Category: AI Governance

Ask a security team to name the AI applications running inside their company and most will get four or five right without looking anything up. That is not a failure of attention; it is what the data looks like. Akamai’s Enterprise AI Usage Risk Report 2026, built on browser telemetry from the LayerX platform Akamai acquired, found that the top four AI applications in a typical organization are each used by more than 20% of employees, and then the curve falls off a cliff. After the tenth application, usage drops below 5% of the organization, and by the thirtieth it approaches zero. The report’s own description of what sits in that tail is worth quoting: “a vast ‘long tail’ of shadow AI apps operates just below the surface, often used by small, isolated teams without corporate oversight.”

That shape is the entire detection problem. Every method for finding shadow AI keys off some signal, whether that is traffic volume, a billing record, an identity grant, or a content match, and the long tail is precisely the region where each of those signals is weakest. A program that finds the apps everyone already knows about has not produced an inventory; it has produced a confirmation. The gap matters beyond hygiene, because an inventory is now an explicit control obligation: NIST’s AI Risk Management Framework states under GOVERN 1.6 that “mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.” An auditor will ask what the mechanism is, and “we monitor the network” is a mechanism with a known coverage boundary that most teams have never written down.

Below are the six approaches enterprises actually deploy to find unauthorized AI. Each one genuinely works on some part of the problem, each has a blind spot that is structural rather than a missing feature, and the last one is ours, held to the same standard.

1. Network and Proxy Monitoring

Secure web gateways, cloud access security brokers, and DNS logging see every device on the corporate network without installing anything on it. For a first pass at discovery this is the right move and often the fastest one available: the egress logs already exist, nobody has to ship an agent, and a weekend of querying domain requests against a list of known AI services will produce a defensible starting inventory. CASB products extend this by inspecting sanctioned applications through vendor APIs, which adds real depth on the platforms a company has already licensed.

The structural limit is that a domain is not a person and a request is not a prompt. Without TLS inspection the logs resolve to a hostname and a timestamp, so the record says someone reached a chat service, not who they were or what they sent. TLS inspection closes part of that gap but is expensive to run and politically difficult to justify, and it still breaks against certificate pinning in native clients. More decisively, the network only sees what crosses it. An employee on a home network, a personal laptop, or a tethered phone is outside the sensor entirely, and that is not an edge case now that AI use has drifted onto whatever device is nearest.

2. Identity and OAuth Grant Logs

Mining the identity provider for third-party application grants is the highest-precision discovery method available, and the most underused. When an employee connects an AI tool to their corporate account, the grant is recorded with the scopes it requested, so the log tells you not just that an app exists but what it can reach. An AI meeting assistant holding calendar and mailbox scopes is a materially different risk from one holding nothing, and the identity log is the only source that distinguishes them. It is retroactive, needs no deployment, and finance and security can read it without a project.

The blind spot is the sign-up path. An employee who registers with an email address and a password never creates an OAuth grant, so the most common way into an AI tool leaves no trace in the place you are looking. The Akamai research sizes this directly: nearly half of all enterprise AI conversations, 47.11%, take place through personal identities rather than corporate-managed accounts. The more troubling finding is the one that looks governed and is not. 14.4% of AI conversations on corporate email addresses were linked to personal freemium subscriptions rather than enterprise licenses, which means, as the report puts it, “the data going into those accounts was being used by the LLM for public model training.” The identity log shows a corporate address behaving normally. The contract governing that data is a consumer click-through.

3. Endpoint and DLP Agents

Endpoint agents and data loss prevention tooling are the only approach on this list that is content-aware and device-wide at the same time. The agent travels with the laptop, so it keeps working off the corporate network, and it sees native desktop applications that a browser-based sensor cannot. For organizations that already run endpoint detection everywhere, extending the existing policy to AI destinations is incremental work rather than a new program, and it is the closest thing available to a complete view of a managed device.

The limit is that the detection model was built for a different shape of data. Akamai’s report makes this argument against the category’s own history: traditional DLP “assumes that sensitive information moves through relatively well-defined channels” and relies on “exact matching, fingerprints, regular expressions, dictionaries, and predefined data classifications.” AI does not move complete files. It moves prompts, pasted snippets, screenshots, conversational context, and iterative follow-ups, so that “sensitive information has become fragmented across dozens of interactions that individually may appear harmless but collectively expose valuable business context.” A rule tuned to catch a spreadsheet leaving the building does not fire on the twentieth question in a conversation that has reconstructed the same spreadsheet. There is also a reporting mismatch: DLP produces exfiltration events, which is not the same artifact as an application inventory, and a queue of events will not answer the auditor’s question about mechanisms.

4. Expense, Procurement and SaaS Management

Reading the card statements is the oldest shadow IT technique and it remains the only one that sees money. SaaS management platforms automate it, reconciling expense feeds and vendor invoices into a subscription list with renewal dates, seat counts, and duplicate purchases attached. It is owned by finance, needs no security deployment, and it surfaces a class of problem the technical approaches miss entirely, which is the team that bought a paid tier through a departmental card and has been renewing it annually ever since. It is also the only discovery path that arrives with a cost attached, which is why we treat shadow AI discovery as a spend problem as much as a security one.

The limit is arithmetic. Shadow AI begins free, and a free tier generates no invoice, no expense line, and no procurement record. The Akamai freemium figure is the measurement of exactly this gap: usage that reaches corporate email addresses, carries business data, and never once appears in a financial system. By the time a tool shows up on a statement it has usually been in production use for months, which makes expense data an excellent record of what was purchased and a poor record of what is being used.

5. Browser Extensions

A managed browser extension sees the interaction rather than the connection. Where a gateway records that a host was reached, the extension records which application was used, by which identified user, at what time, and in some cases what was actually sent. That is the difference between an inventory of domains and an inventory of behavior. It deploys through existing browser policy in minutes rather than quarters, and critically it works regardless of which account the employee signed in with, which is the one failure mode that defeats identity-based discovery.

The structural limit is in the name. A browser extension sees the browser, so desktop clients, IDE assistants, and anything calling a provider API from a server are outside it. We have argued this against ourselves before: browser-only detection is listed as one of the shadow AI mistakes that make the problem worse, and that remains true. There is a second-order problem worth naming too, because the same Akamai research found that nearly three quarters of installed AI browser extensions request high or critical permission levels, 56.4% high and 16.7% critical. An extension is a powerful access channel by construction. What separates a governance sensor from a liability is not how little it can do, but who deployed it, under what policy, and whether what it collects is written down.

6. Olakai

Olakai Assistive discovers shadow AI through a browser extension that is force-installed by policy rather than chosen by the user, across Chrome, Edge, and Firefox, using standard enterprise deployment through Intune, Jamf, or Workspace ONE. Capture runs at two depths and we state the boundary plainly: full prompts and responses on a named set of major applications including ChatGPT, Claude, Gemini, Microsoft Copilot, and Perplexity, and metadata only, meaning application, user identity, and timestamp, across the 800-plus other AI sites in the long tail. Three managed integrations supplement the extension for Microsoft 365 Copilot, Gemini in Google Workspace, and Claude, read from the vendor rather than the browser. Google supplies activity for its surfaces but never prompt content, so that integration tells you who used which feature and when, and nothing about what was said.

The part that answers the long tail is not the extension. Olakai analyzes each detected application’s published terms of service, privacy policy, and licence agreement, and scores it from 0 to 100% across five categories: whether the vendor trains models on customer data, what content licence it claims, how long it retains data, whether it shares data with third parties, and how it treats intellectual property. Each score carries the excerpt from the vendor’s own document that produced it, and a comparison against every other application in the catalog, so an app in the riskiest fifth for data retention is labelled as such. Because this reads the vendor’s public legal documents rather than the traffic, it works on applications we only ever see as metadata, which is exactly where the other five approaches go dark. Pairing that with the app catalog and policy alerts is what turns a list of domains into an audit-ready record, and it is the reason a CISO can answer a question about a tool nobody has inspected by hand.

