What Is AI Shadow IT?
Key takeaways
- Free tiers of hosted AI assistants are the most common source of AI shadow IT in Indian firms, because the sign-up takes under a minute and the data leaves instantly.
- The data that leaves is usually the data that matters: customer spreadsheets, employee details, pricing, source code and unreleased product plans.
- Contractual terms of free consumer AI tools often let the provider process your input, which makes an unapproved tool a data processing question, not just an IT one.
- Discovery works better than prohibition, because a ban without a sanctioned alternative just moves the tool onto personal phones and personal laptops.
- Under the DPDP Act 2023 and the CERT-In directions, every tool that touches company or customer data needs to be in the vendor assessment and access control scope.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is AI shadow IT and why is it growing in Indian companies?
AI shadow IT is any artificial intelligence tool used for company work that has not been approved, contracted or assessed by the company. In practice it is employees signing up for a free hosted assistant, installing a browser extension, or pasting data into a public chatbot because the tool is free, fast and good at summarising. It grows faster than any policy because the cost of trying is near zero and the benefit is immediate. The problem is not the tool itself. It is that the company has no contract, no visibility and no way to remove the data once it has been pasted in.
What data actually leaves the company?
Whatever somebody pasted. In a typical week that is a customer list with phone numbers, an HR spreadsheet with salary and address details, a bank reconciliation file, a design file, a product roadmap, pricing, and sometimes source code or a customer database extract. The DPDP Act 2023 exposure follows the personal data out of your control, and once it is in a third-party model, the deletion request you may need to make later is hard to honour. Treat any paste of customer or employee data into a free tool as a reportable incident, not a minor mistake.
How do you discover AI shadow IT in your own company?
Use four methods together. Browser and endpoint telemetry, which shows which AI domains and extensions are actually being visited, gives you the real list rather than the one people volunteer. A traffic and DNS report from the mail and web gateway identifies uploads to unknown file-sharing and AI endpoints. A cheap internal survey that asks directly which tools people use, which gets surprising answers from senior people. And a network search for unauthorised API keys, because a developer who pasted a company key into a tool has created a channel that no policy will see.
What should a workable AI policy look like in India?
Three tiers, not one ban. Tier one is a short list of approved tools with a clear business purpose, ideally a business-tier contract with the vendor covering data retention, no training on your input, deletion on request, breach notification and data residency. Tier two is a permitted-use list by data class: public and internal information may go into an approved assistant, while customer personal data, financial records, credentials and unreleased product information may not, and must be handled with a tool that meets the DPDP Act 2023 obligations. Tier three is the enforcement and the incentive: keep a single sanctioned tool free and easy, so people do not route around the policy, and make the approved path the fastest one.
| Tier | Tool status | Data allowed | Control |
|---|---|---|---|
| Approved and contracted | Business tier with signed agreement, no training on your input, deletion on request | Internal and customer data within the agreement | Published allowlist, full logging |
| Permitted with limits | Approved but restricted to certain data classes | Public and non-sensitive internal information | Browser and endpoint controls, training |
| Blocked | Free consumer tools, unknown extensions, personal accounts | Nothing company related | Gateway block, endpoint policy, sanctions |
| Discovery and review | New or unknown AI domain seen on the network | None until reviewed | Telemetry, quarterly vendor review, register update |
What are the frequently asked questions?
Get a straight answer on this
Send us the AI tools your team has already signed up for, and we will return a fixed-price discovery and vendor assessment with a tiered acceptable-use policy you can publish.
Send us the details See pricing