Versatile AI Risk Assessment

Glossary Governance and evidence

Shadow AI

AI tools used without the organisation knowing or approving.

As of: September 2026 · Glossary with 28 terms

What is Shadow AI?

Shadow AI is the use of AI services outside governed procurement: the chatbot quickly opened in a browser, the editor extension, the private account used for work. The motive is rarely malicious; usually it is the wish to get done faster.

The problem is invisibility. Without knowing which services are in use there is no processing agreement, no purpose limitation and no record of where input went. What usually works is an easy, approved offering plus a clear rule, not a ban on its own.

GovernanceGDPRProcurement

Threats using this term (1)

Entries in the threat catalogue whose text uses the term. Every link leads to the full threat page.

Shadow AI (Unsanctioned AI Service Use) Employees or business units use AI services without company approval or oversight (shadow AI).

More terms from the subject area Governance and evidence.

DPIA threshold analysis Screening under Art. 35 GDPR: does the processing need a full impact assessment? EU AI Act risk classes Classification of AI systems by risk, from prohibited practices to minimal risk. TOMs: technical and organisational measures Technical and organisational safeguards under Art. 32 GDPR, appropriate to the risk.

From the term into the substance

The link leads to the place on the website where the term becomes practical; the overview shows every term in the glossary by subject area.

Capture first systems with a free single module All terms in the glossary

Cite this term

For reports, policies or internal documents; the link leads directly to this term page.

“Shadow AI”. Versatile AI Risk Assessment, glossary of AI risk analysis, as of September 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/glossary/schatten-ki/

← Back to the glossary