Shadow AI: Why Employees Hide AI Use and How Training Fixes It

An old friend told me her company completely banned AI. That surprised me because a lot of companies are encouraging AI use now. She works at a law firm, and the reason was that one of the employees had pasted a client file with confidential information into ChatGPT.

I get why the company did that. Nobody wants client data ending up in the wrong place after all. But I also thought, does banning AI really solve anything? People can still use it on their phones or personal laptops. They might just stop talking about it at work.

In fact, a study by KPMG and the University of Melbourne found that more than half (57%) of employees hide their AI use and present AI-generated work as their own. At the same time, only 47% of them have received AI training at all. 

I found this interesting because most see the AI shadow as a security problem. Of course, companies need rules to protect their data. But employees also need to know how to use AI safely, which tools are allowed, and what they should never share with the tools.

Otherwise, you can ban AI all you want, but people will still find ways to use it. And that is why I think shadow AI is not just a security problem. It is also a training problem.

In this article, you will:

• Understand what shadow AI at work is, with real examples and the risks it creates
• See the six reasons employees go around the rules
• Get the best practices from other organizations to bring AI use into the open, with examples of how other companies managed it. 

What is shadow AI at work?

Shadow AI is any use of AI at work without the approval, knowledge, or oversight of the company. That covers two different things, and I find it useful to split them, because each one needs a different fix.

And shadow AI is way more common than you think. Because

• 78% of employees use AI tools their employer did not provide
• More than half mention they would find and use other AI tools if the company does not provide them
• 32% of employees who use AI keep their use secret from their employers. 

You may think, why do the numbers range from 32% to 78%? Because the surveys measure different behaviors. Using an unapproved tool (tool shadow) is far more common than actively hiding AI use (disclosure shadow). When you size the problem in your own company, ask about both separately.

• How can shadow AI happen even if you control it?

If we do not go too far, we can see it with the Samsung example. In April 2023, Samsung engineers accidentally leaked internal source code by uploading it to ChatGPT. In one of the incidents, the engineer pasted the source code to find a bug. OpenAI did not have the enterprise tier at the time. 

Samsung responded by banning generative AI tools on company devices and networks, warning that breaking the rule could lead to termination. But banning is not the answer because if employees need to use AI tools, they can find alternatives anytime. 

As a solution, Samsung said it would build its own internal AI tools. So, apart from banning, make sure you have a solution for that problem, which is either having internal tools or policies and AI training. 

• Why is shadow AI risky?

"Employees are using AI tools without their bosses' knowledge to boost productivity. It is crucial for employers to assume this is happening, regardless of any restrictions, and to assess the use of AI to ensure it complies with their security and governance standards."

Brooke Johnson, Chief Legal Counsel and SVP of Security and HR at Ivanti

• Data leaks and fines. In IBM's 2026 Cost of a Data Breach Report, 43% of breached organizations reported a shadow AI incident. And those incidents cost $5.39 million on average (up from $4.63 million), and more than one in five organizations paid a regulatory fine.
• Sensitive data in public tools. Almost half of employees admitted using AI in ways that go against company policy, including uploading sensitive company information into free public tools.
• Invisible work. When AI use stays hidden, nobody checks the output, and good use cases never spread beyond one person's laptop.

And here's the take I agree with most. Mike Bollinger, global VP of strategic initiatives at Cornerstone, calls shadow AI 

the predictable result of encouraging adoption faster than building enablement

In other words, it is not a people problem. It is a sequencing problem.

Why do employees use AI in the shadows? 6 reasons in the data

I was researching the most recent AI shadow incidents and even found names of companies everybody knows about. So based on that data, here is why I think AI shadow happens. 

1. Employers do not tell employees what is allowed instead

In Slack's Workforce Index, 45% said they do not have explicit permission to use AI. In the WalkMe survey, 51% said they get conflicting guidance on when and how to use it. 

If your company's only AI rule is "do not use AI," employees are left to figure out the rest themselves. I would ask whether I could still draft my emails with AI, or whether I can summarize our meetings with AI. Because if we are honest, AI can mean a bunch of things. So unless it is explicit, the employee will make their own rules. 

• How to deal with this? 

Create an AI policy employees can actually follow.

Give employees specific examples of permitted and prohibited uses, identify approved tools, explain which data they can share, and tell them who to contact when they are unsure.

For example, Colgate-Palmolive has published an AI policy that covers data privacy, confidentiality, accountability, fairness, and responsible use.

Or you can create a short microlearning course where you explain the cases of use and include it in your onboarding training program. 

2. Employees are never trained

Only 7.5% of employees in the WalkMe survey had received extensive AI training, and 23% had none at all. 64% of US employees feel encouraged to use AI, but only 44% have received any training.

