Glossary · Technology
Shadow AI
The use of AI tools by staff without the organisation’s knowledge or approval, often with data that should not leave it.
- Field
- Technology
- Examined in
- CBA-AIG, CBA-AIM
- Learning objectives
- 2
Where the CBA Standards examine it
AI Governance ProfessionalCBA-AIG
In the specimen paper
Two analysts at Al Batinah Freight have quietly stopped using the approved tool and gone back to an unapproved one on their own accounts. The control exposure is real and must be dealt with. What should the manager do first?
Answer
Ask what the approved route costs them, then close the control gap.
Why that is the answer
Two experienced people with no reason to make trouble have run an unsupervised comparison on live work under real deadlines, and the approved route lost. That is better evidence about the approved route than any pilot the firm has commissioned, and it exists only until the matter is framed as a breach. The exposure is genuine and must be closed, so the question is not whether you act but in which order: ask first, because the question is free and the information does not survive enforcement. Then close the gap on the strength of what you have learned.
Related terms
- Acceptable use policyTechnology
An organisation’s rules on which AI tools staff may use, for what purposes, and with what data — including what must never be entered into an external service.
- AI system inventoryTechnology
A register of every AI system an organisation uses or builds, recording what each does, the decisions it informs, its owner, its data and how its outputs are checked.