In the IT departments we meet, the same finding comes up again and again: every week, someone discovers that an employee has used a personal account on a consumer assistant. The market calls it shadow AI, and the first response is often defensive: block and monitor. We think the cause lies elsewhere, in the company's own AI offer. When the internal assistant is restricted or weaker than the one people use at home, teams go to ChatGPT with their personal account. This article defines the term, explains what gives rise to it, then shows how to make it recede: look at what teams do with the AI tools the company gives them, and cover what is missing.
Shadow AI: definition and causes
What is shadow AI?
The term covers the use, by employees, of artificial intelligence tools the company does not provide: a consumer assistant used from a personal account, sometimes paid out of their own pocket, or an AI app installed on their phone. It is modelled on shadow IT and comes from the security world. Two other cases are sometimes included: an agent built by a business team without being declared, and an AI feature switched on in business software without anyone attaching it to a budget. Those two cases usually run on tools the company administers, which makes them possible to find. Personal accounts sit outside everything the company administers.
Why do employees use their personal AI accounts?
Because the company does not give them the AI they need. Either there is no company assistant, or it arrives late, it is restricted or weaker than the consumer version, and nobody has shown the teams what it is for. Two mechanisms widen the gap. Several teams move in parallel, each on its own scope: the same need ends up handled on three tools, and a fourth, personal one fills the gaps. The bill is split across licences, model consumption and AI features bundled into business software, so nobody sees that a paid tool is barely used. The employees involved want to do their job better with what works; they are not trying to get around a rule. Their choice tells you something about the company's offer, provided you read it.
What a company loses without measuring usage
What does a company lose when it cannot see its AI usage?
First, the ability to measure return on investment. 30 to 50% of AI initiatives do not deliver what they should: Gartner counts at least 30% of proofs of concept abandoned, and more than 80% of the companies McKinsey surveyed do not yet see an effect of generative AI on their operating income. Without a company-wide view, there is no way to know which side of that statistic your own projects fall on. Next comes the full cost of AI, licences and consumption included: it stays unreadable as long as usage is not consolidated across tools. Waste follows the same path: it cannot be seen, so it cannot be cut.
What does shadow AI reveal?
It shows where demand exists and where the company's offer does not serve it. A paid licence nobody uses and a personal account opened every day often describe the same problem: a company AI that does not meet the need. So we ask one question: what does the company not provide, which sends teams elsewhere? The answer is a deliverable of the audit in its own right: unmet demand. It shows in what teams do with the company's AI tools, where they give up (tasks dropped halfway, repeated questions, teams that do not come back), and it is confirmed in interviews.
Should you block the tools the company does not provide?
Blocking alone moves the problem. Usage carries on on personal devices, out of sight, and the company loses the information about the need. Shadow AI recedes when the company's AI becomes simpler and more useful than the personal account. That means knowing what your teams do with the tools you give them, fixing what makes them drop off and opening the uses that are missing. A usage policy has its place in this. It holds better when the company offers a real alternative, and when its rules rest on measured facts.
Measuring what your teams do with the AI you give them
How do you measure the use of your AI tools without installing anything?
We start from the logs and exports you already produce, on the platforms you administer: Azure OpenAI and internal models, Dust, Copilot, custom agents. Nothing installed on workstations and no re-instrumentation: export handover or a read-only connection, with the exact method decided in the scoping meeting. Idun Cockpit, our measurement tool, consolidates these logs into a single reading of every AI tool you make available: detected use cases with estimated return on investment, licences actually used, identified waste, full cost of AI. It also shows where these tools disappoint: dead ends, missing knowledge, teams that give up. That is where shadow AI is most likely to take over. Independence matters as much as method: no Idun product is ever recommended in the deliverables. The analysis serves your decision; it does not push a tool.
What do logs give, and what do interviews give?
Logs give the facts: which uses, how often, at what cost, with what error rate. Interviews give the intent and the context: why a use exists, for which process, under which constraint. Scoping interviews with the IT department and business leadership are a mandatory step of the engagement: the tool does not replace them, it makes them factual. The combination of the two is what makes the audit. A purely automatic analysis would miss the context; interviews alone would remain impressions.
What about consumer AI on personal accounts?
We do not collect this data, and Idun Cockpit does not see it. An assistant used from a personal account sits outside the platforms you administer: claiming to measure it would mean looking at workstations or network traffic, and we do neither. We name this blind spot and address it through the question of the internal offer: what do you not provide, which sends teams elsewhere? The answer is a deliverable of the audit; it does not claim to be a measurement.
Usage, never people
How does the analysis respect employees?
Fear of individual monitoring is legitimate, among employee representatives as well as executives. Our answer fits in one sentence: we analyse usage, never people. In practice: results aggregated by team and by tool, never by person; the exact status of the processing is validated with your data protection officer. Read-only, no writing to your systems. No access to data before signature: pre-sales happens in meetings. No workstation scanning. No imposed re-instrumentation: we use existing logs. The French validation steps, data protection officer and works council consultation, are all the easier to prepare when the setup is designed this way from the start.
Where is the data processed?
By default, the analysis runs in our environment located in the European Union, on encrypted storage, from the exports you provide. If your data protection officer or your security policy requires it, the pipeline runs within your perimeter and the data never leaves your premises. The method is decided in the scoping meeting. An isolated network remains possible as an on-premises deployment. This flexibility meets frequent legal requirements without turning the engagement into an infrastructure project.
From findings to decisions: rationalising the AI estate
How do you move from measurement to decisions?
The readout says what to scale first, what to cut and who to train on what. It also spots duplicates: the same use case detected on three tools calls for a single implementation. For shadow AI, the decision is about the company's AI offer: improve the assistant in place, replace it, or open the missing use. Licence decisions are timed with renewals. Everything is laid out in a roadmap, with a report ready for the steering committee. On the cost side, four cumulative levers drive optimisation: model routing, caching, context compression, cutting waste. Target: 30 to 50% lower cost on the targeted uses and 2 to 4 times fewer errors.
Where does compliance fit in this approach?
A substantive argument, which comes after value. The European regulation on artificial intelligence sets obligations according to each system's risk level, which assumes you know which systems you use; the deadline for high-risk systems has been pushed back to December 2027. Usage measurement built to steer value serves that need along the way for the tools the company makes available: their inventory exists, up to date and documented. Approaching the subject through value rather than obligation changes the internal dynamic: teams cooperate more readily with an approach that improves their tooling than with a defensive exercise.
Where to start?
Three signals justify launching an analysis: a licence renewal to decide on, AI costs the finance department cannot read, a newly appointed head of AI who has to draw up the inventory. For shadow AI, the signal is simpler: a company assistant that teams abandon for their personal ChatGPT. The process starts with a 30-minute discovery call, followed by scoping with the IT department and business leadership, then the analysis of your logs and the readout. Our services page details the engagement: the audit of real AI usage, then Idun Cockpit on a subscription if you keep it. To see how we work, our AI agency page presents the firm and its method.