I think this is where L&D needs to get involved. Employees can learn how to use ChatGPT in a few minutes, but that does not mean they know how to use AI properly for their jobs.

• How to deal with this? 

Train employees on the tasks they actually perform.

Instead of giving everyone the same introductory course and calling it a day, identify the tasks where AI could help each department, run a training needs analysis, and provide training for each group. 

For example, Moderna launched its AI academy. 

“AI Academy is intended to educate and empower employees at all levels to identify and integrate AI and machine learning solutions into every Moderna system and process to bring mRNA medicines to patients”.

3. Employees are afraid of looking incompetent

Nearly half (48%) of desk workers in the Slack study would be uncomfortable telling their manager they used AI for common tasks. Their top reasons were that it feels like cheating and fear of looking less competent (46%) or lazy. 

So, even if you give employees an approved tool and train them to use it, they might still hide it if they think their manager will judge them for it.

• How to deal with this? 

Managers need to explain what responsible AI use looks like in their teams. If an employee uses an approved tool to prepare a first draft, checks the information, improves the result, and takes responsibility for the final work, that should not automatically be treated as laziness or cheating.

4. Employees fear more work, or no work

Ivanti's 2025 report found that 30% of employees who hide their AI use worry their job may be cut. Across all employees surveyed, 29% worry AI will make their skills look less valuable. Even more telling, 52% of office workers agree that when they work more efficiently, their employer simply gives them more work.

If an employee believes that AI will make them replaceable, or that finishing their work faster will only earn them more tasks, why would they be eager to tell their manager how they do it?

How to deal with this?

Managers should discuss which tasks AI may change, which skills employees will need, and how the company plans to use the time saved. If employees are expected to take on new responsibilities, give them the training and support to handle them.

In my team, we also recognize employees who identify useful AI applications, share their automated workflows, or help colleagues learn new skills. 

5. Employees want to keep their AI skills as a competitive advantage

The most common reason in the Ivanti data was the "secret advantage": 36% of employees who hide their AI use say they like it. Software AG's study of 6,000 knowledge workers found 47% believe AI tools will help them get promoted faster.

Again, you should give employees a reason to share what they have learned. In my team, we organize internal workshops where employees show how they use approved AI tools for real tasks, what they automated, and any useful solution they found that the team can use.

6. The approved tools are missing or worse

In the Software AG study, 33% said they bring their own AI because IT doesn't offer the tools they need. Ivanti found that 46% of office workers use at least some AI tools their employer did not provide.

• How to deal with this?

Start by asking employees which AI tools they already use and what they use them for. You may discover that the company-approved tool lacks a feature they need, or that employees simply do not know what is available to them. Because in our team, we have many tools we have even forgotten about. 

IT and department leaders should evaluate these needs, assess the security and privacy risks, and provide suitable approved tools wherever possible. 

Moderna offers a practical example of this process. In early 2023, it introduced an internal AI chatbot called mChat. But after testing different solutions, the company decided to expand its use of ChatGPT Enterprise. According to OpenAI's account of the partnership, more than 80% of employees had adopted mChat before the company made that move. 

Which shadow AI problems can training actually fix?

Training fully fixes three of the six reasons, and helps with two more. 

Notice that most of the reasons training can fix are about disclosure, not tools. That is a learning and culture issue, which we can solve with proper training. Here is how. 

How to fix shadow AI with employee training: 5 practices

If you do not want the managers or HR to become the AI police, the best way to solve the shadow AI issue is training and teaching the culture.  Here are a few best practices from how different companies handled AI training. 

#1 Make employees pass a short AI safety course before using AI at work

As we have already seen, if employees do not know which AI tools they can use or what information they can share, they are left to figure it out themselves. 

Johnson & Johnson addresses this with a simple rule: employees must complete a generative AI training course before they can use the tools. By early 2025, more than 56,000 employees had completed the training.

Colgate-Palmolive took a similar approach. It started with a short session explaining what generative AI is, which tools employees can use, and how to handle data responsibly. Today, employees must complete AI training to access the company's internal AI platform, AI Hub.

You do not need to build a long course. A 20- to 30-minute introduction is enough to cover the rules everyone needs to know.

You can use the famous traffic light rule in the program. 

• Red: Customer personal data, unreleased financial information, and trade secrets. Never enter these into public AI tools. Use only the secure systems your company has specifically approved for this data.
• Yellow: Meeting transcripts, internal project drafts, and company strategy. Use these only in approved company accounts, following your organization's data rules.
• Green: Public marketing copy, general industry research, and other non-confidential information. These are generally fine to use with approved tools.

