Employees summarize contracts with a personal chatbot account, connect an AI assistant to a shared drive or build their own agent for a recurring task. None of it went through IT, data protection or the governance team. This is shadow AI, and it has become a measurable risk: 22% of organizations already report unauthorized or shadow AI as an AI-related incident.
The 2026 BARC study “The State of Data and AI Governance”, based on a global survey of 234 data, AI, IT and business leaders, also reveals a regional gap. In EMEA, 29% of organizations report shadow AI incidents, compared with 18% in North America. This post looks at what drives that gap, what shadow AI puts at risk and how organizations can bring it under governed control without slowing down the people who use it.
What is shadow AI?
Shadow AI is the use of AI tools, models or agents inside an organization without the approval, visibility or oversight of IT and the governance team. It includes public chatbots used with company data, AI features switched on in existing software, browser extensions, coding assistants and, increasingly, agents that employees build and connect to company systems themselves.
Shadow AI is a newer form of shadow IT, but the risk works differently. Shadow IT is about unapproved applications. With shadow AI, the critical moment is what happens to the data: content pasted into a prompt, files uploaded for a summary, or an agent that reads, writes and acts on company systems with nobody tracking what it does.
How widespread shadow AI is: the numbers
The BARC study puts concrete figures on a problem that is often discussed only anecdotally:
- 22% of organizations reported unauthorized or shadow AI as an AI-related incident in the past twelve months.
- 17% name shadow AI use as one of the top three obstacles to governing data and AI effectively.
- 29% vs. 18%: organizations in EMEA report shadow AI incidents considerably more often than those in North America.
These numbers are likely a lower bound. According to BARC, shadow AI is a problem that organizations have only begun to recognize. An incident is only reported when someone notices it.
The trend points upward. Knowledge workers use AI every day: document analysis is already the most widely deployed AI use case, at 62% of organizations. And the next wave is agents.
“Given the widespread rush for knowledge workers of all types to deploy their own agents, we believe shadow AI will become a pervasive problem in the coming months. Many agents operate independently, creating governance risk and technical debt.” BARC, The State of Data and AI Governance, 2026
Build a trustworthy data foundation to enable AI-driven automation and reliable decision-making. Download the whitepaper to learn how to establish Data Governance as a strategic capability — and unlock scalable automation and AI.
Why EMEA reports more shadow AI incidents
BARC reads the higher share of shadow AI incidents in EMEA as a sign of weaker central visibility and control. The structural data in the study supports that reading. On almost every dimension of governance organization, EMEA trails North America:
| Governance dimension | North America | EMEA |
|---|---|---|
| Centralized governance structures | 79% | 50% |
| Formalized AI leadership and ownership | 52% | 26% |
| Formalized security standards and compliance | 51% | 26% |
| Formalized enterprise architectural requirements | 35% | 11% |
| Shadow AI incidents in the past 12 months | 18% | 29% |
Without central ownership, nobody sees the whole picture
Where governance is organized centrally or through a center of excellence, there is one place that knows which AI tools are approved, who uses them and with which data. Half of EMEA organizations have no such structure. In a decentralized setup, every department decides for itself, and AI use that nobody registers stays invisible.
Weak data foundations push employees to work around them
The second difference concerns the data itself. 40% of EMEA organizations name inadequate data quality as a top obstacle to governing data and AI (North America: 15%), and 35% cite siloed data (North America: 17%). In our view, this connects directly to shadow AI. When the approved route to data is slow, incomplete or blocked by silos, employees take the faster one: they copy data into whatever tool is at hand.
One caveat applies. A higher share of reported incidents can also mean that more incidents are detected. The structural figures, however, point clearly toward a governance gap rather than better detection.
The BARC study “The State of Data and AI Governance” is based on a global survey of data, AI, IT and business leaders. It shows what separates the AI Leaders from the rest of the market, and which steps turn governance from a compliance exercise into an operating model that lets AI scale with confidence.
The risks of shadow AI
Shadow AI rarely stays a single incident. It opens the door to the other incident types that the study records:
- Data privacy breaches: personal or confidential data ends up in tools outside the organization’s control. 23% of organizations reported an AI-related data privacy breach in the past twelve months.
- Biased or incorrect outputs: 23% reported biased or harmful outputs, and 21% incorrect AI outputs that reached end users or customers. Unapproved tools run without the quality controls and review steps that apply to approved AI.
- Compliance gaps: 77% of organizations say the evolving regulatory environment, such as the EU AI Act and GDPR, has a moderate or significant impact on their AI governance. AI use that nobody has registered cannot be assessed, documented or reported.
