What is Shadow AI? Risks, Examples and How Organisations Can Respond

The simplest definition of Shadow AI is the unauthorised use of AI technologies within an organisation. This can involve employees using publicly available generative AI tools to:

• Write reports
• Summarise documents
• Analyse data
• Generate code
• Automate routine tasks

Unlike officially sanctioned AI platforms governed by security and compliance processes, Shadow AI operates outside organisational oversight. This means companies may have limited visibility into which tools are being used, what data is being shared and how AI-generated outputs are influencing business decisions.

Examples of Shadow AI include:

• Uploading company documents into a public AI chatbot.
• Using an AI image generator without IT approval.
• Employing AI coding assistants that have not been reviewed for security risks.
• Drafting confidential reports using unapproved tools.
• Connecting third-party AI tools to company data without authorisation.

In many cases, employees are not intentionally creating risk. They are simply trying to work more efficiently. However, the absence of governance can lead to significant consequences.

The rapid advancement of AI is transforming how people work. Generative AI tools are easy to access, often low-cost and capable of producing results in seconds. Employees can see immediate productivity benefits and begin using these tools before organisations have established formal policies. Several key factors are driving this growth:

1.     Easy access to AI tools

Many platforms are freely available online and require little technical expertise, allowing staff to use them immediately without approval.

2.     Pressure to increase productivity

Employees are under increasing pressure to deliver results quickly. AI helps automate repetitive tasks, summarise information and streamline workflows, making it highly attractive.

3.     Slow organisational adoption

Some organisations are still developing their AI strategies. When approved tools are not readily available, employees may seek their own solutions.

4.     Lack of clear policies

Without defined guidance, staff may not understand which AI tools are approved, what information can be shared or how outputs should be reviewed.

While artificial intelligence offers clear benefits, unapproved or unmanaged use introduces significant risks. These risks are particularly important in health and social care, where organisations handle sensitive personal data and must meet strict regulatory standards.

Data protection and confidentiality risks

One of the most serious concerns with Shadow AI is the potential exposure of sensitive information. Employees may unknowingly upload confidential data into public or unapproved AI tools, including:

• Care recipient records or care plans
• Staff or workforce data
• Financial or operational information
• Internal policies and safeguarding documentation

In many cases, it is not clear how this data is stored, processed or reused by third-party platforms. This creates risks relating to:

• Unlawful data processing under UK GDPR
• Loss of control over personal and sensitive data
• Breaches of confidentiality and trust
• Unauthorised third-party data access

For care providers, even a minor data incident can have serious consequences for care recipients, organisational reputation and regulatory standing.

Compliance and governance challenges

Shadow AI can make it difficult for care services to demonstrate compliance with legal and regulatory requirements. Health and social care providers must meet expectations set by:

• The Care Quality Commission (CQC)
• UK GDPR and the Data Protection Act 2018
• Internal governance and audit frameworks

When AI tools are used outside approved systems, care services may struggle to:

• Track how data is being used
• Maintain clear audit trails
• Evidence of lawful processing and consent
• Ensure appropriate record keeping

This lack of visibility and control can lead to gaps in governance, increasing the risk of non-compliance.

Inaccurate or misleading outputs

Generative AI tools can produce outputs that appear reliable but are factually incorrect or incomplete. In a care setting, relying on unverified AI-generated content can lead to:

• Inaccurate care documentation
• Misinterpretation of policies or procedures
• Poor operational or clinical decision-making
• Increased risk of safeguarding issues

AI should support, not replace, professional judgement. Without proper oversight, there is a risk that inaccurate information could influence decisions that directly impact care recipient safety.

Lack of visibility and control

Shadow AI often develops without the knowledge of leadership or IT teams. As a result, care providers may not have a clear understanding of:

• Which tools are being used across teams
• How widely is AI embedded in daily workflows
• What types of data are being shared
• Whether outputs are reviewed or validated

This lack of oversight makes it difficult to identify emerging risks, implement consistent policies and respond effectively to incidents. Without visibility, care providers cannot establish effective governance or risk management strategies.

Security and third-party risks

Many AI tools rely on external providers, which introduces additional security considerations. Risks can include things like:

• Weak or unclear data protection practices from vendors
• Data being stored outside the UK or the EU
• Limited transparency around how AI models are trained
• Potential vulnerabilities in third-party integrations

If these tools are used without proper assessment, organisations may expose themselves to cybersecurity threats and supply chain risks.

Reputational and trust risks

Trust is fundamental in health and social care. If Shadow AI leads to a data breach, inaccurate information or poor decision-making, care services may face:

• Loss of trust from care recipients and families
• Reputational damage within the sector
• Increased scrutiny from regulators
• Impact on staff confidence and morale

Maintaining transparency and accountability in how technology is used is essential to protecting organisational credibility and quality of care.

Completely eliminating shadow AI is unlikely. As AI tools become more accessible, employees will continue to explore ways to use them in their day-to-day work.

The focus for organisations should be on enabling safe, transparent and responsible use, rather than restricting innovation entirely. This is particularly important in health and social care, where any use of AI must align with data protection requirements, governance frameworks and standards of care.

Provide approved AI solutions.

If care services do not provide trusted AI tools, employees are more likely to find their own solutions. Providing approved platforms helps ensure AI is used within controlled and governed environments. These solutions should support:

• Secure handling of sensitive data
• Clear audit trails and accountability
• Alignment with organisational policies
• Integration with existing systems and workflows

In care settings, this is particularly important when managing care recipient data, care records, and workforce information.

