When a finance manager pastes a draft board memo into ChatGPT to clean up the language, three things happen. The memo arrives polished. Productivity goes up. And, depending on the provider settings, that confidential text may now live in a third-party model that nobody at your company can audit, control, or delete.
Multiply that by every department, every week. That is shadow AI. It is the single fastest-growing category of unmanaged risk in most businesses right now.
Why it is bigger than IT thinks
Three forces converged in 2024. AI tools became free, fast, and good. They were marketed directly to end users, not IT departments. And the value of using them is immediate and personal: faster emails, cleaner reports, better analysis. The result is that the people using AI most heavily are often the ones least involved in approving software.
A typical 50-person business will have 8 to 15 AI tools in active daily use. Procurement knows about one or two. The rest are paid for on personal cards, expensed quarterly, or used on free tiers.
The actual risks, not the theoretical ones
- Customer or employee personal data being submitted to providers whose terms permit training. Once it is in the training set, it is impossible to extract.
- Source code, financial models, or strategy documents being shared with tools that retain prompts indefinitely.
- Hallucinated outputs being relied on for decisions, especially in regulated functions.
- Vendor concentration risk: critical workflows quietly depending on one provider with no fallback.
- NDPC exposure: under the Nigerian Data Protection Act, processing personal data through an unvetted processor is a compliance breach in its own right.
How to find what you have
Three sources surface most of it. First, your SSO logs and your firewall or web proxy logs will show traffic to AI provider domains. Second, your finance system will show subscriptions if you look for keywords like AI, GPT, Claude, Copilot, Midjourney. Third, an anonymous five-question survey of staff asking "which of these tools do you use weekly" will surface the rest. Run all three in the same week and compare.
What to do once you find it
Resist the urge to ban everything. That will not work; it will just push usage further underground. Instead, classify what you found by risk. For low-risk uses, sanction them officially with documented guidance. For medium-risk, move them onto enterprise tiers with data processing agreements. For high-risk uses involving regulated data, restrict them and provide a sanctioned alternative.
Within a quarter you can replace ungoverned shadow AI with a small, sanctioned set of tools that staff actually want to use and your compliance team can defend. That is a far healthier endpoint than pretending it is not happening.