The National Cyber Security Centre has warned organisations that unapproved workplace AI is becoming a security problem that cannot be solved simply by telling employees to stop using it, as adoption continues to move faster than many companies’ internal policies and approved technology stacks.

In guidance published on 7 September, the NCSC describes “shadow AI” as artificial-intelligence technology operating outside an organisation’s approved systems and processes. The pattern is an extension of shadow IT, although generative models and autonomous agents introduce additional questions around where corporate information is processed, how long it is retained, and what systems an AI service may be permitted to access.

The agency cites research in which 71% of employees reported using AI tools that had not been approved by their employer. Rather than treating that solely as a behavioural failure, the NCSC argues that staff often reach for unsanctioned technology when authorised services are missing, slow to obtain, or unable to perform the task employees are trying to complete.

Shadow AI therefore becomes partly an adoption problem created by the organisation itself. A company can publish a restrictive AI policy, but if employees are already using models to summarise meetings, rewrite documents, analyse information, or accelerate development work, a policy without usable alternatives creates an incentive to move activity into services that security teams cannot see.

Data can leave established controls

The most immediate risk concerns information passed to consumer or otherwise unmanaged AI services. Corporate documents, customer information, proprietary code, and internal analysis can move outside established data-governance arrangements, where the organisation may have limited knowledge of retention, processing location, model-training practices, or the privacy controls available to individual users.

Once that happens, conventional controls around access, monitoring, encryption, and information lifecycle management become less effective because the organisation no longer has a complete picture of where its data resides. The resulting exposure can extend beyond a cybersecurity incident to intellectual-property loss, contractual problems, regulatory breaches, and difficulties responding to data-subject or audit requests.

AI agents make the problem more complicated because their value often comes from connecting models to other systems. An approved agent might be given access to email, documents, code repositories, databases, or business applications so it can complete tasks, while an unmanaged equivalent can introduce software with unknown security properties into the same environment.

The NCSC warns that vulnerabilities or misconfigurations in agents can give attackers access to the same data, services, and privileges legitimately available to the AI system. Identity and permission design therefore become part of AI security: an over-privileged agent may create a larger blast radius regardless of whether the model itself performs as intended.

Governance has to compete with convenience

The agency is not recommending that employees stop using AI altogether. Its approach is closer to risk reduction, beginning with an understanding of which tools people are using and why before organisations provide approved services that meet genuine operational demand rather than forcing staff towards workarounds.

Security culture matters in that process because punitive responses can reduce visibility. Employees who expect disciplinary action for admitting that they used an unapproved chatbot are less likely to tell security teams what information was shared, while colleagues may learn to conceal similar behaviour rather than bringing it into a managed environment.

The economics of AI adoption reinforce the difficulty. Many useful services are inexpensive or free at the point of use, require little technical expertise, and can be accessed through a browser within minutes, so individual employees can introduce new computing capability without the procurement cycle that previously accompanied enterprise software adoption.

Technology governance is consequently being pushed closer to the speed of ordinary workplace experimentation. Companies that take months to evaluate every new AI service may struggle to keep up with employees, but companies that waive assessment entirely can accumulate a portfolio of models, plugins, agents, and data flows that nobody centrally understands.

The NCSC’s advice also follows its August guidance on agentic AI, which emphasised safeguards, sandboxing, and active oversight when systems are allowed to act with greater autonomy. The two issues increasingly converge as general-purpose workplace models evolve from tools that answer questions into systems capable of calling applications and performing multi-step work.

Shadow AI will be difficult to eradicate because the demand behind it is real, and the NCSC’s guidance implicitly recognises that employees will keep finding useful tools faster than many formal approval systems can process them. A more durable response is to reduce the incentive for workarounds, constrain access appropriately, and make sanctioned AI sufficiently useful that secure adoption can compete with the convenience of opening another browser tab.