The structural limit is that Olakai observes; it does not block. The extension reports an interaction after the model has finished responding, so it is an audit and early-warning system rather than a prevention control, and acceptable use policies it presents are advisory, meaning an employee can decline the notice and keep using the application while monitoring continues. Enforcement requires integrating our control endpoint into your own application code, which by definition cannot cover a third-party web tool. Classification is also human work: discovery is automatic, but until someone assigns an approval state to a newly found app you cannot enforce policy against it, attribute its cost, or flag sensitive data leaving through it. And our discovery is browser-based, with no gateway and no identity-log component, so anything in the first four categories above belongs underneath Olakai rather than instead of it. We would rather say that than have a customer discover it in month three. The argument for why blocking shadow AI fails is the same argument for why observation is the right default, and what the extension does and does not collect is documented rather than described.

The Pattern: Everyone Counts Apps, Nobody Counts Exposure

Line the blind spots up and they stop looking like six separate gaps. Network monitoring sees domains rather than people. Identity logs see grants rather than sign-ups. DLP sees events rather than an inventory. Expense data sees invoices rather than usage. Browser extensions see the browser rather than the device. Every one of them is counting applications, and the application count is a proxy for the thing that actually matters. Akamai puts the reframe in a single sentence: “The biggest AI security risk is no longer employees who access AI, it is employees who share sensitive business data with AI.”

That is a different question, and it has three parts that no app inventory answers. Which data left the organization. Whose account it left through, corporate or personal. And what the receiving vendor’s terms permit them to do with it once it arrives. A program built to answer those will tolerate an incomplete app list, because a tool nobody has sent anything sensitive to is a low-priority row. A program built to produce a complete app list will keep adding sensors and still be unable to tell a board whether anything of value walked out. This is also why prohibition makes measurement worse rather than better, a pattern we have tracked as shadow AI has gotten worse rather than better under blocking-first policies: each ban removes a surface from the sensors without removing the behavior.

The practical sequence is unglamorous. Start with whichever sensor you already own, because partial coverage you can read beats complete coverage you are still procuring. Write down what it cannot see, since an undocumented coverage boundary is the thing that turns into an incident report. Then close the largest gap deliberately rather than buying another overlapping tool, and run the whole thing as AI governance with a named owner rather than as a security project with an end date. If you have never produced the first inventory, the AI visibility audit is the version of this that fits in a week.

Shadow AI is not a list of applications to eliminate. It is evidence of demand that arrived faster than governance, and the organizations handling it well are the ones that can say, with a number, what their people are sending where and under whose terms. That is a measurement problem before it is a security problem, which is the whole reason Olakai exists. Talk to an expert and we will show you what the first week of detection actually surfaces, including the parts we cannot see.

On May 7, 2026, a community bank in Pennsylvania filed something no public company had filed before. Its Form 8-K disclosed a material cybersecurity incident, as the SEC rules require, but there was no attacker in it. The bank had “become aware of an internal incident involving the handling of certain non-public customer information using an unauthorized artificial intelligence-based software application.” Names, Social Security numbers, dates of birth. An employee, a tool nobody had approved, and a regulatory filing that will be read by every bank’s board for years.

The uncomfortable part is that this bank almost certainly had a shadow AI program. Most enterprises do by now. The problem is not that leaders are ignoring shadow AI; it is that the programs they built rest on assumptions that were reasonable two years ago and are wrong today. We have written before about the two biggest ones: that blocking makes the problem smaller, when the data says it drives usage underground, and that shadow AI is purely a threat, when it is also the clearest demand signal a company will ever get for free. This post is about the seven mistakes that come after those two, the ones that quietly make a well-intentioned program worse.

1. Counting apps instead of interactions

The first number every shadow AI program produces is a count of tools. It is a natural place to start, and it is almost meaningless. Zscaler’s ThreatLabz saw AI traffic to more than 3,400 distinct applications in 2025, and the volume of data moving to those tools grew 93% in a year. A catalog of 3,400 names tells you nothing about which forty of them matter. Cyberhaven’s 2026 report found that the most aggressive adopters use 300 or more generative AI tools while cautious enterprises use fewer than 15, yet the share of data movements into AI that involve sensitive content, 39.7%, does not follow the app count at all.

The unit that carries risk and value is the interaction: who sent what, to which tool, for which task. A note-taking app with two users and a spike in data-processing prompts is a bigger exposure than a writing assistant with two hundred users drafting emails. The Olakai Shadow AI overview charts interaction volume by app and by task category precisely because a jump in “Analysis” or “Data Processing” is a stronger sensitive-data signal than the same jump in “Writing”. Measure the stream, and the catalog becomes a by-product rather than the goal.

2. Trusting what people tell you

Surveys are cheap, fast, and the only instrument many organizations had when the question first came up. They are also systematically low. A University of Chicago study presented at CHI 2026 asked the same population two questions: do you use AI, and do your peers? About 60% admitted to their own use while estimating 90% for everyone else. The subjects were students, not employees, and the gap is worth stating with that caveat. But the mechanism the authors identified, social desirability bias driven by concern about looking less competent, is not a student phenomenon. Ask a finance team whether they paste figures into a free chatbot and you will get the compliant answer, not the true one.

The fix is to replace the questionnaire with telemetry. Usage captured at the point it happens, in the browser, at the API, or in the developer’s terminal, does not have a social-desirability problem. It also does not need to be repeated every quarter. Self-reporting still has a place for understanding why people chose a tool, but it should never be the number that goes to the board.

3. Declaring victory after buying the sanctioned tool

Procuring an enterprise copilot is the right move, and it is also the moment many programs stop looking. The assumption is that once a sanctioned tool exists, the unsanctioned ones fade. The telemetry says otherwise. LayerX’s 2026 usage report found that 14.39% of AI conversations conducted under a corporate identity still ran through personal licenses, and Cyberhaven put personal-account usage of ChatGPT at 32.3% and Gemini at 24.9%, inside companies that in many cases had already bought the enterprise edition. People keep the side tool because it is better for a specific task, or because it was already open, or because the licensed one is locked behind a request form.

The sanctioned purchase is the beginning of a measurement problem, not the end of one. You now need to know how many of the seats you paid for are idle, which teams kept the alternative, and what they are doing in it. Olakai Assistive puts the licensed tool and the shadow tool in the same catalog, with seat counts and per-seat cost against actual usage, so the question “did the purchase work” has an answer other than the invoice.

4. Running a snapshot instead of a stream

A one-time AI visibility audit is a good first act. Treating it as the finished product is the mistake, because the inventory is accurate for roughly as long as it takes someone to sign up for something new. Verizon’s 2026 Data Breach Investigations Report recorded the share of workers using AI on corporate devices tripling from 15% to 45% in a single year. An audit from last spring describes a company that no longer exists.

Continuous detection changes the shape of the work. Instead of a project that ends with a slide deck, you get a queue: newly detected apps land in review, someone classifies them as authorized, monitored, or unauthorized, and the alerts fire on the unauthorized ones from then on. The review queue is never empty, and that is the point. It is the difference between knowing what your organization used and knowing what it is using.

5. Never reading the terms

Most shadow AI risk discussions focus on what an employee might paste. Far fewer look at what the vendor is allowed to do with it afterwards, and the answer sits in plain sight in the terms of service. Anthropic’s consumer terms, updated in August 2025, allow training on Free, Pro, and Max account data when the setting is on, and extend retention to five years for those who allow it. Google’s Gemini privacy notice says a subset of chats are reviewed by human reviewers, that reviewed chats are kept for up to three years even after a user deletes their activity, and, in its own words, “please don’t enter confidential information that you wouldn’t want a reviewer to see.” None of this is hidden. It is simply never read by the person signing up with a work email on a Tuesday afternoon.

Those are the consumer tiers of two of the most responsible vendors in the market. The long tail of 3,400 tools includes far looser terms on data retention, third-party sharing, and who owns the output. This is the layer of shadow AI risk that is contractual rather than technical, and it is why Olakai generates an EULA Risk Assessment for every detected app, scoring its terms across AI training, content license, data retention, third-party sharing, and IP ownership, with the source excerpt attached so a reviewer can read the clause instead of trusting the score.

