What is Shadow AI? Risks, Costs and Discovery Methods

As enthusiasm around AI continues to build, many organizations are ramping up their investment – spending on AI tools has risen by an average of 80% in the past year alone.

But with most companies still in the early, exploratory stages of adoption, this rapid growth is also exposing critical gaps in oversight and control. Without the right structure in place, they’re at risk of doing more harm than good.

One consequence: the quiet rise of Shadow AI.

What is Shadow AI?

Shadow AI refers to the use of AI tools that have not been formally approved, vetted, or monitored by an organization’s IT or procurement teams.

This often includes individual subscriptions to platforms such as ChatGPT Plus, experimental plugins, or other tools brought in by employees to support their own workflows.

While these efforts are often well-intentioned – aimed at boosting productivity or automating repetitive tasks – they contribute to AI usage that flies under the radar of organizational controls, governance, and compliance, mirroring long-standing challenges seen with shadow IT.

The cost of Shadow AI

According to our own data, 44% of AI-related spending happens without procurement’s oversight, a figure that is significantly higher than the 26% average for software spend overall. This lack of transparency, and fragmented and largely uncontrolled usage, creates inefficiencies, tool duplication, and misalignment with broader business objectives.

In fact, these issues leave organizations exposed to hidden risks as adoption accelerates:

Wasted spend

With 13% of AI applications going entirely unused and a further 48% underutilized, inefficiency is already evident. But with investment in this area having surged by 80% in the last year, the financial impact of this waste is only set to escalate.

Combine this with the risk of unwanted auto-renewals locking organizations into paying for unused tools and licences, and the cost of Shadow AI could very quickly become a major burden.

Security, compliance, and vendor risk

‍Unvetted AI tools may fall short of both organizational and regulatory standards for data protection, privacy, and compliance – potentially exposing sensitive information or breaching legal and contractual requirements.

Additionally, when tools are procured outside of formal purchase requisition channels, companies may not necessarily be aware of critical contractual terms, key vendor dependencies, and support limitations until problems arise.

There’s also a risk that unapproved AI tools could access and use company data in ways that aren’t clearly understood or authorized. Some vendor contracts allow data to be used for model training, which can lead to loss of control over proprietary information and potential compliance issues – exposing the organization to data misuse, legal liability, and broader security gaps.

Lost productivity and missed potential

Tool underutilization massively increases without proper onboarding, training, or integration into workflows. Shadow AI bypasses these enablement and IT support structures – leading to fragmented usage and lost time rather than real gains in productivity.

Usage analytics solutions can provide insights into actual tool adoption and help guide better training and integration efforts.

‍Strategic misalignment

‍Siloed AI adoption creates difficulties in evaluating impact, alignment with company priorities, or scaling successful use cases. What starts as experimentation can result in disjointed efforts that don’t connect to broader transformation goals – stalling momentum rather than driving it.

The bottom line is that the rapid increase in usage combined with limited oversight means these risks could increase significantly – leading to far greater challenges if left unaddressed.

Taking a proactive approach to SaaS spend management is therefore crucial to maintaining control over AI investments, minimizing risk, and ensuring that these tools deliver real value rather than creating hidden costs.

What is causing Shadow AI?

The rise of Shadow AI is a byproduct of the accessibility and appeal of generative tools. With minimal friction and almost immediate perceived benefits, applications are often adopted before leadership can define strategy, standards, or governance.

A few key drivers include:

• Ease of access: Many AI tools offer free trials or low-cost plans that don’t require approval.
• Pressure to innovate: Teams are incentivized to move fast and automate, leading to tool adoption outside elongated or frequently delayed formal processes.
• Lack of a centralized AI strategy: When there’s no clear organizational roadmap for AI, individuals take the lead themselves.‍
• Developer curiosity: Technical staff often experiment with APIs to test use cases, which can balloon into unsanctioned deployments.

How to discover Shadow AI

You can only manage the risks of Shadow AI if you know where these tools are hiding.

Without effective discovery, unvetted AI tools silently proliferate across your organization – exposing you to security gaps, wasted spend, and compliance issues long before you’re aware of their existence.

To avoid this issue, companies should:

• Assess financial records: Review expense claims, invoices, and direct debits to identify unapproved AI subscriptions.
• Leverage single sign on (SSO) data: Look at which AI applications employees are logging into across the organization.
• Survey teams and departments: Directly ask employees which tools they’re using or testing.‍
• Invest in a Procurement Orchestration Platform: Streamline purchasing, enforce controls, and support ongoing Shadow AI discovery at scale.

Getting ahead of the problem

Shadow AI may not yet be a crisis, but companies need to get ahead of the situation before AI usage scales beyond control.

This means developing clear processes for AI software procurement, improving visibility into application usage, and engaging with teams to understand what tools they’re already using – and for what purpose.

Leveraging SaaS procurement software with robust contract management capabilities is crucial for managing unauthorized AI tool usage effectively.

In our latest report, Buying AI, we explore critical topics including new security and compliance risks introduced by AI tools, how to spot AI-washing, and the negotiation tactics organizations can apply to secure the best deals.