How to Govern Shadow AI in the Workplace: A NIST-Based Model

How do you govern shadow AI in the workplace?

You govern shadow AI by finding it first, then giving employees a sanctioned tool that's easier to use than the unsanctioned one, backed by a structured framework like NIST's AI Risk Management Framework instead of a blanket ban. That's the short version. The long version is why most companies are doing the opposite: arguing about hypothetical bioweapons while a measurable, already-priced risk sits inside their own network.

Why are there two AI risk conversations happening at once?

Walk into any AI policy conversation right now and you'll hear two entirely different risk profiles discussed as if they were the same problem.

One is speculative and enormous. In May 2023, the Center for AI Safety published a 22-word statement, signed by hundreds of researchers and executives including OpenAI's Sam Altman and Anthropic's Dario Amodei, warning that "mitigating the risk of extinction from AI should be a global priority alongside other societal-scale risks such as pandemics and nuclear war." A 2023 Reuters/Ipsos poll found 61% of Americans believe AI threatens humanity's future. Frontier labs have taken this seriously enough to build biosecurity testing programs. Anthropic's own threat intelligence work has disrupted attempted misuse of its models tied to biological weapons development, and the Frontier Model Forum has published industry-consensus thresholds for when a model's bio-uplift capability requires additional safeguards.

The other conversation is mundane, already happening, and already showing up on breach reports. It's called shadow AI, and it's costing companies money today, not in some projected future.

This piece is about the second conversation. Not because the first one is fake, but because most organizations have no governance structure for either, and the one they can actually act on this quarter is the one getting ignored.

What is shadow AI?

Shadow AI is the AI-era version of shadow IT: the tools, accounts, and applications employees adopt without going through procurement, security review, or IT approval. It splits into two distinct behaviors that get lumped together but need different responses.

• BYOAI (Bring Your Own AI). An employee pastes a client contract into a personal ChatGPT account because it's faster than the sanctioned enterprise tool, or there isn't one. This is unsanctioned use of AI.
• Citizen-developer shadow AI. An employee uses an AI coding assistant or a no-code builder to ship a working internal app, sometimes in an afternoon, with no ticket, no owner, and no security review. This is unsanctioned software, built with AI rather than just used with it.

The second category is growing fast. Gartner has forecast that by 2026, at least 80% of low-code application builders will sit outside formal IT departments, up from 60% in 2021. Generative AI just gave that population a much sharper set of tools. We've covered how IT keeps these employee-built apps accountable elsewhere, because it's a different governance problem than an employee who just wants a chatbot.

How big is the shadow AI problem, really?

The numbers aren't vendor speculation. They come from multiple independent surveys pointing at the same scale.

• 78% of employees who use AI at work bring their own tools without employer approval, according to Microsoft and LinkedIn's 2024 Work Trend Index, a behavior they term BYOAI. The rate climbs to 80% at smaller companies.
• Corporate data pasted or uploaded into AI tools grew 485% between March 2023 and March 2024, per Cyberhaven, with roughly half of source code, R&D materials, and HR records headed to non-corporate, unsanctioned accounts.
• 49% of workers admit to adopting AI tools without employer approval, according to a 2025 BlackFog survey, and a majority of senior leadership, 69% of presidents and C-suite members, say they're fine with that trade-off because it moves faster.
• Smaller companies carry the densest exposure. Reco's 2025 State of Shadow AI Report found firms with 11 to 50 employees average 269 unsanctioned AI tools per 1,000 staff, about 27% of the workforce, largely because they lack dedicated security teams or a formal AI policy.
• 44% of employees use AI in ways that violate existing company policy, and only 41% report their organization even has a generative AI policy at all, per KPMG.

These aren't four versions of the same statistic. They're four different research firms measuring the same underlying behavior from different angles, landing in the same range.

How much does shadow AI add to a data breach?

This is where the risk stops being theoretical. IBM's 2025 Cost of a Data Breach Report found shadow AI was a factor in roughly one in five breaches, and organizations with high levels of shadow AI use paid an average of $670,000 more per breach than those with low or no shadow AI use.