6. Governing people instead of data

When a policy is written in a hurry, it tends to name users and tools: marketing may use this, engineering may not use that. It is understandable, because people and tools are what you can see. But the bank in the opening did not have a people problem or a tool problem. It had Social Security numbers in a place they should never have been, and that would have been true whichever employee and whichever application were involved. LayerX found that around 6% of enterprise AI conversations contain sensitive data. A blanket ban on a team or a tool mistargets the other 94%, and misses the 6% that moves to a tool you have not banned yet.

Governance that follows the data is tool-agnostic by construction. A rule that flags a prompt containing PII, PHI, a credential, or source code applies equally to the sanctioned copilot and to the app discovered yesterday, which is what makes it durable. That is how Olakai’s sensitivity detection works: it reads what leaves the organization, validates structured data like card numbers and national IDs, and flags interactions by what they contain rather than by who sent them. The employee-facing acceptable-use policy still matters, but it rides on top of data rules rather than replacing them.

7. Assuming the browser is the whole story

Browser-level visibility is where every serious shadow AI program should start, because that is where most assistive AI use happens, and Olakai’s own Assistive product is built on a browser extension for that reason. The mistake is assuming it is where the story ends. A growing share of AI activity never opens a tab. Browser extensions themselves are AI tools now, and LayerX’s 2026 extension report found roughly one in six enterprise users already running at least one, with AI extensions 60% more likely than others to carry a known vulnerability. Developers call model APIs directly from code and agents. GitGuardian’s 2026 secrets report counted 1.27 million leaked AI-service credentials, up 81% in a year, including 24,000 exposed in MCP configuration files. Each of those keys is an AI integration that no browser monitor will ever see. The unknown agents enterprises keep discovering in their environments are the same problem at larger scale.

Browser detection is necessary, not sufficient. Coverage has to extend to the API, the repository, and the SDK, which is what Olakai Agentic does for coding tools and autonomous agents, so that an engineer’s Claude Code session and a marketer’s ChatGPT tab show up in the same system of record. A program that watches only one of those surfaces is measuring the half of shadow AI that is easiest to see.

None of these are failures of intelligence

Every mistake on this list was the sensible move at the time it was made. Surveys were the only data. Blocking was the only lever. Counting apps was the only report anyone could produce. The organizations getting this right in 2026 are not smarter; they have simply swapped assumptions for measurement, one by one, and found that governance built on an interaction-level, continuous, data-centric view of AI use is both stricter where it matters and more permissive everywhere else. For a CISO, that is the version of shadow AI governance that survives contact with a regulator, and the version that would have kept a Pennsylvania bank out of the 8-K archive.

Which of the seven is your program making? Talk to an expert and we will show you, against your own environment, what interaction-level shadow AI visibility looks like across browsers, APIs, and agents.

Think about what an AI governance platform actually collects. Every prompt an employee typed into ChatGPT. The contract an analyst pasted into Claude for a summary. The customer list someone dropped into a spreadsheet copilot. Which department exposed patient data last Tuesday, and who in that department did it. Cyberhaven Labs‘ 2026 AI Adoption & Risk Report found that 39.7% of AI interactions expose sensitive data, and that the average employee sends sensitive information into an AI tool roughly once every three days. A platform that watches all of that is not a dashboard. It is the most complete inventory of confidential material your company has ever assembled in one place.

So here is the question security teams started asking us in 2025, and have not stopped asking: where does that inventory live? If the answer is “in the vendor’s multi-tenant cloud,” you have addressed shadow AI by creating a second copy of everything shadow AI exposed, outside your perimeter, under someone else’s retention policy. That is not a hypothetical worry. Samsung banned generative AI tools for staff in May 2023 after engineers pasted source code and chip yield data into ChatGPT, and JPMorgan, Goldman Sachs and Apple restricted them the same spring. Companies that learned that lesson about AI tools will not unlearn it for the tool that monitors the AI tools.

The market has already moved

The infrastructure data points the same direction. In a February 2026 survey of 203 enterprise IT decision-makers commissioned by Cloudian, 91% said they would choose on-premises, private cloud or hybrid infrastructure over public cloud for AI that touches sensitive company data. Fifty-eight percent said data-residency concerns had directly delayed or scaled back an AI initiative, and 74% rated shadow AI a critical or significant security concern. Broadcom’s Private Cloud Outlook 2026, with a larger sample of 1,800 senior IT leaders across three continents, found that public cloud’s share of production AI inference fell from 56% to 41% in a single year. And Gartner forecasts sovereign cloud infrastructure spending of $80 billion in 2026, up 35.6% in a year.

Two of those three are vendor-commissioned surveys, so treat the exact percentages with caution. The direction is not in doubt, and it matches what we hear in every regulated-industry conversation: the buyer has already decided that the model, the data and the governance layer will all sit inside their boundary. The only open question is which vendors can meet them there. That buyer is who Olakai Enterprise was built for.

Regulated industries do not get a vote

For some of our customers, on-prem is not a preference to be weighed against convenience. A bank operating under SR 11-7 and data-residency mandates cannot send AI interaction logs through a third-party cloud to govern its AI. A health system cannot route clinical notes containing PHI through a vendor’s servers to find out whether a clinician pasted them into a chatbot. A law firm’s client confidentiality obligations do not carve out an exception for the compliance tooling. A manufacturer’s OT environment under IEC 62443 is not connected to the internet at all. In each case the SaaS answer ends the procurement conversation, and since the EU AI Act’s high-risk obligations became enforceable on August 2, 2026, with a six-month minimum on event logs and penalties up to 7% of global revenue, European buyers have one more reason to want those logs on infrastructure they control.

We see this in our own search traffic. One query that landed on our healthcare page this quarter read, almost word for word: every AI vendor we shortlist wants a copy of our claims data, so which platforms deploy into our own environment and leave the data where it is? That sentence is the entire brief.

How Olakai on-prem actually works

Olakai on-prem is the full platform, not a thin agent that phones home for the real work. Our install guide describes it plainly: the bundle “runs the entire platform — app, database, object storage, queue, and background jobs — on a single Linux VM via Docker Compose.” A one-command installer exchanges your license key for a signed bundle, verifies the signature before anything is extracted, generates every secret, brings the stack up behind an automatic HTTPS reverse proxy, and emails your first administrator a magic link to set a password. The guide’s own estimate is that “a complete install takes about 3–5 minutes once your DNS record and ports are in place.” The VM can live in your data center or in your own AWS, Azure or GCP account; Ubuntu, Debian, RHEL, Oracle Linux and Amazon Linux are supported, on Docker or rootless Podman.

Sizing is driven by how many people and coding agents you monitor and how long you keep the data, not by raw compute. The bundle ships its own Postgres, Redis and object store, and you can point it at managed instances you already run instead.

Deployment	Monitored users	vCPU	RAM	Data disk
Pilot	up to ~250	4	16 GB	200 GB
Standard	~250 to 1,500	8	32 GB	500 GB
Large	1,500 to 3,000+	8	32 to 64 GB	500 GB to 1 TB

Where the analysis runs is your call

This is the part security reviewers care about most. Olakai reads each captured interaction with a language model to detect sensitive content, classify it and score it. On SaaS, Olakai’s hosted models do that. On-prem, you decide where the model runs, and you decide it separately for each kind of analysis: sensitive-content detection, classification, advanced analytics and session scoring are routed independently. You can point any of them at Anthropic, OpenAI or Google under your own API key, in which case the prompt text goes to that provider over an encrypted connection and, as the docs put it, “Olakai is not in the path and never receives the content.” Or you can point them at an OpenAI-compatible inference server inside your own network, running vLLM or Ollama, where the answer to “what leaves your network” is a single word: nothing. A fallback never crosses the boundary you set: if your in-network model is unavailable, Olakai waits rather than quietly sending the content to a cloud provider.

