The Rise of Shadow AI - Implications for Privacy, Security, and Ethics

Fujitsu / September 11, 2024

AI Computing Converging technologies Digital Transformation Global Responsible Business

Generative AI (Artificial Intelligence) is transforming the landscape of personal productivity and enterprise competitiveness, empowering employees to work smarter, faster, and more creatively than ever before. Organizations have been quick to recognize these advantages. Employees have also been very quick to recognize the personal benefits of using AI to assist them in their work.

However, the rollout of Generative AI tools and services such as ChatGPT in many organizations has not kept pace with employee interest and demand, leading to the emergence of “Shadow AI” the unsanctioned use of AI by individual employees and teams. Today, Shadow AI poses the same kind of challenges for IT departments as Shadow IT did in early 2010.

What is Shadow AI and what issues dose it present
What drives Shadow AI adoption
How widespread is Shadow AI
The Risks of Shadow AI Utilization
Recommendations
Conclusions

What is Shadow AI and what issues dose it present

Shadow AI refers to the unauthorized adoption and use of AI tools and services, like ChatGPT, by employees without IT department approval. While employees may be motivated by good intentions seeking to enhance their productivity and capabilities, Shadow AI poses significant problems for organizations.

Without proper IT oversight and safeguards, Shadow AI introduces a range of legal, regulatory, reputational, and operational risks. For instance, the EU’s General Data Protection Regulation (GDPR) requires explicit consent for data usage. Organizations that breach these regulations can face fines of up to €20 million or 4% of the company’s annual global turnover from the preceding fiscal year, whichever is higher.

Furthermore, Shadow AI can perpetuate biases and exhibit discrimination inherent in their training datasets, raising ethical concerns. AI systems might also generate false or misleading information, compromising decision-making processes, which can lead to monetary loss, reputational damage, and a loss of trust in the organization.

What drives Shadow AI adoption

Several factors drive the adoption of Shadow AI:

Accessibility:
The increasing availability of free and low-cost AI tools, such as ChatGPT, enables employees to independently adopt these technologies. Cloud-based AI platforms and open-source libraries have democratized AI, allowing non-technical staff to integrate advanced AI into their workflows. While IT departments can take steps to mitigate this, employees may still use personal devices to access AI tools and incorporate the results into their work.

Pressure:
The competitive pressure to enhance productivity, innovation, and speed can push individuals and teams to bypass lengthy approval processes and resort to Shadow AI.

Familiarity:
Many new employees, including recent graduates, are already familiar with Generative AI tools from their academic experiences and expect to use similar tools in their professional tasks. If these tools are not provided officially, they may turn to Shadow AI.

Governance:
Insufficient AI governance frameworks can lead to fragmented AI adoption, where isolated instances of AI usage occur outside official channels.

How widespread is Shadow AI

Shadow AI is a growing concern. A recent survey by the Deloitte AI Institute found that 20% of the 2,000 employees surveyed admitted to using Shadow AI to support their work. However, given its unauthorized and covert nature, the true volume is difficult to ascertain, with some estimates suggesting it could be over 60% in certain organizations.

The Risks of Shadow AI Utilization

While Shadow AI may benefit individuals and teams, it poses significant risks to organizations:

Data Security and Privacy:
Unsanctioned AI tools often handle sensitive data without adequate security measures, leading to potential data breaches and privacy violations. The lack of centralized control complicates the enforcement of data protection standards, increasing vulnerability to cyber threats.

Regulatory Compliance & Legal issues:
Generative AI systems learn from all the data uploaded to them and then use this data to help answer other users' requests. If a user uploads data to a Shadow AI service to analyze this may result in Federal Communications Commission (FCC) or GDPR issues depending on the data.

Operational Inefficiencies:
Shadow AI can create data silos, hinder collaboration, and result in duplicated efforts. The lack of integration with existing IT infrastructure can complicate system interoperability and maintenance.

Bias and Ethics:
Without proper oversight, Shadow AI implementations are more likely to propagate biases present in the data or algorithms, leading to unfair or unethical outcomes. This can damage the organization’s reputation and lead to discrimination against certain groups.

Strategic Misalignment:
Shadow AI initiatives may not align with the organization’s strategic goals, resulting in fragmented efforts that do not contribute to the overall mission and vision. This misalignment can lead to wasted resources and missed opportunities for synergies.

Loading component...

Recommendations

Addressing the challenges of Shadow AI requires organizations to adopt a proactive and comprehensive approach. The following strategies can help mitigate risks and harness the benefits of AI in a controlled manner:

The Establishing Robust AI Governance:
Develop a clear governance framework to manage AI adoption. This framework should define roles and responsibilities, outline approval processes for AI initiatives, and establish guidelines for data security, privacy, and compliance. A centralized AI governance committee can oversee AI projects, ensuring alignment with organizational objectives.

Promoting Awareness and Training:
Educate employees about the risks and benefits of AI. Training programs can help staff understand the importance of adhering to governance protocols and the potential consequences of Shadow AI. Fostering a culture of compliance and awareness can reduce the likelihood of unsanctioned AI usage.

Encouraging Collaboration and Communication:
Facilitate open communication between IT departments, business units, and other stakeholders. Regular meetings, cross-functional teams, and collaborative platforms can enable the sharing of insights and best practices, ensuring AI initiatives are aligned and integrated.

Implementing AI Audits and Monitoring:
Regularly audit AI systems to identify instances of Shadow AI and assess their impact. Monitoring tools can track AI usage across the organization, flagging unauthorized implementations and ensuring compliance with governance standards. Continuous monitoring can also help detect and address biases and ethical concerns in AI systems.

Providing Accessible AI Solutions:
Offer sanctioned AI tools and platforms that meet the needs of various departments. Providing user-friendly, secure, and compliant AI solutions can empower employees to innovate within governance frameworks and meet their expectations for AI tool availability.

Aligning AI with Business Strategy:
Ensure AI initiatives are closely aligned with the organization’s strategic goals. Prioritize AI projects that offer significant impact and value, integrating AI into the broader business strategy. By aligning AI efforts with strategic objectives, organizations can maximize the benefits of AI while maintaining control and coherence.

Culture Change:
Meeting employee expectations is crucial for attracting and retaining talent. IT teams must align with leading performance-positive IT cultures that focus on enabling individuals and teams to maximize their performance and productivity.

Loading component...

Conclusions

Shadow AI represents a critical issue that demands immediate attention and action. By adopting and enforcing comprehensive AI governance frameworks, investing in employee education, and fostering a culture of ethical AI use, organizations can mitigate the risks associated with Shadow AI and harness the full potential of this transformative technology. As AI continues to evolve, proactive management of Shadow AI will be crucial for organizations aiming to leverage the full power of AI while safeguarding their integrity and objectives.

Shadow AI can pose a significant risk to your organization's security and compliance. Why not talk to Fujitsu and see how we can help you mitigate the risks of Shadow AI before it becomes a problem?

Loading component...

Nick Cowell

Principal Consultant & Fujitsu Distinguished Engineer / Technology Strategy Unit/ Fujitsu

Nick is a technologist and futurist with extensive experience in hardware, software, and service development, having previously worked for leading technology providers across the USA, Europe, and Oceania.