Best Practices Cybersecurity IAM Fundamentals

Shadow AI – Identifying Risks and Managing Them Through Governance

Shadow AI often emerges where employees need to move faster than IT can respond.
Find out why clear governance is more effective than a blanket AI ban – and how organizations can maintain control without slowing down innovation.

25. September 2026
11 Min. Lesezeit
Shadow AI is far more than just a trend. Employees use AI tools to create content, summarize information, write code, or accelerate processes – often without the IT department being aware of it. According to a study by IBM/SentinelOne, a data breach involving Shadow AI can, on average, result in significantly higher costs than a conventional security incident.

The issue is rarely malicious intent. In most cases, it is about efficiency: a freely available AI tool can deliver a result within seconds, while getting an official tool approved can take considerably longer. This gap is precisely what makes Shadow AI a challenge for IT, security, and corporate management.

Shadow AI

Key Takeaways

Shadow AI often emerges unnoticed: Employees turn to unauthorized AI services to perform their work more efficiently.

The risk goes beyond data: Access rights, responsibilities, and technical identities can also emerge without adequate control.

Clear AI governance is essential: Organizations need clear rules, secure alternatives, and technical controls rather than a blanket ban.

What Is Shadow AI?

Shadow AI refers to the use of AI tools by employees without the approval or knowledge of the IT department. This includes publicly available AI services or private accounts used for business purposes. For organizations, this creates AI usage outside their defined security and governance structures.

Why Shadow AI Is Growing So Quickly in Organizations

Access to artificial intelligence has never been easier. Many AI applications are browser-based, free or inexpensive, and require no technical expertise. For employees, it is therefore an obvious choice to use an available tool when it can solve a specific task more quickly or easily.

At the same time, two different speeds are colliding: the requirements of day-to-day work can change within days, while introducing and approving new enterprise applications often takes considerably longer. External AI tools, by contrast, are available within seconds.

There is another factor at play: executives and other decision-makers also use unauthorized applications. When this behavior is visibly accepted, it can quickly become established throughout the organization.

Shadow AI is therefore not simply a matter of individual misconduct. It often indicates a gap between employees' actual needs and the solutions provided by the organization.

Risks posed by AI

Shadow AI and OAuth: When AI Agents Become Invisible Identities

As AI continues to evolve, so does the security challenge. Modern AI agents can access applications and data through interfaces. If persistent OAuth tokens are used for this purpose, the agent technically has its own identity – even if that identity is not registered in the organization’s central IAM system.

This creates a familiar problem from a new perspective: an identity has access rights but is not subject to defined governance. There may be no clear accountability, controlled provisioning, or established process for removing its permissions.

Shadow AI can therefore create a connection between uncontrolled AI usage and traditional IAM challenges. Untracked OAuth identities can, for example, become a lifecycle problem.
Auch das Thema Non-Human Identities gewinnt dadurch an Bedeutung. KI-Agenten, Anwendungen und andere technische Identitäten benötigen klar definierte Verantwortlichkeiten und kontrollierte Zugriffsrechte.

An Overview of the Risks of Shadow AI

The mere use of AI does not automatically create a risk. The problem arises when an organization does not know which applications are being used, what data is being processed, or what access rights are associated with them. Key risks include:

Data leakage: If confidential or personal information is entered into public AI systems, organizations may no longer be able to control how that data is subsequently processed or used.

A blind spot for traditional security tools: Conversational AI usage can be difficult for existing security solutions to detect because the communication may technically appear to be ordinary encrypted web traffic.

Loss of intellectual property: If trade secrets or internal information are submitted to public AI services, they may end up outside the organization’s controlled environment.

Scalable risk: Even individual prompts can contain sensitive personal or business-critical information. As AI usage increases across the organization, so does the associated risk.

This makes one thing clear: Shadow AI is not exclusively an IT issue. It can also affect security, data protection, compliance, internal audit, HR, other business functions, and ultimately the entire organization.

Risks posed by Staff

The Legal Dimension in Germany

In addition to the technical risks, the legal framework also plays an important role. The handling of personal data is particularly relevant. If such information is entered into public AI systems without an appropriate legal basis, this can raise data protection concerns. Entering personal data into public AI systems will regularly constitute processing without a legal basis under the GDPR.

Trade secrets and confidential business information can also be affected if they are transmitted to external AI services without adequate controls. Without appropriate confidentiality measures within the meaning of Section 2 No. 1 of the German Trade Secrets Act (GeschGehG), statutory protection for trade secrets may be lost.

Another aspect is employee co-determination. Whenever an employer provides AI systems or mandates and regulates their use within the organization, the introduction and use of such systems may affect the works council’s co-determination rights.