Strengthen data protection and governance controls

Organisations should ensure that AI use is embedded within existing data protection frameworks. This includes:

• Reviewing how personal data is processed by AI tools
• Completing data protection impact assessments where appropriate
• Ensuring third-party providers meet UK GDPR requirements
• Monitoring how data is shared externally

Strong governance helps health and social care providers maintain control, accountability and transparency in how AI is used.

Invest in workforce training and AI literacy

Technology alone cannot reduce risk. Staff need the knowledge and confidence to use AI responsibly. Training should focus on:

• Understanding the risks of Shadow AI
• Recognising sensitive and confidential data
• Using approved tools appropriately
• Reviewing and questioning AI-generated outputs
• Applying professional judgement in decision-making

An informed workforce is one of the most effective ways to support safe and ethical AI adoption.

Improve visibility and oversight of AI usage

Health and social care providers need better visibility into how AI is being used across teams. This can include things like:

• Monitoring which tools are accessed within the organisation
• Encouraging staff to disclose AI usage openly
• Regularly reviewing usage patterns and potential risks
• Establishing clear reporting processes for concerns or incidents

Improved visibility enables organisations to identify certain risks early and respond effectively.

Encourage a culture of responsible innovation

Employees often adopt Shadow AI because they want to work more efficiently. Rather than discouraging this behaviour, care providers should:

• Encourage open conversations about AI use
• Support safe experimentation within approved boundaries
• Involve staff in shaping AI policies and best practices
• Share examples of responsible and effective AI use

Creating a supportive culture helps balance innovation with accountability, ensuring AI is used to enhance, not undermine, the quality of care.

Work with trusted technology partners

Choosing the right partners is critical. Health and social care services should look for software providers that:

• Understand the health and social care sector
• Prioritise data security and governance
• Offer transparency in how AI tools operate
• Support organisations in aligning with regulatory requirements

Working with trusted partners helps ensure AI adoption is sustainable, compliant and aligned with organisational values.

The range of shadow AI tools continues to expand.

• Generative AI chatbots - used to draft emails, create reports, summarise meetings and answer questions.
• AI writing tools - used for blogs, marketing content, policies, presentations and social media.
• AI coding assistants - used to generate code, troubleshoot issues and speed up development.
• AI image generators - used by creative teams to produce graphics and marketing materials.
• AI productivity platforms - used for note-taking, transcription, meeting summaries and workflow automation.

While these tools offer real value, they require clear governance to ensure safe use.

As artificial intelligence becomes more embedded in everyday operations, governance is becoming just as important as innovation.

The health and social care providers that succeed will not simply be those adopting AI at pace, but those using it in a way that is transparent, accountable and aligned with regulatory expectations. This is particularly critical in health and social care, where the use of technology must support safe, high-quality, person-centred care.

The focus should not be on restricting AI adoption. Instead, organisations need to create the conditions for AI to be used safely, ethically and with clear oversight, ensuring that innovation supports both operational performance and the wellbeing of care recipients.

Organisations that take this approach are more likely to build trust, demonstrate compliance and realise the long-term value of AI. In practice, this means establishing:

1. Clear AI strategies - Defined objectives for how AI will be used, aligned to organisational priorities such as improving care quality, supporting staff and enhancing efficiency.
2. Transparent governance frameworks - Clearly documented policies, processes and accountability structures that ensure AI use is visible, controlled and regularly reviewed.
3. Secure and responsible data management - Strong data protection practices that support lawful processing, confidentiality and alignment with UK GDPR and the Data Protection Act 2018.
4. Appropriate human oversight - Ensuring that AI supports professional judgement rather than replacing it, particularly in decisions that impact care delivery and care recipients.
5. Responsible usage policies - Practical guidance that helps staff understand how to use AI safely, including what data can be shared and how outputs should be validated.
6. Trusted technology partnerships - Working with providers who understand the health and social care sector and prioritise security, transparency and regulatory alignment.

Ultimately, governance enables organisations to move from reactive risk management to proactive, confident AI adoption, where innovation and accountability work together rather than in tension.

1. What is Shadow AI?

Shadow AI is the use of AI tools at work without formal approval or oversight. This often includes employees using public AI platforms outside approved systems.

2. Why is Shadow AI a risk?

It limits organisational control and visibility. This can lead to data exposure, compliance issues and unverified AI outputs being used in decision-making.

3. What are examples of Shadow AI in care?

Common examples include uploading care plans into public AI tools, drafting safeguarding reports using AI and analysing rostering or EVM data in unapproved platforms

4. Is Shadow AI illegal?

Not in itself. However, it can lead to breaches of UK GDPR if personal or sensitive data is shared unlawfully.

5. Why do employees use Shadow AI?

Mostly to save time and improve productivity. It is often driven by easy access to tools and a lack of approved alternatives.

Shadow AI is a natural result of rapid technological change. While employees use AI to improve productivity, organisations must ensure these tools are used within clear governance frameworks that protect data, support compliance and maintain transparency.

Understanding what Shadow AI is, recognising its risks and implementing approved solutions are essential steps towards a safer approach to AI adoption.

Here at The Access Group, we support organisations in transitioning from Shadow AI to trusted, governed use of artificial intelligence. Evo for Care, our next-generation platform for care organisations, brings together:

• Operational oversight
• Compliance and reporting
• Workforce management and rostering
• Intelligent, AI-driven insights

All within a secure, connected environment designed to support transparency and accountability. Rather than relying on disconnected tools operating outside governance, care services can adopt integrated platforms that balance innovation with control.

Contact us today to learn more about how Evo for Care can support responsible AI adoption, or book a personalised demo to see it in action.