Shadow AI is rarely rule-breaking; it is usually a missing rule. In a survey of 48,340 people across 47 countries, 38% of employees had already used AI at work without knowing whether they were allowed to — 41% have no rule about it at all, and 19% do not even know whether one exists.
The proportions are surprising. The same survey finds that 70% of employees use a free, public AI tool for work, while only 42% use one their employer hands them — and a mere 6% work under a policy that bans generative AI. So the "everyone bans it and they use it anyway" story is false.
The most common misconception is "we do not have that here, because we do not allow it". By the data that is the worst state of all: there is no sanctioned route and no discovery either — 68% of breached organisations had no tooling whatsoever to detect shadow AI.
How to map it in a single day, and what comes after that, is what Shadow AI: The Tools Your Team Already Uses walks you through. Directly related terms: acceptable use policy, DLP and GDPR.