Shadow AI, explained

Shadow AI is when staff use AI tools for work that their organization hasn’t approved or can’t see. The term comes from “shadow IT,” technology used outside the systems IT manages. It usually starts for a good reason: someone has work to get done, and a free AI tool is easy, available, and useful.

What shadow AI looks like day to day

Pasting a staff report into a personal AI account to shorten it
Using a free AI app on a phone to draft a reply to a resident
Uploading a spreadsheet to get a quick summary of the numbers
Asking AI to rewrite an internal memo before it goes to council

The task itself is ordinary. What makes it shadow AI is that the organization doesn’t know which tool is being used, what information went into it, or how that information is handled.

Why it’s more common than most leaders think

AI doesn’t feel like adopting new technology. There’s nothing to install and nothing to request. Open a browser, sign in with a personal email, and start typing.

And what staff paste in is rarely trivial. In GovAI, half of all messages start with staff pasting in their own documents, and nearly half include sensitive information. There’s little reason to think staff paste less on a personal account, where nobody is watching for it.

When IT leaders tell us why they started looking for an approved AI tool, shadow AI is the reason we hear most often. They knew staff were using personal accounts for city or county work, and they wanted that risk closed.

Source: GovAI messages from US and Canadian local governments, to August 2026.

What it puts at risk in local government

When city or county work goes into a tool the organization can’t see, basic questions become hard to answer:

Which documents or resident details went in?
How long is that information kept, and where?
Can it be used to train AI models?
If a records request asks for everything written about a topic, can anyone find what was written in AI?
If a council member asks how staff use AI, can anyone answer?

Someone using AI is fine. The risk is that nobody can see how it’s being used or what’s being shared.

A typical case

A planner has a 40-page staff report due Friday. On Wednesday night she pastes the draft into a free AI app on her laptop and asks it to tighten the executive summary. The draft includes an applicant’s name and a neighbor’s complaint with their address. The summary is good, and she uses it.

Nothing went wrong that night. But the organization now has a public document partly written in a tool it doesn’t control, with resident details sitting in an account it can’t see. If that report is challenged, nobody can show what went into it.

Why a ban doesn’t fix it

The first reaction is often to block AI sites or write a policy saying “don’t.” Staff who need the help keep using AI on their phones or at home. The use doesn’t stop. It just moves further out of view.

What brings it back into view is a better option: an approved tool that’s as easy to use, rules staff can remember, and training on the work they already do.

What to do about it

If you’re on staff: find out which AI tools are approved for work and what your organization’s rules allow. If you’re unsure, ask before putting organizational information into a tool.

If you lead a team or department: ask your team what they use AI for today, without judgment. The answers show you which jobs to support first.

If you’re in IT or leadership: give staff an approved place to use AI, with clear rules and someone who can see how it’s used. In GovAI, your content stays yours and isn’t used to train AI models, sensitive information is flagged as staff type, and when a records request comes in, our team exports the records for you.

Try this week

Ask five people in different departments one question: “If you needed help rewriting something at 9pm, what would you open?” If the answer is a personal app, you have shadow AI. Then give them somewhere better to go: Where should our local government start with AI?