I’ve been having a lot of conversations with industry leaders lately about the prevalence of so-called “shadow AI.” They’re worried about the risks of unapproved AI tools at work, and most come to me wanting to know how to rein in their employees. But that’s looking at the problem backwards.
Their concern is well founded. Among organizations surveyed in IBM’s Cost of a Data Breach Report 2026 that had experienced a data breach, 43% reported security incidents involving shadow AI, up from 20% the previous year. And the problem isn’t going away. In our own recent survey, we found that roughly one in three respondents reported shadow AI use at their companies.
The problem is, leaders are missing what shadow AI is actually telling them about their businesses. Most chalk it up to an employee problem, when it’s really a leadership one.
The prevalence of shadow AI means your company is trying to innovate faster than you’re letting it. That’s a significant risk in and of itself.
Shadow AI is a signal
Picture an HR professional who, frustrated with a repetitive task like assembling personalized onboarding materials, automates this process with an unauthorized tool.
Some might say they put the company’s security at risk to avoid doing the job they’re paid to do. But another way of looking at it is this: Your employee just revealed a way to create better onboarding materials, save time and money, and free up an entire team for deeper work. In other words, they’re showing you how to trim the fat on your business so everyone can focus on new opportunities to grow the company.
Shadow AI is often the result of an organization’s standardizing its AI approach too early. It may seem like strong leadership, but by committing too soon to one set of tools, you’re closing the door to new opportunities. If you force people to use tools that aren’t the best ones for the job, they’re likely to use the right tool anyway, creating unnecessary risks.
How leaders should respond to shadow AI
Shadow AI is a green sprout of innovation, so don’t treat it like a weed. If, in the example above, the company simply fired or penalized that HR professional, they would be sending a message to employees that innovation is not welcome. Your main priority as a leader right now should be getting AI experimentation out of the shadows so everyone can benefit.
One company we work with did this by hosting an AI amnesty month. Employees were encouraged to share the tools they’d been using without fear of reprisal. The company found that those using shadow AI were some of their best performers and were frustrated by having to keep their innovations in the dark. The initiative allowed the company to evaluate all the tools at its disposal—tools that were already road tested—and decide which to implement widely and which to formally reject. They celebrated the innovation and found a path for employees to operate them securely.
Doing so mitigates another crucial risk. If your employees have found a more efficient way to do their jobs, your competitors will discover the same. You are ceding the advantage to them if you ignore what your team has found.
How to build a culture of AI experimentation
To be clear, shadow AI carries significant risk and should be discouraged. But how you discourage it will have an impact on how your company relates to AI in general, so be intentional in your messaging and reactions.
Create a culture of responsible innovation by:
- encouraging employees to seek out new tools while establishing clear rules around what data they can use and what systems those tools can access
- coordinating with IT to create approved pathways for testing new tools rather than simply blocking them
- creating a sandbox system with synthetic data so employees can experiment without exposing company or customer information
- supplying employees with time, resources, and training so they have the space and ability to use these tools responsibly, and
- creating forums for employees to share what’s working so that everyone can learn from each other.
What leaders should communicate about AI
The best way to fight shadow AI is to create a culture where no one feels the need to hide their usage in the first place. That comes down to the message you’re sending to your employees: We will not tolerate shadow AI, but we will do everything we can to empower you to use AI. Let them know that because they are closest to the work, they know how to make the work better, and you’re giving them the chance to do that.
The way things have always been done is not the path to the future. If your employees aren’t stuck doing drudgery work, they’ll have time to find ways of doing things you previously never thought possible. Leaders should follow the motto: “Find a way; don’t get in the way.”