AI tools employees use for work without their company’s approval, oversight, or knowledge, the AI-era version of shadow IT.
Also known as Unsanctioned AI, shadow IT for AI
Shadow AI is any AI tool an employee uses to do their job that IT, legal, or account leadership has not approved, does not know about, and cannot govern. It covers everything from someone pasting a client brief into a personal ChatGPT account to a freelancer running project files through an AI tool the agency has never vetted.
It is not new in kind, shadow IT, meaning unapproved software generally, has existed for decades, but AI raises the stakes. Verizon’s 2026 data breach report found shadow AI detections up fourfold year over year, and unlike most unapproved software, the AI tools people reach for are often built to retain and learn from whatever gets typed into them.
Client material ends up in places it should not. Unreleased creative, campaign budgets, and confidential briefs are exactly the kind of content someone might paste into a free AI tool to save time, without realizing the tool’s terms of service allow that input to be retained or used for training.
It is a contract problem, not just a security one. Most client agreements include confidentiality and data handling clauses. An account team using unsanctioned AI on client material can put the agency in breach of a contract nobody on that team has necessarily read closely.
Banning it outright does not work. Employees adopt shadow AI because the sanctioned tools are slower, more limited, or do not exist yet for their use case. Agencies that respond only with a ban tend to push the behavior further out of sight rather than stopping it.
A creative director at a mid-size agency discovers that two junior copywriters have been running early-stage client concepts through a free AI writing tool to speed up first drafts, including for a client whose master service agreement explicitly prohibits sharing materials with third-party services. Nobody told them not to; the agency simply never issued guidance either way. Rather than issuing a blanket ban that would just send the habit underground, the agency fast-tracks a sanctioned AI tool with an enterprise agreement that guarantees client data is not retained, and adds a one-line disclosure to onboarding: here is what is approved, and here is why the free version of that tool is not.
The automations and agents module of the workshop teaches you how to build AI workflows that compress the busywork without taking the craft out of the studio.