The governance gap behind that number is stark:

• 97% of organizations that suffered an AI-related breach reported they lacked proper AI access controls.
• 63% of breached organizations either have no AI governance policy or are still writing one.
• Of the organizations that do have a policy, only a minority perform regular audits for unsanctioned AI use, per ISACA's review of the same data.
• Shadow AI incidents expose personally identifiable information at a higher rate (65% versus 53% globally) and intellectual property at a higher rate (40% versus 33% globally) than the average breach.

That $670,000 figure is a number a CFO can put in a budget line. The bioweapon-uplift debate doesn't have an equivalent, because nobody has priced an event that hasn't happened. If you're weighing which risk gets a governance budget this year, one of these is measured and one is modeled.

Why does the extinction narrative crowd out the real problem?

None of this means the biosecurity concern is manufactured. Anthropic disrupted a real attempt to use its model in ways that could support biological weapons development. Frontier labs are building genuine capability thresholds because the uplift risk, however small today, compounds with model capability.

But expert opinion on the existential-risk framing is genuinely split, not settled. When The Conversation convened a panel of five AI safety and ethics academics and asked whether AI currently poses an existential risk, three said no and two said yes. Surveys of machine learning researchers put the median estimate of extinction-level outcomes this century at around 5%, a number the panel itself called small but not negligible.

That's a contested, forward-looking estimate debated by specialists. The shadow AI breach data is neither. It's 20% of breaches, already logged, with an average cost already calculated. When boardroom attention goes entirely to the speculative catastrophic scenario, the governance budget, the security review cycle, and the policy-writing time that could close a 97%-unprotected gap gets spent on a debate specialists themselves haven't resolved.

What actually works when moving from banning to governing?

Banning shadow AI doesn't work, for the same reason banning shadow IT never worked: employees adopt these tools because the sanctioned alternative is slower or doesn't exist. KPMG's research frames this correctly: shadow AI is a demand signal, not just a violation, and the fix is to move it from liability to launchpad through centralized AI governance boards, a tool intake and inventory process, and curated, role-specific sanctioned tools that are actually good enough to use.

The most widely cited structured approach is the NIST AI Risk Management Framework, built on four continuous functions: Govern, Map, Measure, and Manage. ISACA recommends treating shadow AI as an audit problem structurally similar to shadow IT, but with a larger blast radius, and aligning discovery and remediation to NIST's framework rather than reacting tool by tool.

What belongs on a governance checklist for shadow AI in the workplace?

1. Run a discovery and inventory pass first. You can't govern what you can't see. Network and SaaS-expense discovery tools, plus a straightforward employee survey, will surface far more AI use than IT expects.
2. Publish a pre-approved tool list, not a ban list. Give employees a short menu of sanctioned tools cleared for company data, updated quarterly, so the default path is also the fast path.
3. Classify data before you classify tools. Define what can never leave the company (client data, source code, HR records) separately from what's low-risk, so the policy scales with the actual sensitivity of the task.
4. Set guardrails for citizen developers, not just chatbot users. Anyone building an app or agent with an AI coding tool needs a lightweight review step before it touches real data or customers, distinct from the rules for someone just prompting a chatbot.
5. Audit on a schedule, not after an incident. Only a minority of organizations with a policy actually audit for unsanctioned AI regularly. That gap is exactly where the $670,000 cost premium shows up.
6. Train people on why, not just what. 58% of employees trust AI output without verifying it and have made mistakes as a result. A rule without an explanation gets ignored the first time it slows someone down.

Why does sanctioned but easy beat banned every time?

The pattern across every source in this piece is the same: employees don't adopt shadow AI because they're careless. They adopt it because it's faster than what IT gave them. That's a software ownership problem as much as a security one. If the sanctioned option is a rented tool that's slower, more restrictive, or simply absent, employees will keep building around it, whether that means a personal ChatGPT account or a working internal app assembled over a weekend. The fix isn't stricter prohibition. It's giving people governed, owned infrastructure, whether that's a properly reviewed AI coding platform or an internal tool built to the same standard, so the fast option and the safe option are finally the same one. We've laid out the practical version of that model, tool by tool, in our governance guide for AI-built apps, and the underlying logic holds regardless of which framework you start with: visibility first, sanctioned alternatives second, audits on a schedule, always.