In short
An analyst needs to summarise a long contract before a meeting. The assistant approved by the company does not exist, or it exists and has no access to the documents. She opens an AI tool in the browser, pastes the contract and gets the summary in seconds. The task is done, and the contract, with its amounts, clauses and the customer's name, now sits in a service the company never contracted, never assessed and does not monitor. This pattern has a name: shadow AI. It grows because demand for AI reached companies before the structure to meet it. The answer involves offering an approved path with access to the company's context, and that is where the Company Brain comes in, the layer that knows the company: what data exists, where it lives, how it relates and who can see what.
Shadow AI, also called invisible AI or parallel AI, is the use of artificial intelligence tools and applications by employees without formal approval or oversight from the technology or security team. The most common case is a personal generative assistant used to draft, summarise, translate or analyse work material.
The definition also covers less obvious situations:
The core issue is the lack of visibility. The company does not know which tool is in use, what data goes into it, what the vendor does with that data and which decisions are being made based on the answers.
The phenomenon has a well-known predecessor. Shadow IT is the use of software, cloud services or equipment without IT approval, such as personal file storage or a project management tool paid for on a manager's card. The motivation is usually the same: the official solution is slow, inadequate or missing.
Shadow AI adds two layers to that problem. The first is where the data goes. A file kept in a personal cloud is still just a file, whereas text sent to an external model may be logged, reviewed by third parties or used for training, depending on the service's terms. The second is how the output is used. The parallel tool produces answers that end up in emails, proposals, analyses and decisions, with nobody knowing where the information came from or whether it is correct.
Shadow AI rarely comes from bad faith. It comes from people trying to work better with what they have at hand. The reasons repeat from company to company:
The last reason is the least discussed and the most important. When the approved tool answers in generic terms because it has no access to the contract, the CRM or the ticket base, the person goes back to the parallel tool and takes the data there. The lack of context in the official solution pushes the data out.
Parallel use takes different forms depending on each team's work:
Data leaks get their own section just below. The other risks tend to surface later, once the use has already spread across the company.
Personal data of customers and employees sent to an external service with no legal basis, no vendor assessment and no record of the processing puts the company at odds with Brazil's data protection law (LGPD), which requires a defined purpose, security measures and control over who processes the data. Customer contracts usually have confidentiality clauses that are also breached when the customer's material is pasted into an unauthorised tool. In regulated sectors, such as finance and healthcare, the use may go against specific rules.
The answer from a parallel tool arrives with no traceability. Nobody knows whether the number came from the right spreadsheet, whether the model filled a gap with an estimate or whether the policy it cites is the current version. When that content goes into a sales proposal or a report for the leadership, the error starts circulating with the authority of an official document.
Each team adopts its own tool, with its own prompts and its own way of using it. The company loses the ability to standardise quality, to learn from what works and to reuse what one area has built. Knowledge about how to use AI well ends up scattered across personal accounts.
Individual subscriptions reimbursed as expenses, tools duplicated across areas and workflows that depend on a service the company never contracted add up to a cost that appears in no technology budget. It only becomes visible when the tool changes its price, its terms or goes offline.
A wrong answer sent to a customer, a text that mixes up information from two customers or a publicised leak all affect the trust the market places in the company. The damage usually outweighs the productivity gain that motivated the use.
A shadow AI leak rarely involves an attack. It happens when someone pastes text into a chat box. The contract, the margin spreadsheet, the source code or the customer list leave the company's perimeter in a single action, with no alert and no record.
Once sent, the data is subject to the vendor's terms. Depending on the service and the plan, the content may be stored in the account history, retained for a period for monitoring, reviewed by the vendor's staff or used to improve models. The company did not negotiate those terms, does not know which country the data is in and has no contractual right to demand deletion. If the employee's personal account is compromised, the chat history, with all the work material pasted into it, is exposed along with it.
The size of the problem already shows in incident data. The 2025 edition of the Cost of a Data Breach report, published by IBM, found that one in five organisations studied reported a data breach linked to shadow AI. Companies with heavy use of unauthorised AI had an average cost per breach US$670,000 higher than those with low or no use.
There is also a less visible form of exposure. Agents and automations connected to email, drive or CRM on someone's own initiative receive broad permissions in order to work. They start reading, and sometimes writing, across entire systems, with a level of access that no security review ever approved.
Many companies' first reaction is to block public tools on the corporate network. The block reduces use in the office and does little about the personal phone, the home network and the laptop with no security agent. The demand that drove the use is still there, and the data starts leaving through channels that are even less monitored.
Blocking has a place in a broader strategy, especially for tools with unacceptable terms of use. On its own, it treats the symptom. The underlying problem is that people need AI with access to company data to do their work, and the company does not yet offer that safely.
The companies that handle the problem best combine governance with an official alternative that is more useful than the parallel one. Governance measures form the base:
These measures put order into the use. Adoption depends on the official tool solving the problem that drove people to the parallel tool, and that problem is usually a lack of context.
A corporate assistant with no access to company data answers in generic terms, and the person goes back to pasting the contract into the external tool. The Company Brain closes that gap through its architecture. It connects CRM, ERP, helpdesk, contract management and documents once and organises that data in a knowledge graph, with the business ontology defining what each term means and the semantic layer translating the question into the right query.
As a result, the model the company approved starts answering with the current contract, the customer's history and the current policy, without anyone having to copy and paste. The context is served to models over MCP, the open protocol that connects models to data sources. The data stays in the company's systems, and at the moment of the question the model receives only the slice it needs.
Governance travels with the data. Permissions are inherited from the source system, and each person gets through the AI only what they can already see in the CRM, the ERP or the drive. Every answer points to the source the information came from, which gives the security team back the visibility that shadow AI takes away: who asked, about which data and with what result.
There is also an effect on cost and model choice. Because the context arrives organised, a good share of tasks runs on lower-cost models, and switching vendors does not require redoing integrations. The decision about which model to use, on which terms and for which data, goes back to the company.
Mapping parallel use works as a survey of demand. The tasks people most often take to external tools, such as summarising contracts, replying to customers or analysing month-end spreadsheets, show which data and which questions the official path needs to handle first.
Starting with one of those tasks, with the sources connected and permissions inherited, delivers an approved alternative for a use that already exists. The AI policy makes practical sense when the rule comes with a tool that does the job better than the parallel one, and each following use case reuses the context the Company Brain has already organised.
