Managing shadow AI: visibility, policy and safe alternatives

What is shadow AI and why is it different from shadow IT?

Shadow IT is the long-standing phenomenon of employees using unsanctioned tools to do their work. Personal Dropbox accounts for file sharing, Slack workspaces outside the corporate domain, browser extensions for productivity. The pattern is familiar; most organisations have shadow IT policies and tooling.

Shadow AI is different in three important ways. Velocity: new AI tools launch weekly. Faster than any approval process can keep up. Data exposure: most AI tools work by sending data to the model. The act of using the tool is the act of exfiltrating data. Invisibility: AI usage is often indistinguishable from normal web traffic. Without specific detection, IT has no idea where company data is going.

The result is a category of risk that traditional shadow IT controls do not address.

The concrete risks: what goes wrong when you do nothing

The risks are not theoretical. We see them in customer engagements regularly.

Confidential data in public models. Strategy documents pasted into ChatGPT to summarise. M&A draft contracts in Copilot for editing. Customer data in image generators for marketing collateral. Once in a public model, the data is, for practical purposes, irretrievable.

Regulatory exposure. GDPR processing of personal data by an unauthorised processor (the public AI vendor) is a notifiable breach. The Dutch Autoriteit Persoonsgegevens has issued guidance and is beginning enforcement.

IP loss. Source code in public AI tools may surface in other users' completions. Trade secrets that depend on confidentiality lose their legal protection if voluntarily shared.

Quality and accuracy. AI-generated content used in customer-facing communications without review introduces hallucinations into the company's voice.

Why prohibition does not work

The natural managerial response to a new risk is to ban it. With shadow AI this fails predictably for three reasons.

First, AI tools are too valuable for individual productivity. Employees who lose access to them at work simply switch to personal devices. The work continues; only the visibility ends.

Second, AI is too pervasive to ban cleanly. ChatGPT, Copilot and Gemini are integrated into thousands of products. Banning "AI" without listing each tool is meaningless; listing each tool is endless work.

Third, prohibition signals that IT does not understand the actual problem. The employee using ChatGPT to draft a customer email is solving a real problem. Telling them no, without offering yes, undermines IT's credibility for everything else.

The four-step strategy: visibility, policy, safe alternatives, monitoring

Step 1: visibility. Detect which AI tools are being used and by whom. CASB and SASE inspection identify the traffic; usage analytics show the patterns. Without this baseline, every subsequent step is guesswork.

Step 2: policy. With visibility, write policies that match reality. Some tools are blocked (those with poor data handling); some are allowed with restrictions (no personal data, no IP); some are sanctioned (corporate-configured Copilot, enterprise Claude). The policy framework reflects three categories, not a binary.

Step 3: safe alternatives. Where employees have legitimate AI needs, offer the corporate version. Corporate Copilot for productivity, enterprise ChatGPT for content drafting, internal AI for sensitive data. The principle: make the safe path easier than the unsafe path.

Step 4: continuous monitoring. AI tools change weekly. New ones launch, existing ones change data handling, terms of service shift. Continuous monitoring catches drift; quarterly policy refreshes keep the framework current.

How Cato AI Security manages shadow AI technically

Cato AI Security, launched in March 2026 as the first SASE-native AI security module, implements the four-step strategy in technical form.

Detection uses the Cato CTRL threat intelligence layer enriched with AI-tool signatures. Identification happens at traffic inspection, regardless of the user's awareness.

Policy enforcement happens inline. The SASE single-pass engine evaluates each AI-tool interaction against policy: allow, allow with redaction (DLP strips sensitive content before it reaches the model), allow with logging only, or block.

Safe alternative routing is policy-driven: requests to public ChatGPT can be redirected with a notification to use the corporate Copilot instead. Friction stays low, education happens in context.

Continuous monitoring uses behavioural analytics: anomalous patterns (sudden spike in AI usage from one user, large data uploads to AI tools, off-hours patterns) generate alerts.

GDPR, NIS2 and the data protection authorities

Shadow AI sits at the intersection of two regulatory frameworks. GDPR covers personal data processing; NIS2 covers cyber security obligations. Both are increasingly explicit about AI-tool usage.

For Dutch organisations, the Autoriteit Persoonsgegevens has issued guidance stating that employees pasting personal data into public AI tools constitutes unauthorised data processing. The same logic applies under NIS2 for organisations in scope: shadow AI is an access control gap. The auditor will expect evidence of detection, policy enforcement and audit trails.

We unpack the broader compliance picture in our article on NIS2 compliance.

Momentum EMEA as shadow AI governance partner

Technical capabilities are necessary but insufficient. The harder work is the policy framework: categorising tools, defining acceptable usage, communicating with employees. As EMEA's leading specialised Cato implementation partner, Momentum EMEA delivers both: the Cato AI Security platform that enforces and a governance framework that articulates the policy in language employees understand.