Shadow AI
Also: unsanctioned AI use
AI use that a firm has not approved or does not know about. A staff member's personal chat account is one example.
The fuller definition
Shadow AI is the use of AI tools that an organization has not approved, often personal accounts used for work tasks.
- Your computer
- Model running on it
- Answer stays on it
Confidentiality depends on the machine and anything else connected to it.
- Your computer
- Provider's servers
- Storage, logs, possibly training
- Answer returned
Confidentiality depends on the contract, the account tier, and the settings in force.
Neither route is safe by default. The question is the same for both: who can see the material, where is it kept, and for how long.
A concrete example
A staff member pastes a client letter into a free chatbot to rewrite it, outside any firm-approved service.
The distinction that matters
The risk is in the data flow, not the intent. An approved alternative and clear guidance reduce shadow use more than prohibition alone.
Related terms
AI governance
The rules an organization sets for which AI tools may be used, for what, and with what checks.
Reliability & securityConfidentiality
Keeping private material from people who may not see it. Check who can read, store, or share what you put into a tool.
Reliability & securityData retention
How long a service keeps your data after it has been used.
Where it is taught
Map where information goes before using a toolSource and further reading
Law Society of Ontario · Using technologyThe definition and example are written for this library. The link gives background, official documentation or legal authority as labelled. Legal scope depends on the jurisdiction and current text; product features depend on release and settings.