Shadow AI AI tools used at work without the organisation’s knowledge.
Short answer. Shadow AI is the use of AI tools at work without the organisation’s knowledge or approval, such as staff pasting client files into a personal chatbot account. It is widespread. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work, and 80% in small and medium-sized companies. IBM’s 2025 Cost of a Data Breach report found that one in five organisations reported a breach due to shadow AI, and that organisations with high levels of shadow AI had breach costs an average of US$670,000 higher. The usual fix is not a ban but an approved tool that is as easy to use, plus a short policy.
01
What it looks like in an office
Behaviour
Example
Risk
A personal chatbot account used for work
A manager pastes a client email thread to get a reply drafted
Client data sits with a third party, outside your records
An AI note-taker joins meetings
An invited bot records and transcribes a partners’ call
Recordings and transcripts leave the building without a decision
A browser extension or add-in
A summariser that reads every page the user opens
It can read client portals and email
Free document tools
A website that summarises or translates uploaded PDFs
The document goes to a service nobody has checked
Apps on personal phones
Voice dictation of case notes
Audio and text go to a consumer service
02
How big it is
The 2024 Work Trend Index from Microsoft and LinkedIn surveyed 31,000 people in 31 countries. It found 78% of AI users bringing their own AI tools to work, 80% at small and medium-sized companies, and 52% of people who use AI at work reluctant to admit to using it for their most important tasks. It puts the behaviour down to a lack of guidance or clearance from the top.
IBM’s Cost of a Data Breach report, published on 30 July 2025, describes shadow AI as unregulated, unauthorised use of AI. It found one in five organisations reporting a breach due to shadow AI, only 37% with policies to manage AI or detect shadow AI, and shadow AI incidents exposing more personal data (65%, against 53% on average) and intellectual property (40%, against 33%). Organisations with high levels of shadow AI saw breach costs an average of US$670,000 higher than those with little or none. Both studies are international, so read them as an indication of scale rather than a measure of your own office.
03
Why bans fail, and what works
Offer an approved tool that is as easy to use as the personal one. A ban without an alternative leaves the need in place.
Write a one-page policy: which tools are approved, which data may never go into outside tools, and who to ask for a new tool.
Train people with real examples from your own work. OWASP advises educating users on safe use of language models and keeping clear policies on data retention, use and deletion.
Make the approved tool visible: log its use, so you can show a client or a regulator how AI is used.
Ask rather than hunt. A short, no-blame survey of which tools people already use tells you what the approved tool must do.
Review every quarter. New tools appear constantly.
04
The law in the background
Using an unapproved tool is not an offence in itself. But the DPDP Act makes a data fiduciary responsible for complying with the Act for any processing it undertakes, or that is undertaken on its behalf by a data processor (section 8(1)), and requires reasonable security safeguards (section 8(5)). The Press Information Bureau’s summary of the Act and Rules says failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore. Whether a particular case of staff using a personal chatbot falls under these provisions is a question for your lawyer. The Act and Rules are being phased in over 18 months from November 2025, so these duties apply from about May 2027. This is general information, not legal advice.
05
Where ANVE stands
One answer to shadow AI is an approved tool inside the office. ANVE is a private AI appliance whose makers run on the box, and every model call is logged with the user, the app, the model and whether it ran locally or in the cloud. Its security page (/security) says cloud models, connectors and agent tools each need an administrator’s approval, so the office decides what can leave the box. It only helps if staff actually use it, so policy and training still matter. ANVE is pre-release.
06
Questions people ask
Is shadow AI illegal?
Not in itself: the risk is what data goes where. If personal data is processed through an unapproved tool, the organisation may still be responsible for it under the DPDP Act once its duties apply, from about May 2027. Ask your lawyer; this is not legal advice.
How do I find out which AI tools staff use?
Ask, with a short anonymous survey, and review browser extensions and network logs for known AI services. Treat what you find as a list of needs that the approved tool should meet.
Should we ban ChatGPT?
A ban with no alternative tends to push use onto personal phones, where you cannot see it. Microsoft’s finding that 78% of AI users bring their own tools suggests the habit is already common. Offer an approved option and set clear data rules.
Does a private AI box end shadow AI?
It removes one reason to use outside tools, if staff find it as useful. It does not stop someone pasting data elsewhere, so keep the policy and the training.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