The pattern we see most from regulated customers is a split: keep sensitive-content detection and classification in-network, because that is where regulated text is actually read, and leave the heavier analytics and session scoring with a provider, because that is where frontier model quality is worth the most. If you have been running the build-or-buy arithmetic on hosting your own model, this is where it pays off: a 30-billion-parameter open model is more than enough to tell a social security number from a sprint retro.

Beyond the model you choose, the deployment does not talk to Olakai’s product infrastructure. The network allowlist states that app.olakai.ai and Olakai’s own product hosts “are never contacted from an on-prem deployment. There is no Stripe, Google Analytics or PostHog traffic.” Fully air-gapped installs are supported by mirroring the images to an internal registry and carrying the bundle across by hand. Everything else is the same product: both Olakai Assistive and Olakai Agentic, the integrations, OIDC single sign-on with Okta, Entra ID or Google Workspace, retention windows from 14 days to forever, and the control that makes a second administrator approve any viewing of prompt content, with every view logged. On-prem deployments also carry no usage limits.

This is about more than a compliance checkbox

It is tempting to file on-prem under “things regulated industries make us do.” That undersells it. Olakai’s whole premise is to be the vendor-neutral system of record for the entire AI stack: the one place where ChatGPT usage, Copilot seats, Claude Code spend and autonomous agent runs are measured against the same business outcomes and governed under the same policies. A system of record for your AI program is, by definition, the richest dataset about how your company works that has ever existed, and treating its location as an afterthought would contradict everything the product stands for. To our knowledge, Olakai is the only platform that combines AI ROI measurement with governance and will run entirely inside the customer’s boundary; most tools in this category are SaaS-only, and the ones that do self-host stop at compliance checklists.

For a CISO, that means shadow AI discovery, policy enforcement and the audit trail live on infrastructure the security team already controls, with no new subprocessor on the data map. For a CFO, it means the ROI and spend numbers the board asks for come from a system finance can trust precisely because the data never had to leave to be analyzed. The shadow AI statistics are not getting better on their own, and the regulatory calendar is not getting lighter. The choice is between measuring and governing AI from inside your walls now, or explaining later why the tool meant to stop data leaving the building was itself sending data out of the building.

Getting started

Most teams begin on SaaS, where the Starter tier is free; it runs on AWS with a completed SOC 2 Type II examination covering the Security criteria, with the report available under NDA. When a security policy, a regulator or a customer contract says the governance layer has to sit inside your perimeter, Olakai Enterprise adds the on-prem bundle with custom SLAs and dedicated support, and our team walks your infrastructure group through the install and the model-routing decisions before anything is provisioned. The short version of the deployment options is summarized here; the long version is a conversation.

Ready to see Olakai running where your data already lives? Talk to an expert about an on-prem deployment.

On July 22, 2026, at 18:00 CEST, the window closes for AI providers to sign the EU’s Code of Practice on Transparency of AI-Generated Content. Eleven days later, on August 2, 2026, the obligations that Code was written to help with become enforceable anyway — whether a company signed or not. Article 50 disclosure requirements for chatbots and deepfakes go live, and the AI Office’s supervisory and fining powers over general-purpose AI providers activate. Fines reach €15 million or 3% of global annual turnover, whichever is greater. Most enterprise AI programs currently treat compliance as a project with a deadline. This one doesn’t have a deadline anymore. It has a start date.

There’s a genuine amount of confusion circulating about which date matters and why, largely because two unrelated EU processes are landing in the same news cycle. It’s worth separating them, because they point enterprises toward very different actions.

Two dates, two different clocks

The first clock is the Code of Practice on Transparency of AI-Generated Content, and it closes July 22. Signing isn’t mandatory, but it isn’t free to skip either: signatories get a presumption of conformity with the transparency rules, which shifts the burden of proof onto regulators to show non-compliance rather than onto the company to prove compliance. Enterprises deploying assistive AI at scale — chat interfaces, generative content tools, customer-facing copilots — have a real decision to make here about whether that presumption is worth the commitment.

The second clock, and the one that actually matters regardless of what anyone signs, is Article 50, enforceable August 2, 2026. It requires that anyone deploying a chatbot or similar conversational AI disclose “you are talking to an AI” at the start of the interaction, in plain and accessible language, and that synthetic or deepfake content be labeled as such. This isn’t a footnote requirement. It touches every customer-facing assistive AI deployment an enterprise runs, and the general penalty ceiling under Article 99 — that same €15 million or 3% of global turnover — applies to non-compliance. The same date activates the AI Office’s supervisory and fining authority over general-purpose AI (GPAI) model providers. GPAI providers have technically been obligated since August 2025; what changes August 2 is that Brussels can now actually enforce it, and models released before that original date get until August 2027 to fully catch up. See the Commission’s own GPAI provider guidelines for the underlying obligations.

A third, entirely separate development has muddied the water further. The Digital Omnibus, which received final Council approval on June 29, 2026, defers high-risk AI system obligations out to December 2027. That’s a real and meaningful delay — but it applies to a different category of the Act. It does nothing to the Article 50 disclosure requirement or the GPAI enforcement powers landing August 2. If your compliance plan assumes the Omnibus bought you more runway on chatbot disclosure, it didn’t. Worth reading the actual Council press release rather than the secondhand summary making the rounds, because conflating these two threads is exactly how enterprises end up caught flat-footed on the wrong deadline.

Why “we’ll handle it before August 2” is the wrong plan

The instinct in a lot of legal and compliance teams right now is to treat this as a sprint: audit the chatbots, add a disclosure banner, check the box, move on. That instinct misses what regulators are actually going to ask for, which isn’t a banner — it’s evidence. Evidence that disclosure happened consistently, across every deployment, every time, not just on the interfaces someone remembered to check. Evidence that synthetic content got labeled before it shipped, not after a complaint. Evidence that policy enforcement is a standing, monitored practice rather than a one-time remediation before a known date. A disclosure banner added in July satisfies an audit that happens in July. It does not satisfy the audit that happens in October, after the banner quietly disappeared during a redesign nobody flagged.

This is the structural problem with treating AI governance as a bolt-on project instead of an operating discipline. Enterprises running dozens of chatbots, copilots, and AI-enabled tools across departments can’t manually audit each one before a deadline and call it done — new tools get added, existing ones get reconfigured, and shadow AI keeps showing up in places IT never approved. Our own research into shadow AI statistics shows just how much AI usage exists entirely outside sanctioned channels, which means it’s also outside whatever disclosure and labeling controls a compliance team thinks they’ve implemented. You can’t put a disclosure banner on a tool you don’t know is running.

What actually holds up under regulatory scrutiny is a standing measurement layer — one that knows what AI tools are in use, whether disclosure requirements are being met at the point of interaction, and can produce an audit trail on demand instead of reconstructing one under pressure. This is precisely the gap Olakai was built to close. Olakai Assistive gives enterprises visibility into every chatbot, copilot, and employee-facing AI tool in use — including the shadow AI that never went through procurement — with governance and DLP controls built in as a Key Feature, not an afterthought. For engineering organizations, Olakai Agentic extends the same governance discipline to autonomous agents and AI coding tools, where disclosure and audit obligations are increasingly following the same logic as chatbot transparency rules. Both products are part of a single, vendor-neutral Enterprise AI Intelligence Platform, which matters here specifically because Article 50 and GPAI enforcement don’t stop at your own tooling — they extend to the vendor chain. If a third-party model provider embedded in your stack can’t demonstrate compliance, that exposure becomes yours too, and a governance approach that only covers tools your team built directly will miss it.

What CISOs should actually be doing this month

For security and compliance leaders, the practical sequence is straightforward even if the underlying work isn’t trivial. First, get a real inventory of every AI interface employees or customers touch, sanctioned and unsanctioned, because Article 50 doesn’t care whether IT approved the tool. Second, decide on the Code of Practice question before July 22 — sign for the presumption of conformity, or accept the higher evidentiary bar of proving compliance without it. Third, and most important, stop treating August 2 as a finish line. It’s the day enforcement starts, not the day the work ends; disclosure and labeling have to be continuously monitored and continuously provable, month over month, not demonstrated once and forgotten. Our CISO governance checklist walks through the broader set of controls this requires, and our CISO use case page covers how policy enforcement and audit-ready evidence get built into day-to-day operations rather than bolted on before a deadline.

