Shadow IT. Every organisation has it. Employees adopting new tools without official approval because it helps them get the job done faster. Now we’re seeing its next evolution: shadow AI. And it’s spreading faster than most leaders realise.

As JP Browne, Practice Manager at Talent Auckland, explains:

“The use of AI tools is prolific in every organisation, and it kind of just happened. Executives are scrambling to catch up, to either capitalise on it or put some structure around it.”

From staff pasting data into ChatGPT to marketing teams using generative tools for campaigns, shadow AI is already shaping workflows, decisions, and customer interactions. The question is: will your organisation keep pace, or fall behind?

The upside of shadow AI

It’s tempting to see shadow AI only as a risk. And yes, it comes with security, compliance, and ethical challenges. But there’s also a huge opportunity: grassroots innovation.

“Most of the experiments we’ve seen start with individuals in departments,” JP says. “They’re dabbling to find productivity gains or new insights, and that’s what’s forcing organisations to pay attention.”

In other words, shadow AI is where many of the best use cases are discovered. It’s employees closest to the problem spotting where AI can create value. Ignoring that would be a mistake.

The risks leaders can’t ignore

Of course, there is a dark side. Shadow AI introduces risks that can’t be brushed off:

• Data leaks. Sensitive customer data pasted into public AI tools can breach privacy laws and contracts.
• Security gaps. AI-generated code may introduce vulnerabilities that slip past standard reviews.
• Compliance issues. Using unapproved tools in regulated industries can expose companies to fines or reputational damage.

Jack Jorgensen, General Manager of Data, AI & Innovation at our IT delivery arm Avec, recalls:

“We’ve seen AI drop entire databases and then apologise. If you’re not putting guardrails around this, you’re gambling with your business.”

Why locking it down doesn’t work

Some organisations’ instinct is to ban AI tools outright but that would be a losing battle. Employees will find workarounds if the technology genuinely helps them.

Instead, leaders need to acknowledge shadow AI as a reality and bring it into the light.

“You can’t just bury your head in the sand,” JP stresses. “AI is in everything now, even your phone updates. The only question is whether you create a framework for using it safely.”

Turning shadow AI into an advantage

So, how do you harness the innovation of shadow AI without exposing your business to unnecessary risk? Start with three steps:

1. Listen first. Find out what employees are already using and why. Often these experiments highlight gaps in existing tools or processes.
2. Set clear guardrails. Develop policies around data security, compliance, and acceptable use. Make them practical so employees don’t feel forced underground.
3. Encourage responsible innovation. Provide safe sandboxes or approved platforms where staff can test and share ideas.

Jack’s advice:

“Don’t focus on speed for the sake of it. Focus on building velocity and a foundation that lets you scale safely and keep experimenting.”

The innovation edge

Shadow AI is a sign your people are hungry to innovate. Rather than suppressing it, leaders should channel it. The companies that do will move faster, find better use cases, and keep their competitive edge, and those that don’t risk being left behind by their competitors and their own employees.

Shadow AI isn’t a threat to stamp out. It’s a wave to ride. The businesses that embrace it with the right guardrails will unlock innovation and the ones that don’t will spend the next five years scrambling to catch up.

Discover how other organisations are navigating shadow AI in our AI survey results.