadow AI sits squarely in the part of your estate you cannot see. That is why we treat Shadow AI Discovery as the foundation of a governance programme.

How do you find shadow AI in an organisation?

You find shadow AI through structured inventory work rather than surveillance. We catalogue the AI tools in active use, identify what data each one touches and assess vendor terms and access controls.

A governance-led discovery maps usage across teams, interviews the people who rely on the tools and produces a defensible inventory. That inventory is the foundation of any AI security or ISO 42001 programme. The method matters as much as the result: discovery built on conversation rather than monitoring surfaces tools that network logs miss, because much shadow AI runs in a browser tab or a personal account that never touches your managed infrastructure.

The output is a single record of every AI tool in use, the data it processes, who owns it and how exposed you are. From there you can prioritise. Some tools are low risk and can be sanctioned quickly. Others touch regulated data through opaque vendor terms and need urgent attention. Discovery turns an unknown estate into one that is ranked, owned and recorded.

How is shadow AI different from shadow IT?

Shadow IT is unsanctioned software and infrastructure. Shadow AI is the AI counterpart, unsanctioned AI tools used without security or governance oversight.

AI changes the risk in three ways. First, these tools process sensitive data through third-party models, so a single prompt can move regulated information outside your control in seconds. Second, AI outputs can be biased or unexplained, which creates accountability problems that a conventional SaaS app does not. Third, AI tools fall within regulation that is now in force, such as the EU AI Act, so the governance questions go beyond the classic shadow IT checklist of licensing and patching.

The practical consequence is that a shadow IT register is not enough. You need to record not just which tool is in use but what data it touches, how its model behaves and whether its use is permitted under the regulation that now applies to AI. The discipline is similar to managing shadow IT; the questions are harder.

How do you govern shadow AI once it has been discovered?

Governing shadow AI means moving each discovered tool into a managed position. For every tool you assign an owner, assess its data handling and vendor terms, decide whether to sanction, replace or retire it and record the decision.

That last step matters. A governance decision you cannot evidence is not a governance decision. Recording who owns each tool, what it was assessed against and why it was kept or removed gives you the audit trail regulators and certification bodies expect. Discovery feeds ISO 42001 readiness and EU AI Act scoping by turning an unknown estate into an inventoried, owned and prioritised one.

We frame this as a governance exercise rather than a tooling problem because the failure mode is rarely technical. As one anonymous commenter on The Register forums argued in October 2025: “Shadow AI isn’t the threat - lack of competence is.” Within a governance model that is the right diagnosis. The answer is not another detection product but the capability to assess, decide and record, applied consistently across the estate.

Is shadow AI a compliance problem under the EU AI Act?

It can be, and that is why discovery matters before you can scope your obligations. The EU AI Act classifies AI systems by risk and places duties on organisations that deploy them. The Act is already in force, with obligations applying on a phased timetable, so the question is not whether it applies but which of your AI uses it reaches. If staff are using AI tools you have not inventoried, you cannot know whether any of them fall into a regulated category, which means you cannot demonstrate compliance.

UK organisations serving EU customers, or operating under contractual obligations that reference the Act, need to scope which of their AI uses are in scope. That scoping is impossible against an unknown estate. A structured discovery gives you the inventory the Act assumes you already have: what AI you use, what it does and where it sits on the risk spectrum. Discovery does not make you compliant on its own, but it is the prerequisite for any credible compliance position. This article is general guidance and does not constitute legal advice.

Does shadow AI discovery require employee monitoring?

No. A governance-led discovery is built on inventory and interview, not surveillance. We catalogue tools, map data flows and talk to the people who use them. We do not deploy invasive monitoring across employee devices.

This is deliberate. Monitoring tends to drive shadow AI further underground, because staff who fear punishment stop being honest about what they use. Discovery that opens with a conversation surfaces more than discovery that opens with a network scan. People adopt these tools to do their jobs, and they will tell you why if the exercise is framed as improvement rather than enforcement. The defensible inventory you need comes from collaboration, not from watching keystrokes.

How does shadow AI discovery support ISO 42001 readiness?

ISO 42001 is the management system standard for AI. Like any management system standard, it expects you to know what you are managing. You cannot demonstrate control over AI you have not inventoried.

Discovery produces that inventory. It identifies the AI tools in use, the data they process and the owners responsible for them, which maps directly onto the requirements an ISO 42001 implementation has to satisfy. Our differentiator here is regulated-sector delivery and ISO 42001 Lead Auditor framing, not detection volume. We approach discovery as the first step of a readiness programme, so the output is structured to feed the standard rather than to sit in a tooling dashboard. The inventory becomes the basis for your scope, your risk assessment and your control decisions.

Why do staff adopt unsanctioned AI tools?

Usually because the sanctioned options do not do the job. Staff reach for AI tools that are faster, more capable or simply available when the official tooling falls short. Punishing them rarely works, because the underlying need does not disappear.

This is why we treat shadow AI as a signal rather than a crime. A digital workplace and PMO leader in regulated industries put it well on LinkedIn in June 2026: “Shadow AI isn’t the problem. It’s the symptom. Still figuring it out ourselves, but listening has been the best first move.” Listening is the right instinct. Discovery that starts by understanding why staff adopted a tool produces better governance decisions than discovery that starts by assuming bad faith.