The enterprises that treat August 2 as a governance maturity milestone — not a scramble — will be the ones who can answer a regulator’s questions in minutes instead of weeks. The ones still assembling their evidence trail after the fact will find that a banner slapped on in July doesn’t hold up to an audit in Q4. If your AI governance is still a spreadsheet and a promise, now is the time to change that.

“We have a Shadow AI problem” is a sentence a CISO says a lot and rarely means precisely. It could mean dozens of unclassified tools nobody’s looked at in a month, or it could mean three specific employees pasting client data into an unapproved chatbot right now. Those are different emergencies requiring different responses, and treating them as one vague problem is how real incidents sit unnoticed inside a 30-day summary chart. Olakai’s Shadow AI module inside Olakai Assistive is built around exactly that distinction: three tabs, answering three different questions, on purpose.

As the product’s own framing puts it: Shadow AI is the AI usage your IT and security teams don’t know about. Until an app is classified, there’s no way to enforce policy, attribute cost, or flag sensitive-data exfiltration against it. Everything below exists to turn unknown, unclassified usage into something a security team can actually act on.

Overview: the 30-day triage workspace

The Overview tab is where a security team starts the day. It’s split into four secondary filters — All, Authorized, In Review, and Unauthorized — each carrying a count badge, and the intended workflow is explicit: start in All to see the whole picture, then treat In Review as the actual day-to-day work queue, since those are the apps still waiting on a classification decision. Two headline cards frame the exposure at a glance: Shadow AI Risk, the percentage of detected apps rated medium or high risk, and Shadow AI Apps, a breakdown of how many are OK, Not OK, or still Under Review.

The apps table underneath isn’t a static report — it’s editable in place. Status, risk rating, and an Advanced Monitoring toggle can all be changed directly from the row, which is what makes this the actual triage surface rather than a read-only summary someone screenshots into a slide. One detail worth knowing before trusting the defaults blindly: Advanced Monitoring is on by default for newly detected apps, but any app detected before that default existed keeps whatever setting it already had — worth an explicit check on older entries rather than an assumption that everything’s covered.

Alerts: what’s happening right now, not last month

Overview answers what’s happening over a 30-day window. Alerts answers what’s happening right now — a live feed showing only apps currently marked Under Review or Blocked, deliberately excluding anything already approved so the feed doesn’t fill up with resolved, harmless activity. It covers the last 7 days and auto-refreshes every 10 seconds. This is the view to keep open when a new tool is spreading fast or a sensitive interaction might be happening in real time, not the 30-day chart that would only show that spike days later.

A second chart on the Alerts tab segments current activity by app category — Productivity, Communication, Coding, Data, and similar buckets — and the category itself is a useful triage signal on its own. A spike in Data or Communication apps generally warrants faster investigation than the same-sized spike in Productivity tools, simply because the surface area for sensitive-data exfiltration is larger in the former. When a chart spike does grab attention, the activity table underneath lets a security team identify the specific early adopters of a new tool — usually a faster and less heavy-handed move than a broadcast policy announcement, and one that tells you why the tool was being used in the first place, which often determines whether the right response is authorizing it, licensing it, or blocking it outright.

Policy Compliance: the audit-ready evidence trail

The third tab is where Shadow AI governance turns into something an auditor can actually verify. Acceptance is captured entirely through the Olakai browser extension — the first time an employee visits a covered app, the policy appears in-page, no separate Olakai login required. One acknowledgment is recorded per employee, per policy, per app, so a policy covering ChatGPT, Claude, and Gemini gets acknowledged separately for each one an employee actually visits, not once for all three.

The versioning behavior is the sharpest, most defensible part of the mechanism: a policy cell only shows green when every recorded acceptance is on the current published version. Publish a revised policy, and previously-green cells turn amber until each affected employee re-accepts the new version, app by app — nothing quietly stays marked compliant against an outdated policy text. And “applicable” is precisely scoped rather than blanket: a global policy applies to everyone, but an app-specific policy only applies to an employee who has actually used that app, ever. Someone who’s never opened ChatGPT isn’t behind on a ChatGPT policy, and an employee with zero applicable policies counts as compliant by default because there’s nothing for them to acknowledge. That precision is exactly what a security reviewer wants to see, and exactly what a cruder “did they click accept” tracker can’t give you.

Why three tabs beats one dashboard

The reason this is three separate views instead of one combined Shadow AI dashboard is that “what’s out there,” “what’s happening right now,” and “who has agreed to use it responsibly” are three genuinely different questions with three different urgencies. Compliance-focused AI governance platforms tend to stop at the third question — policy status, audit trail, nothing tied to real usage, which is why Shadow AI keeps showing up as a governance crisis in survey after survey. Olakai’s Shadow AI module answers all three from the same underlying detection data, which is what “govern without blocking” looks like in practice: triage and classify first, escalate to blocking only when the evidence actually supports it.

Classification decisions on this table don’t have to happen one click at a time, either — Kai can approve, block, or re-risk-rate apps conversationally, including in bulk, with every change surfaced for approval first. None of this requires manually chasing spreadsheets or waiting for a quarterly audit to find out what employees are actually using. Talk to an Expert to see what Olakai’s Shadow AI detection turns up inside your own organization.

Last year, one in five organizations was breached because of shadow AI. The average tab came to $4.63 million, roughly $670,000 more than a conventional incident. The detail that should keep security leaders up at night is not the dollar figure, though. It is that 97% of the breached organizations lacked basic AI access controls, according to IBM’s 2025 Cost of a Data Breach Report. Not because their security teams were careless, but because you cannot put a control around a tool you do not know exists.

That is the real shape of the shadow AI problem in 2026. It is not a story about a few reckless employees pasting customer data into a chatbot. It is a story about visibility, and the uncomfortable truth that most enterprises have almost none of it over the AI their own people use every day. The statistics that landed this spring make the scale hard to wave away, and harder still to govern with the policy-first playbooks most companies are reaching for.

The scale is bigger than most security teams know

Start with adoption, because that is where the gap begins. UpGuard’s late-2025 research found that 81% of employees and 88% of security leaders admit to using unapproved AI tools, which means the people writing the policies are breaking them too. Netskope’s data puts a sharper edge on it: 47% of enterprise generative-AI usage now flows through personal, unmanaged accounts, entirely outside corporate data controls, and the average organization logs 223 AI-related data-policy violations every month, a figure that doubled in a year.

Layer those findings on top of one another and shadow AI stops looking like an edge case and starts looking like the default operating state of the modern enterprise. Employees adopted AI faster than IT could catalog it, faster than security could vet it, and far faster than legal could write rules for it. The result is a sprawling, invisible layer of AI activity that no single dashboard captures, which is exactly the visibility gap we examined in our deeper look at shadow AI as an enterprise risk. The first step toward governing any of it is simply seeing it, and most organizations cannot.

It is not just chatbots anymore

If unmanaged chatbots were the whole problem, it would be serious but bounded. The 2026 escalation is that shadow AI has grown agents. A Cloud Security Alliance survey released in April found that 82% of enterprises had discovered previously unknown AI agents running inside their environments in the past year, and 41% had found them more than once. These are not browser tabs. They are autonomous workflows holding API credentials, reading from production systems, and taking actions without a human approving each step.

The risk class is fundamentally different. A rogue ChatGPT session is recoverable and largely contained to whatever a person chose to paste into it. An unknown agent with standing access to your finance or HR systems is a far larger exposure, and most governance tooling built for the assistive era simply cannot see it. Watching the browser layer was never going to be enough once AI started acting on its own behalf, which is why monitoring autonomous agents has to be part of the same system of record as everything else, not a separate tool bolted on after the first incident. You cannot govern an agent you have never met.

