By Antonio Giarrusso, founder of Userbot and Head of AI at the smeup group · November 2026
What Shadow AI is.
Shadow AI is the use, at work, of artificial intelligence tools the company hasn’t approved: AI chats with personal accounts, extensions, external apps. It’s the AI version of the old shadow IT, with one difference: whole documents, contracts and customer data end up in an AI chat.
According to UpGuard’s “State of Shadow AI” report (November 2025), more than 80% of workers use unapproved AI tools.
How to spot it.
- Employees pasting company documents into AI chats with personal accounts.
- Browser extensions or AI apps installed without going through IT.
- Expense claims or subscriptions for AI tools paid with personal cards.
- Work output clearly written with AI, while no official tool exists.
Why banning it doesn’t work.
A ban doesn’t remove the need. Someone who has found out that AI lets them write a report in half the time won’t go back: they’ll switch to their phone, another tool, a different account. The company stops seeing the problem, but the problem is still there. And it loses the productivity people had already found on their own.
What works.
Giving people an official tool as convenient as their personal ones, and having the tool enforce the rules, rather than a PDF policy: which models can be used, with which data, within which costs and with which permissions. Every step logged, data within a controlled perimeter.
That’s the work we do with Userbot, the Italian platform for governed AI adoption. The full five-step method is in the guide AI adoption in companies.
A self-assessment in eight questions.
Answer yes or no: every “no” is a place to start.
- 1.Do you know which AI tools your employees use today?
- 2.Is there an official AI tool, accessible with company credentials?
- 3.Is it at least as convenient as the personal chat people already use?
- 4.Is it written down which data can be used with AI and which can’t?
- 5.Are those rules enforced by the tool, or only by a document?
- 6.Do you know how much you spend on AI, and in which departments?
- 7.Is there a log of who used what, available if something goes wrong?
- 8.Have people received training suited to their role?
A 90-day plan.
- Days 1–30Map real usage with an anonymous survey and network data. Choose the official tool and the basic rules on data.
- Days 31–60Open the tool to a first group in each department, with two or three concrete use cases and a short training session. Collect what’s missing.
- Days 61–90Roll it out to the whole company, measure active users and off-perimeter usage, and only then tighten the blocks on unapproved tools.
Want to find out how much Shadow AI you have?
Tell me where you’re starting from: I’ll reply myself, or the Userbot team will.
Frequently asked questions.
What is Shadow AI?
It’s the use, at work, of artificial intelligence tools that haven’t been approved: AI chats with personal accounts, extensions, external apps. It’s the AI version of shadow IT.
Why is Shadow AI a risk?
Because company documents and data end up in services the company doesn’t control: it doesn’t know where they’re stored, who can read them or whether they’re used to train models. On top of that, it can’t measure costs and results.
Is blocking ChatGPT enough?
No. The need remains: people switch to their phone or to another tool. A block moves the problem out of sight and costs the company the productivity its employees had already found.
How do you manage Shadow AI?
By offering an official tool as convenient as personal ones, with rules enforced by the tool itself: which models, with which data, at what cost and with which permissions. And by logging every step, so usage can be checked.