This is where the works council’s co-determination rights under Section 87 (1) No. 6 of the German Works Constitution Act (BetrVG) come into play. Conversely, this means that an AI usage policy developed without involving the works council may be legally challengeable. It should therefore not be developed in isolation from the works council, IT, and security functions.

A robust strategy therefore requires more than technical safeguards. Organizations need to bring together technical, organizational, and legal requirements.

External AI systems can also represent potential entry points for cybersecurity risks. Under the NIS2 Implementation Act, managing directors, executive boards, and other governing bodies are required at all times to establish, approve, and monitor appropriate IT risk management measures (§38 BSIG). A lack of knowledge or delegation no longer provides relief from this responsibility.

AI Governance Instead of a Ban

A blanket ban on AI may initially sound like a simple and secure solution. In practice, however, it is difficult to enforce. If employees have a specific need and no suitable approved solution is available, they may simply shift their use of effective AI tools to private devices, accounts, or other channels that are difficult to control.

A clear AI governance framework is therefore more effective. It provides guidance while still enabling productive work. This can include:

  • a clear and understandable AI Acceptable Use Policy
  • clearly defined permitted and prohibited use cases
  • approved AI solutions for common requirements
  • guidelines for handling confidential and personal data
  • clearly defined responsibilities for AI applications and access rights
  • regular reviews of actual usage
  • technical controls wherever they are appropriate and necessary

The key is to combine clear rules with practical alternatives. Employees need to know what is permitted, which solutions they are allowed to use, and why certain requirements are in place.

AI governance should therefore not be treated as a one-time project. New applications, features, and use cases are constantly emerging. Organizations need to continuously adapt their policies and regularly review actual usage – including through compliance monitoring.

How OEDIV SecuSys Supports You in Managing Shadow AI

Shadow AI cannot be addressed with a single product. The first step is to develop a clear understanding of how AI is actually being used within the organization. OEDIV SecuSys supports organizations in analyzing existing structures and risks and deriving a practical governance framework for AI usage.

As a vendor-independent partner, OEDIV SecuSys does not focus solely on individual applications. The focus is on identities, access rights, responsibilities, and integration into the existing security architecture. The goal is a solution that fits the organization’s specific organizational and technical environment.

AI usage can be integrated into existing IAM and security structures. AI agents and other technical identities should also be governed according to clearly defined principles – with clear ownership and controlled access rights.

Would you like to know how well prepared your organization is for Shadow AI? OEDIV SecuSys supports you in assessing the current situation, developing an appropriate governance framework, and implementing the required technical measures.

Contact us for a no-obligation strategy consultation.

strategy consultation

Shadow AI: From Blind Spot to Controlled, Effective Use

Shadow AI is a topic that will continue to grow in importance. Easy access to powerful AI applications means that new use cases can emerge faster than organizations can adapt their governance frameworks.

The answer should therefore not be to ban AI outright. What matters is creating transparency, assessing risks, and establishing clear guidelines. In addition to data protection and information security, identities, access rights, and responsibilities play a central role.

OEDIV SecuSys supports organizations in bringing these perspectives together. As a vendor-independent cybersecurity specialist with a focus on Identity & Access Management, OEDIV SecuSys supports organizations from initial analysis and conceptual design through implementation and long-term operation.

Contact us today.

FAQ

FAQ zu Shadow AI 

Here you will find answers to the most important questions about our services and solutions.

What Is Shadow AI?
Shadow AI refers to the use of AI applications by employees without those applications being officially approved by the organization or controlled by the IT department. Publicly available AI services or private accounts are often used for business purposes.
Shadow IT encompasses unauthorised hardware, software and IT services. Shadow AI is a specific subset of this and refers to the use of artificial intelligence. This includes, for example, public chatbots, AI assistants or AI agents operating outside the scope of corporate governance.
Many AI applications are accessed via browsers and encrypted connections. As a result, to traditional security solutions, this communication may appear to be standard HTTPS traffic. Furthermore, private accounts and unmanaged applications may lie outside central corporate structures.

That may well be the case. If AI systems are introduced within a company or their use is regulated, this may affect the works council’s rights of co-determination. The specific situation depends on the design and use of the system and should be subject to legal review.

Through clear rules, approved AI solutions and simple guidelines for the secure handling of data. It is crucial to provide staff with practical alternatives. This allows the use of AI to be managed without unnecessarily hindering productive use cases.

Newsletter

Stay Informed

Subscribe to our newsletter to receive regular insights into Identity & Access Management.

    By submitting this form, I consent to the processing of the data I have provided for the purpose of handling my enquiry.
    I may withdraw this consent at any time with future effect. Further information: Privacy Policy.
    Read More

    Related Articles

    Ready for an Initial Consultation?

    Let's assess together how resilient and future-ready your Identity & Access Management strategy really is.

    vertrieb­@secusys.de

    Request a Strategy Meeting