Why policies always lag the tools

Faced with these numbers, the instinct is to write a policy. Most companies have, and most policies are not working. Gartner found that 69% of cybersecurity leaders either suspect or have confirmed that employees are using prohibited AI tools, and IBM’s data shows only 37% of organizations have any approval process or oversight mechanism for AI in the first place. Protiviti’s 2026 survey put the share of companies with a formal AI governance framework at just 41%. The policies exist on paper at a fraction of companies, and even where they exist, they describe a world the organization cannot actually observe.

This is the core failure, and it is a sequencing failure more than a willpower one. Policy-first governance assumes you already know your inventory, that you can name the tools, the users, and the data flows you intend to regulate. Shadow AI breaks that assumption at the foundation. Until you can answer what AI is running, where, by whom, and against which data, every rule you write is aspirational. Olakai was built on the opposite sequence: complete visibility across the AI stack first, governance second, because measurement is not a precondition for governing AI usage so much as it is the substance of it. The companies treating shadow AI as a demand signal rather than only a threat are the ones discovering which tools their people actually find valuable, then bringing them into the light instead of driving them further underground.

The market is already responding

None of this is lost on the analysts who advise enterprise budgets. Gartner forecasts that enterprise spending on AI governance platforms will reach $492 million in 2026 and surpass a billion dollars by 2030, driven by AI regulation expanding to cover three quarters of the world’s economies. Gartner also predicts that 40% of enterprises will suffer a shadow AI security incident by the end of the decade. The market has effectively priced in the problem. The open question is whether your organization gets ahead of it or becomes one of the case studies that justifies everyone else’s budget.

For the CISO, that reframes the conversation from defensive to strategic. The point of investing now is not to bolt locks onto a problem after the breach, but to build the visibility that makes every later decision, every policy, every control, enforceable rather than theoretical. That is the case we lay out in detail for security leaders in our guide to AI governance for CISOs, and it starts from the same premise as everything else here: see first, then govern.

Start with what you can see

The shadow AI statistics of 2026 are alarming, but they point to a clear and unglamorous first move. Before the next policy memo, before the next vendor demo, before the next acceptable-use training that 81% of people will ignore anyway, build a complete inventory of the AI your organization is actually running. Assistive tools, coding tools, and autonomous agents all belong in the same picture, because the gaps between them are precisely where the breaches happen. A governance program that begins with measurement is durable. One that begins with policy, against an inventory you cannot see, is theater. The 30-page governance checklist only works once you know what you are governing.

You can’t govern what you can’t see. Talk to an expert to see how Olakai gives you a complete, vendor-neutral inventory of every AI tool and agent in your enterprise, so your governance starts from evidence instead of guesswork.

Here’s a scenario we’ve watched play out more than once. A CIO asks his team a simple question: how many AI tools are we paying for right now? He gets a clean answer, a few dozen on the procurement list, with a combined spend that’s easy to defend in a board meeting. Then his company deploys a browser extension across the organization. Within 48 hours, the real answer arrives. Not dozens. Hundreds. Most of them free, most of them nowhere near the procurement list, and almost none of them visible to the security team.

That gap between what leadership knows about and what employees actually use is the shadow AI problem. Most conversations about it focus on the threat, and the threat is real. But there’s another side of shadow AI that almost nobody talks about, and it’s the reason the CIO in that story spent the next month rethinking his entire AI procurement strategy. Shadow AI is the most honest data you have about what your teams actually want from AI. Used right, it’s a procurement gift wrapped in a security wrapper.

The number that should worry you (and also excite you)

Across the enterprise deployments we’ve analyzed, roughly 60% of AI usage happens outside IT-sanctioned channels. Employees paste customer data into free ChatGPT tabs, upload financial models to AI summarizers they found on Product Hunt, and run code through coding assistants the CAIO has never heard of. The security risk is obvious. What gets less airtime is what that 60% is telling you about your workforce. Six out of every ten AI interactions happening in your company right now represent a demand signal, an employee who needed a tool badly enough to go find one, bypass procurement, and keep using it until it became habit. That isn’t only a risk. It’s research.

Prohibition has never worked

Every security team’s first instinct, when they see the shadow AI scale for the first time, is to ban it. Block the URLs. Rewrite the acceptable use policy. Send a firmwide email. We’ve watched this happen a dozen times, and the result is always the same. Employees route around the block. They switch to mobile devices. They email documents to personal accounts and run them through free tools at home. They find three alternatives for every one you block, because the tools genuinely help them work faster, and no policy has ever beaten a productivity gain you can feel within an hour.

The answer is not prohibition. It’s visibility and governance. You need to know what is being used, by whom, with what data, and whether it complies with your policies. Then you need to decide, tool by tool, whether to sanction it, route it through an approved version, or block it with a replacement in hand. That’s governance. Prohibition is policy theater.

What shadow AI is actually telling you

Here’s the part of the conversation nobody has. Your sanctioned AI stack tells you what your leadership team decided. Shadow AI tells you what your people reached for when nothing was stopping them. That second data set is almost always more useful than the first.

When you can see every AI tool in use across the organization, ranked by department, frequency, and data sensitivity, you start noticing patterns that rewrite your procurement plan. The $40,000-a-year tool legal bought in Q2 has less weekly usage than a free alternative two analysts discovered on their own. Marketing adopted a writing assistant that nobody approved, and campaign velocity has quietly doubled. Finance is using three different AI tools that overlap almost completely, a consolidation opportunity that pays for itself in a month. Shadow AI isn’t a failure of policy. It’s a heat map of real demand.

This is the reframe that changes the budget conversation. McKinsey’s State of AI has tracked enterprise AI adoption climbing faster than any other software category in a decade, but almost every organization we talk to can’t tell you where the value inside that adoption is actually landing. Shadow AI is where a lot of that value is landing, and it’s where most of the buying signals you’re missing already live.

What Olakai does about it

We built Olakai’s shadow AI capability around three steps: discover, govern, and report. Discovery starts with a lightweight browser extension that identifies over 600 AI tools the moment an employee starts using one. It doesn’t require SSO integration, it doesn’t require expense report reconciliation, and it catches the tools that would never show up in either. Within days, you have a complete inventory of every AI tool your organization is actually using, mapped to departments, users, and usage patterns.

Governance is where the threat and the opportunity both get resolved. Olakai ranks each tool by risk surface: which ones are processing PII, which departments are most exposed, which specific prompts contain sensitive data. You set policies once, and they enforce automatically. Real-time data loss prevention catches regulated data before it leaves the building. Approved tools keep running. High-risk ones get blocked with a replacement suggested in the same breath. Your security team stops playing whack-a-mole and starts making decisions backed by real usage data.

Reporting closes the loop. Every interaction, every tool, every policy decision becomes an audit trail you can export for compliance reviews. When an auditor asks what AI tools your finance team used in Q3, you don’t send an IT admin to pull logs from five different admin consoles. You export one report.

The part your CFO will actually care about

This is the piece of the shadow AI conversation that usually gets left out, and it’s the piece that pays for the platform in the first quarter. Every AI tool you’re sanctioning charges by the seat. Every enterprise over-provisions. Assistive IQ shows you exactly which licenses are sitting idle, by tool, by team, by user, and gives you a precise reclaim list you can hand to procurement before the next renewal cycle.

Look at the screenshot above for a minute. It’s a real view from an Assistive IQ deployment. Total monthly licensed AI spend: $8,892. Wasted spend on unused seats: $5,962. That’s 67% of the AI budget earning nothing, and it’s not an outlier. Some tools are running over capacity (Anthropic at 185% utilization, Figma AI at 104%, both strong signals to buy more seats or renegotiate). Others are drastically under (Jasper at 30%, Grammarly at 41%, both candidates for reclaim or consolidation). The same single view tells procurement where to buy more, where to cut, and where to do neither.

Now overlay that with the shadow AI data. The tools your people are reaching for on their own, that you aren’t paying for, are frequently the ones quietly delivering the most value. Meanwhile the licensed tools sitting at 30% utilization are the ones you’re defending in a budget review. That isn’t a failure of the employees. It’s a failure of visibility. When you can see both sides at once, the licensed spend that isn’t earning its keep and the shadow usage that represents real demand, procurement stops guessing. You reallocate budget from the dead seats to the tools your team is actually using, and you do it with numbers your CFO will accept.

