Cybersecurity Policy Report, U.K. Cyber Agency Warns About Cyber Risks From ‘Shadow AI’, (Sep 8, 2026)
By Tony Foley
The use of unapproved AI (artificial intelligence) tools by employees in the workplace, commonly referred to as “shadow AI,” presents serious cybersecurity risks for organizations, according to a recent blog post from the United Kingdom’s National Cyber Security Centre (NCSC).
Shadow AI refers to the use of AI technology that is not captured in an organization’s approved systems and processes, the blog said. Research indicates that the use of shadow AI is widespread, with one study suggesting that 71% of employees reported using AI tools that had not been approved by their employer. The NCSC said organizations were likely to continue to see employees use shadow AI.
The NCSC identified the following cyber risks associated with shadow AI:
Exposure of sensitive information, increasing the risk of data breaches;
Loss of visibility and control of data for organizations, because information provided to a consumer AI service may be stored, retained, or used to improve the service outside established security and governance arrangements; and
Creation of new opportunities for attackers, potentially giving them access to the same data, services, and privileges to which the consumer AI agent has access.
The NCSC urged employees to choose wisely when sharing data with AI apps. While it may feel natural to continue using an AI agent that employees are familiar with based on personal use, using systems that are not corporately approved can lead to real risks for the employer.
For organizations, the NCSC recommends that they ensure that employees have access to AI tools that meet their needs while managing cyber risks appropriately. The use of shadow AI is unlikely to disappear, but organizations can reduce their risk exposure by adopting a positive cybersecurity culture and securely integrating AI systems into the workplace.
“You cannot manage what you do not know,” the blog concludes. “By raising awareness of the risks of shadow AI use within your organisation and understanding the needs of employees, you can help them get the benefits of new technologies while using them securely.”
News: InternationalLegislation DataSecurity AINews