What is shadow AI, and how can we reduce it without banning AI?

Microsoft defines shadow AI as workplace AI use without IT visibility or approval. Reduce it with approved tools for useful tasks, clear data rules, and tested access, approval and recordkeeping controls.

​

What is shadow AI, and what actually goes wrong?

Microsoft warns that unmanaged AI use can expose data, create security vulnerabilities, violate compliance requirements and leave work without an audit trail. Start by asking employees which tasks need AI and where approved tools failed them. Record the tool, account, data and actions involved. Help people move the task into an approved environment. Consider an analyst uploading a customer margin workbook to a personal assistant account. The team needs answers to four questions:

• Was the account approved for customer data?
• Which contract governs the upload?
• Who can retrieve the interaction record?
• Who checked the resulting figures?

Approve the task, data class, work account and model route together. Assign a reviewer to check material figures against the original workbook. Record the version they approved.

​

Which AI governance framework should we use?

NIST’s AI Risk Management Framework is voluntary, with four iterative functions. Govern applies across Map, Measure and Manage.

• Govern: Assign owners, approval authority and policy responsibilities.
• Map: Describe the task, data, affected people and possible failures.
• Measure: Test access boundaries, output quality and review coverage.
• Manage: Approve, restrict, improve or retire the use.

Connect each risk to an owner, a control and evidence that the control works. Name who approves customer-data analysis and what they must inspect. ISO’s ISO/IEC 42001:2023 sets requirements for an AI management system for organizations providing or using AI. Consider it when you need formal, repeatable oversight.

​

What should an AI acceptable use policy say?

Publish approved tools beside the policy. Include work accounts, permitted data classes, supported tasks and a help contact.

1. Discover current use. Compare employee reports with procurement, expenses, application inventories and access records. Include embedded AI and local agents.
2. Define allowed data. Specify permitted data classes and approval requirements for sensitive information. Use synthetic data for unapproved trials.
3. Separate drafting from acting. Name reviewers for material outputs. Require approval before consequential sends, publications or system changes.
4. Review accounts and contracts. Check training use, retention, deletion, processing providers and connected access. Record the approved configuration and review date.
5. Set limits and records. Define access scope, spending limits and evidence retention. Name who can inspect logs and revoke access.
6. Provide exceptions and training. Give requests an owner and response target. Teach the approved workflow and how to report accidental uploads.

Example policy clause:

Use approved work accounts for approved tasks and data classes. Obtain approval before uploading restricted information or connecting production write access. Review material outputs before use.

Have business, security and legal owners approve the policy. Pair each rule with a configuration check or review record.

​

How do we audit AI use and test the controls?

Define the tools, teams, workflows, period and criteria in scope. NIST calls for testing before deployment and during operation, with independent review where appropriate.

1. Reconcile the inventory. Compare registered uses with discovery records. Investigate ownerless tools, personal accounts holding work data and unexplained agent access.
2. Select workflows by risk. Sample sensitive data, external actions and material outputs.
3. Test denied access. Use synthetic files with different permissions. Check that unauthorized users and agents cannot retrieve or modify restricted files. Repeat after revocation.
4. Test approvals and budgets. Attempt an action requiring review and check that it waits for the authorized reviewer. Inspect what happens at a spending cap.
5. Trace a completed task. Follow its instruction, inputs, output, changes and approval. Recheck material results and identify the version reviewed.
6. Record and retest findings. Assign each failed control an owner and correction date. Preserve the retest result and escalate unresolved risks.

Keep configuration exports, test results, sampled records and sign-off together. Give the audit owner direct access to these records.

​

How does this compare with ChatGPT, Copilot or Gemini?

Compare the same margin-workbook task in approved work accounts. OpenAI’s ChatGPT Enterprise provides audit records. Microsoft’s Copilot in Microsoft 365 provides audit records. Google’s Gemini in Workspace also provides audit records. Athena also provides audit records.

Full comparison with sources, October 2026

Governance question	ChatGPT Enterprise	Microsoft 365 Copilot	Gemini in Google Workspace	Athena
Access limits	Workspace and feature controls	Microsoft 365 permissions	Google Workspace permissions	Source permissions and range restrictions
Audit records	Audit records available	Audit records available	Audit records available	Audit records available
Review evidence	Logs and metadata	Interactions and references	Gemini interaction events	Saved changes and reviewed-version lineage
Evidence retrieval	Compliance Platform integrations	Purview audit and discovery	Admin search and CSV export	Activity Monitor and audit-log export
Training use	No training by default	Excluded from foundation-model training	Outside-domain training requires permission	No customer-data training

For each option, ask the reviewer to find changed cells, the prior workbook version and approval evidence. Then ask them to export the records. Use the same task and reviewer role for every test. Athena’s Compare in Editor shows saved changes alongside their earlier state. Its lineage connects work to the approver and version reviewed. This supports work-product review alongside the audit records all four options offer.

​

How does Athena put the policy into practice?

Use a bounded pilot to connect policy rules to a working task:

1. Set identity and scope. Athena agents inherit live source permissions, with asset and cell-range restrictions. Test allowed and denied tasks using synthetic workbooks.
2. Choose the model. Select a specific model and configure a backup provider for outages. Athena’s provider agreements include zero data retention and no customer-data training.
3. Cap the run. Create an Athena Agent Operating Procedure, a versioned workflow. Set a dollar limit with max_cost_usd, a model-call limit with max_model_calls, or both in the run’s run_budget when you start it through the API.
4. Inspect saved changes. Use Activity Monitor and Compare in Editor. Athena saves identify the human or agent author, session and message, with audit-log export available.
5. Require tool approvals. Set your workspace’s tool rules so consequential tools ask for approval before they run. Record who reviews them and retest after procedure changes.

​

What to plan for

Discovery can miss personal accounts and unmanaged devices. Record coverage gaps and sampling limits, and assign an owner to improve visibility. The NCSC advises you to avoid sensitive information in public AI queries. Assess the exact business account’s agreement before approving sensitive work. Athena inherits excessive source sharing and does not repair it. Correct over-shared folders before approving sensitive workflows. Ask vendors how long they retain conversations, work products, audit records and backups. Review platform storage separately from model-provider retention agreements. Check output accuracy against source data. Sent email and committed enterprise resource planning rows are examples of Athena actions that cannot be undone. Require review before those actions and keep an incident response plan. Read the full ISO standard before making a conformity claim. Assign owners to interpret legal obligations, test controls and accept remaining risk.

​

Questions teams ask

See it work