Why this exercise matters right now

Every enterprise we talk to is sitting at some version of the same moment. AI spending has ramped faster than any other software category in a decade. Boards are asking for ROI numbers with a patience that’s running out. Regulators are writing compliance frameworks that will require audit-ready AI usage logs. Meanwhile, the people actually using AI in your company are miles ahead of the procurement process that’s supposed to govern them. The gap between those two things is growing by the week, and it’s becoming the single biggest source of hidden risk and hidden opportunity in enterprise IT.

Companies that close the gap this year will have a cleaner compliance story, a leaner AI budget, and a better read on which AI tools are actually working than their competitors. Companies that don’t will spend 2026 explaining what they don’t know about AI to boards that assumed they already knew it. The exercise of actually surfacing shadow AI, governing it, and feeding the data back into procurement is one of the highest-leverage things a CIO, CISO, or CFO can do in the next 90 days.

Your next step

Shadow AI isn’t going away. It’s the shape enterprise AI adoption takes before governance catches up. You can treat it as a threat and spend the next year trying to suppress it, or you can treat it as the most honest data you’ve ever had about how your people actually work, make procurement and governance decisions from that data, and turn the whole thing into an advantage.

If you want to see what shadow AI looks like inside your own organization, talk to an expert. We’ll show you what 48 hours of browser-level visibility reveals, and we’ll walk you through how the threat and the opportunity get resolved at the same time.

Three out of four organizations say shadow AI is a problem. One in three doesn’t know whether they’ve already been breached because of it.

Those numbers come from the HiddenLayer 2026 AI Threat Landscape Report, released this month, which surveyed 250 IT and security leaders. The headline finding: 76% of organizations now cite shadow AI as a definite or probable problem. That’s up from 61% last year — a 15-point jump that represents one of the largest shifts in the dataset. And 31% of organizations don’t know whether they experienced an AI security breach in the past 12 months. Not “haven’t been breached.” Don’t know.

Shadow AI isn’t stabilizing. It’s accelerating.

What Changed in Twelve Months

The 15-point jump from 61% to 76% didn’t happen because security teams got worse at their jobs. It happened because AI tools proliferated faster than governance could follow.

In 2025, the AI coding tool market exploded. Cursor crossed $2 billion in annualized revenue. Claude Code hit $2.5 billion. GitHub Copilot remained embedded across enterprise engineering teams. Beyond development, ChatGPT, Gemini, Claude, and dozens of specialized AI tools became standard productivity enhancers for marketing teams, sales organizations, customer success groups, and finance departments. Each one represents a potential vector for unauthorized data flow.

The math is simple. More AI tools available means more tools employees will adopt without waiting for IT to evaluate, approve, and provision them. According to the 2025 State of Shadow AI Report, the average enterprise hosts 1,200 unauthorized applications. Nearly half of employees using generative AI platforms do so through personal accounts that companies can’t see or govern.

And the data exposure isn’t hypothetical. IBM’s 2025 Cost of a Data Breach Report found that one in five organizations reported a breach due to shadow AI, with those breaches costing $4.63 million on average — $670,000 more than standard breaches. Only 37% of organizations have policies to manage AI or detect shadow AI usage. The other 63% are flying blind.

Why Banning Doesn’t Work — and What Does

Every CISO who has tried to block AI tool access has learned the same lesson that IT leaders learned with Dropbox and Slack a decade ago: prohibition doesn’t eliminate usage. It eliminates visibility.

Employees route around restrictions because AI tools make them measurably more productive. The sales rep who uses AI to draft responses closes more deals. The developer who uses an AI coding assistant ships features faster. The analyst who uses AI for research produces better work in less time. Telling them to stop isn’t a governance strategy — it’s a talent retention risk.

The data backs this up. According to the 2026 CISO AI Risk Report from Saviynt, which surveyed 235 CISOs at large enterprises, 75% have already discovered unsanctioned AI tools running in production environments — and another 16% aren’t sure. Shadow AI ranked as CISOs’ number one risk concern, ahead of traditional threats like phishing and ransomware. Yet only 37% of organizations have policies to manage AI usage or detect shadow AI, according to IBM.

The answer isn’t better firewalls. It’s better alternatives. When organizations provide governed AI tools that meet the same needs employees are solving with shadow tools, unauthorized usage becomes unnecessary — not just prohibited. The problem isn’t employees wanting to use AI. The problem is organizations not giving them a governed way to do it.

The Costs You Can’t See

The financial cost of shadow AI breaches is quantifiable — $4.63 million per incident, according to IBM. But the costs that accumulate before a breach are harder to measure and potentially larger.

Data leakage at scale. When employees paste company data into ungoverned AI tools, that data flows to third-party servers that may retain it for model training. Customer records, financial projections, product roadmaps, and source code are all flowing through systems your security team can’t monitor. The Reco Shadow AI Report found that 86% of organizations are blind to AI data flows, and the average company experiences 223 incidents per month of users sending sensitive data to AI applications — double the rate from a year ago.

Compliance exposure that compounds. The EU AI Act’s provisions for high-risk AI systems take effect on August 2, 2026. Organizations using AI in hiring, credit decisions, healthcare, or safety-critical systems will need to demonstrate compliance with transparency, human oversight, and risk management requirements. If those AI systems include tools that were never formally evaluated or approved — shadow AI, in other words — demonstrating compliance becomes impossible. You can’t document controls for tools you don’t know about.

Licensing and IP liability. When AI tools generate outputs based on copyrighted training data, the liability for using those outputs falls on your organization. If a developer uses an ungoverned coding assistant that was trained on GPL-licensed code, and that code pattern ends up in your proprietary software, the legal exposure belongs to you — not the AI vendor and not the developer who used it.

Audit trail gaps. When regulators, auditors, or legal teams ask how AI is being used in your organization, you need a comprehensive answer. Shadow AI makes that impossible. IBM found that 97% of organizations that reported AI breaches lacked proper AI access controls. The breach isn’t the only problem — it’s the inability to explain what happened and why.

The Governance Playbook That Works

Effective shadow AI governance follows a sequence: Detect, Assess, Redirect, Monitor. Not “block everything” — but “see everything, govern what matters.”

Detect. You can’t govern what you can’t see. The first step is comprehensive discovery of AI tool usage across your organization — not just the tools IT provisioned, but the ones employees adopted on their own. This means monitoring network traffic patterns, analyzing browser extensions and desktop applications, reviewing SaaS procurement and expense reports, and surveying teams about their actual workflows. The goal is a complete inventory, not a witch hunt.

Assess. Not all shadow AI carries equal risk. An employee using ChatGPT to brainstorm blog post ideas is not the same as a developer pasting proprietary algorithms into an ungoverned coding assistant. Prioritize by data sensitivity, regulatory exposure, and business criticality. Our AI risk heatmap framework provides a structured methodology for matching governance intensity to actual risk levels.

Redirect. For high-value use cases discovered in the shadow, provision approved alternatives that meet the same need with appropriate controls. Enterprise versions of popular AI tools typically include data handling agreements, SSO integration, audit logging, and content filtering that their consumer counterparts lack. When approved tools are easy to access and meet employee needs, the incentive to use unauthorized alternatives disappears.

Monitor. Shadow AI isn’t a one-time problem to solve — it’s an ongoing condition to manage. New AI tools launch weekly. Employee needs evolve. Governance policies need continuous enforcement. Build continuous monitoring into your AI governance framework, with alerts for new unauthorized tools, data flow anomalies, and policy violations.

The Market Is Signaling

The venture capital and analyst community has noticed what enterprise security teams are experiencing firsthand. The AI governance market reached $492 million in 2026 and is heading toward $1 billion by 2030, according to Gartner estimates. That growth reflects a simple reality: organizations are realizing they can’t scale AI adoption without governance infrastructure to match.