- Technical debt: agents built outside governance become part of processes without anyone owning, maintaining or auditing them.
Why banning AI tools does not solve the problem
The first reaction to shadow AI is often a ban on public AI tools. It rarely works for long. AI is already in production at 97% of organizations, and employees use it because it saves them time. A ban removes the approved option, while the need remains. Use moves to private devices and personal accounts, where it is even harder to see.
Shadow AI is a symptom. It shows where the governed path to AI and data is slower than the ungoverned one. The lasting answer is to make the governed path the easier one: approved AI with access to trusted data, under clear rules, with controls that run in the background.
Five steps to bring shadow AI under control
1. Make AI use visible
Start with an inventory: which AI tools, features and agents are in use, by whom, and with which data? Include AI functions inside approved software and agents connected to company systems through APIs or service accounts. Detection tools for network traffic, browser extensions and SaaS connections help, but the inventory only stays current if teams can register new AI use easily and without fear of consequences.
2. Offer a governed path that is faster
Provide approved AI tools and agents that work with the data employees actually need. When an approved assistant can access curated, current company data through governed interfaces, there is little reason to copy that data into an external tool. This is where data quality and integration decide the outcome: a governed path built on poor or siloed data will be bypassed.
3. Set standards centrally, execute locally
The study shows which organizational model works. 69% of organizations run either a fully centralized governance program (31%) or a center of excellence (38%) that sets standards centrally while distributed teams execute. Among AI Leaders, 48% use a center of excellence. This model gives business units room to innovate within shared rules for approved tools, data classes and escalation paths.
4. Put controls on data access, not just on tools
Tool lists go out of date quickly. Controls on the data layer last longer: who may use which data for which AI purpose, under which conditions, and with which audit trail. Today, 34% of organizations use privacy and consent management and 32% use identity and access management or data access controls for governance. For agents, 33% rely on audit logging and 32% on identity and access management. Extending these controls to every AI workload, approved or not yet approved, is what closes the gap.
5. Train people and measure progress
41% of organizations name a lack of skilled personnel or training as their biggest governance obstacle, yet only 12% measure employee training completion. Employees who understand why certain data must not go into public tools, and who know the approved alternative, are the most effective control against shadow AI. Track it: shadow AI incidents, registered AI use cases and training completion belong in the governance metrics.
How SoftProject helps
Shadow AI shrinks when the governed path to data is the fastest one. SoftProject builds that path on one converged platform:
- Connect: integration, ETL and API management bring data together from all systems and give AI tools and agents a governed interface instead of copied files.
- Trust: data governance with data catalog, master data management and data quality makes data findable, reliable and classified, so it is clear which data may be used for which AI purpose.
- Act: process automation and governed agent workflows embed approvals, access rules and audit trails directly in the process.
The result is AI use that is visible, controlled and still fast enough that nobody needs a workaround. For European organizations, data sovereignty is part of the same foundation. To see how shadow AI fits into the bigger picture, read our guide to building an AI governance framework.
Edouard Cante is responsible for the strategic direction and further development of SoftProject’s product portfolio as Chief Product Officer. With a strong understanding of the market and a high level of innovative drive, he advances customer-centric solutions and ensures the company’s long-term competitiveness.
FAQ Shadow AI
What is shadow AI?
Shadow AI is the use of AI tools, models or agents inside an organization without the approval, visibility or oversight of IT and the governance team. Examples include public chatbots used with company data, AI features switched on in existing software, browser extensions and agents that employees build and connect to company systems themselves.
How common is shadow AI?
According to the 2026 BARC study “The State of Data and AI Governance”, 22% of organizations reported unauthorized or shadow AI as an AI-related incident in the past twelve months, and 17% name it as one of their top three governance obstacles. In EMEA the incident rate is 29%, compared with 18% in North America.
Why does EMEA report more shadow AI incidents?
BARC sees the difference as a sign of weaker central visibility and control. Only 50% of EMEA organizations have centralized governance structures, compared with 79% in North America, and only 26% have formalized AI leadership and ownership (North America: 52%). EMEA organizations also struggle more with data quality and data silos
What is the difference between shadow AI and shadow IT?
Shadow IT refers to any software or service used without IT approval. Shadow AI is a subset that concerns AI tools, models and agents. The main risk lies in what happens to the data: company information entered into prompts, files uploaded for processing, or agents that act on company systems without anyone tracking what they do
How can organizations reduce shadow AI?
Bans alone rarely work. Organizations reduce shadow AI by making AI use visible, offering approved AI with access to trusted data, setting standards centrally through a governance program or center of excellence, controlling data access for every AI workload, and training employees while measuring progress.