#2 Create different learning paths for different roles

Once employees know the rules, they need to learn how to use AI in their actual jobs. Someone working in finance will need different skills from someone working in customer support or a warehouse.

IKEA is a good example of how to approach this. Its AI literacy program starts with AI Fundamentals for all co-workers, then offers additional training, including Responsible AI and Mastering Gen AI. It also runs AI Exploration Days for leaders.

What I find useful about IKEA's approach is that it does not expect everyone to learn the same things. Training is adapted to employees' roles, backgrounds, and comfort levels. Digital teams work on responsible AI assessments, some employees experiment with tools such as the Hej Copilot assistant, and store staff learn about AI-powered automation and analytics.

#3 Teach people to get great results from the approved tools

We have already seen that half of workers use unauthorized tools. But what if they could learn to get results from the tools the company allows? 

Citi took this on directly. In 2025, it made a prompt-writing course called "Asking Smart Questions – Prompting like a Pro" mandatory for about 175,000 employees in 80 markets, with 60 days to finish it. 

The course adapts to what each employee already knows and teaches them to write better prompts for Citi's own AI tools, where employees had already entered more than 6.5 million prompts that year. Peter Fox, Citi's head of learning, described it as teaching "the possibilities of great prompting versus basic prompting." 

Tip: Aim for at least five hours of training in total. BCG found that regular AI use is much higher among employees who get five or more hours, especially with in-person training and coaching. 

#4 Train leaders first, and let people see them use AI

We have also seen that the fear of looking incompetent does not go away with a policy. It goes away when people see their leaders using AI openly. BCG found that the share of employees who feel positive about generative AI rises from 15% to 55% with strong leadership support. Yet only about a quarter of frontline employees say they get that support.

To address this, the BBVA  bank talked about shadow AI directly. Elena Alfaro, BBVA's Head of Global AI Adoption, told OpenAI: 

“Instead of shadow AI… we gave them a platform that was safe so they could start experimenting. And we gave specific training for 250 leaders, including our CEO and chairman.”

Today, members of the executive committee are among the bank's most active ChatGPT users.

To do this in your company:

• Train leaders before the company-wide launch, not after.
• Build the session around their real work, like drafting a board memo or preparing for a difficult conversation with the approved tool.
• Ask each leader to find out the AI tools and workflows that can be automated in their teams. 

#5 Turn your secret power users into peer trainers

As you already know, another reason people hide AI use is that it gives them an edge. You cannot train that feeling away. But you can make sharing worth more than hiding. And employees are open to it, actually. 

BBVA built a whole network around this. Champions from 21 domains and regions, along with advanced users known as AI "wizards," lead hands-on workshops that help colleagues use AI in their daily work. The bank says its champions network has grown to close to 750 employees, and more than 90,000 employees are part of a community of practice that runs its own bootcamps, meetups and mentoring sessions.

“We consider our investment in ChatGPT an investment in our people. AI amplifies our potential and helps us be more efficient and creative.”

Elena Alfaro, Head of Global AI Adoption at BBVA

FAQ

• What is shadow AI at work?

Shadow AI is any use of AI at work that the organization can't see. It includes using AI tools IT hasn't approved (tool shadow) and using AI without telling anyone (disclosure shadow). In the KPMG and University of Melbourne study, 57% of employees said they hide their AI use and present AI output as their own.

• Should companies ban AI tools to stop shadow AI?

Bans rarely work on their own. In the Software AG study, 46% of knowledge workers said they would keep using their own AI tools even if their company banned them completely. Even Samsung, after its 2023 ban, said it was building internal AI tools so staff could use AI safely. A safe, approved alternative plus training works better than a ban.

• Can training alone stop shadow AI?

No. By my analysis of the survey data, training fully addresses three of the six main reasons (unclear rules, lack of skills and fear of judgment), partly addresses two (job fears and the wish for an edge), and cannot fix missing or weak approved tools. 

• How many hours of AI training do employees need?

BCG's 2025 research points to at least five hours, ideally including in-person training and coaching. Regular AI use was sharply higher above that mark. Short, frequent sessions get people there faster than one long workshop.

Bring AI out of the shadows with Uteach as your LMS

Shadow AI is not a sign that your people are reckless. It is a sign they are ahead of your training. They are already using AI. The only question is whether they do it in the open, with clear rules and real skills, or in private, with your client data.

So give people a safe tool, teach them a simple rule, let them practice in short bursts, train managers to welcome honesty, reward the people who share, and measure the change.

If you want to run that program in one place, with role-based courses, assessments, certificates, and progress analytics, book a demo with Uteach.