A 2025 Gartner survey of 360 organizations found that enterprises using dedicated AI governance platforms are 3.4 times more likely to achieve high governance effectiveness than those relying on manual processes. Manual approaches — spreadsheet inventories, annual surveys, policy documents that nobody reads — worked when AI usage was limited to a few approved tools. They break down completely when every department in the organization is adopting AI tools at its own pace.

The organizations that figure out shadow AI governance first won’t just avoid breaches. They’ll move faster than their competitors because they’ll be able to say yes to AI adoption with confidence rather than defaulting to no out of fear. They’ll know which tools are delivering value, which ones create risk, and where to invest next. Visibility isn’t just a security capability — it’s a strategic advantage.

The 76% Is a Leading Indicator

When three-quarters of organizations acknowledge a problem and a third don’t know whether they’ve already been breached, we’re past the awareness phase. The question is no longer whether shadow AI is a risk. It’s whether your organization will address it before a breach forces your hand.

The path forward isn’t restriction. It’s visibility. See what’s happening. Assess the risk. Redirect usage to governed channels. Monitor continuously. The organizations that do this will turn shadow AI from a hidden liability into a governed advantage. The organizations that don’t will keep finding out the hard way — through breach reports, compliance failures, and audit findings that could have been prevented.

How much AI is running in your organization that you don’t know about? See how Olakai’s shadow AI detection gives you complete visibility across every AI tool your employees use. Talk to an expert to find out.

Right now, someone in your organization is using an AI tool you don’t know about. They’re pasting customer data into it.

This isn’t a hypothetical scenario. According to recent research from BlackFog, 86% of employees now use AI tools at least weekly for work—and 49% of them are using AI tools not sanctioned by their employer. That’s nearly half your workforce operating outside your visibility.

The term for this is shadow AI, and it represents one of the fastest-growing enterprise risks of 2026. Unlike traditional shadow IT, which took a decade to become a crisis, shadow AI is accelerating on a timeline measured in months. The tools are too accessible, too useful, and too easy to hide.

What Shadow AI Actually Looks Like

Shadow AI isn’t malicious. That’s what makes it so difficult to address. Your employees aren’t trying to harm the company—they’re trying to do their jobs better. A sales rep pastes customer objections into ChatGPT to draft responses. A marketing manager uploads competitive research to Claude for analysis. A developer uses an AI coding assistant their team hasn’t officially adopted. A customer success manager feeds support tickets into an AI tool to identify patterns.

Every one of these use cases is reasonable. Every one of them is also invisible to your security, compliance, and IT teams. And every one of them creates risk you can’t quantify because you don’t even know it exists.

The explosion of shadow AI is driven by simple economics. Consumer-grade AI tools are free or nearly free. They require no procurement process, no IT approval, no integration work. An employee can start using ChatGPT, Claude, Gemini, or dozens of other AI tools in minutes, from any browser, on any device. The friction to adopt is essentially zero.

The Risks Nobody’s Tracking

When AI usage happens outside your visibility, risks accumulate in ways that are difficult to detect until something goes wrong.

Data leakage is the most immediate concern. Employees pasting sensitive information into AI prompts are essentially sharing that data with third-party services. Customer records, financial projections, product roadmaps, legal documents, personnel information—all of it can flow into AI tools that may retain, train on, or inadvertently expose that data. According to a survey cited by IBM, over 38% of employees share sensitive information with AI tools without permission from their employer.

Compliance violations compound the problem. If customer data from EU residents enters an AI system that doesn’t meet GDPR requirements, your organization bears the liability—not the AI vendor. The same applies to HIPAA-protected health information, SOC 2 data handling requirements, and industry-specific regulations. Your compliance posture is only as strong as your visibility into how data moves through your organization, and shadow AI creates massive blind spots.

Output consistency becomes another hidden risk. When employees use unauthorized AI tools to generate customer-facing content, legal advice, financial analysis, or technical documentation, you have no quality control over what AI is producing on your behalf. Hallucinations—confident but incorrect AI outputs—can propagate through your organization without anyone recognizing their source.

Cost sprawl may be the slowest-burning problem, but it’s significant. When every team and individual subscribes to their own AI tools, you lose purchasing leverage and budget visibility. Organizations often discover they’re paying for dozens of overlapping AI subscriptions, with no consolidation and no way to measure comparative value.

Perhaps most critically, shadow AI leaves you without an audit trail. When regulators, auditors, or legal teams ask how AI is being used in your organization, you can’t answer. You can only hope nothing material happened in the systems you can’t see.

Why Blocking Doesn’t Work

The instinctive response to shadow AI risk is to block it. Add ChatGPT to the firewall. Prohibit AI tool usage in the acceptable use policy. Send a memo.

This approach fails for the same reasons it failed with shadow IT twenty years ago. Employees route around restrictions because they need these tools to compete. The sales rep who uses AI to respond to customers faster wins more deals. The developer who uses AI coding assistance ships features more quickly. The marketing manager who uses AI for research produces better analysis.

When you block AI without providing alternatives, you don’t eliminate usage—you just push it further underground. Employees use personal devices, personal accounts, and personal networks. The shadow gets darker, and your visibility gets worse.

There’s also a talent dimension. The most effective knowledge workers have already integrated AI into how they operate. Telling them they can’t use these tools at your organization is effectively telling them to work less effectively—or to work somewhere else.

The Governance Gap

The fundamental challenge with shadow AI is simple: you can’t govern what you can’t see. Most organizations have some form of AI policy. They may have approved certain tools, defined acceptable use cases, and established data handling requirements. But policies only work when they’re applied to known activity.

Shadow AI, by definition, exists outside that framework. It’s the AI usage that happens in the gaps between your policies and your enforcement capabilities. For a structured approach to closing those gaps, see our AI governance checklist for CISOs. Closing that gap requires visibility before control—you need to discover what’s actually happening before you can decide what should be allowed.

This is where traditional security tools fall short. They’re designed to detect known threats and block prohibited applications. Shadow AI is neither. It’s legitimate tools being used for legitimate purposes in ways that happen to bypass your governance framework. Detecting it requires understanding the full landscape of AI usage across your organization, including tools you haven’t explicitly approved.

How Olakai Addresses Shadow AI

Olakai takes a visibility-first approach to shadow AI detection and control. Rather than starting with blocking, we start with discovery. What AI tools are actually being used in your organization? Who is using them? What data is flowing through them? What outcomes are they producing?

This visibility layer creates the foundation for informed governance. Once you understand the full picture of AI usage, you can make intelligent decisions about what to allow, what to restrict, and what to redirect to approved alternatives. Our AI risk heatmap framework provides a methodology for matching governance intensity to the actual risk of each tool. You can identify high-risk usage patterns before they become incidents. You can consolidate redundant subscriptions and negotiate enterprise agreements with vendors you’re already using at scale.

Importantly, visibility enables a partnership approach with employees rather than an adversarial one. When you can see which AI tools are delivering real value, you can fast-track their official adoption. When you can identify risky usage patterns, you can work with teams to provide safer alternatives. You shift from “you can’t use that” to “let me help you use this more effectively.”

Getting Started

The first step isn’t blocking. It’s understanding. Before you can govern AI usage effectively, you need to know what’s actually happening. Many organizations are surprised by what they discover—both the scope of AI usage and the specific tools that have gained traction without official approval.

That discovery process should answer several key questions. What AI tools are employees using, both sanctioned and unsanctioned? What types of data are flowing through these tools? Which use cases are delivering measurable value? Where are the highest-risk concentrations of activity?

With those answers in hand, you can build governance that’s proportional to risk and responsive to value. High-risk, low-value AI usage gets restricted. High-value, controllable AI usage gets accelerated. The gray areas in between get managed through policy, training, and approved alternatives.

Shadow AI will continue growing in 2026. The question isn’t whether your employees will use AI tools you don’t control—it’s whether you’ll build the visibility to govern that usage intelligently. The organizations that figure this out will turn shadow AI from a hidden risk into a competitive advantage. The organizations that don’t will remain in the dark, hoping that nothing goes wrong in the systems they can’t see.

How much AI is running in your organization that you don’t know about? Talk to an expert to find out.