AI in the Shadows: Governance Mechanisms Organisations Use to Manage the Risks of Unauthorised AI Tools

Sammanfattning

The rapid adoption of generative AI in organisations has given rise to a growing phenomenon known as Shadow AI, which refers to the informal and unsanctioned use of AI tools by employees outside organisational oversight. This study examines what governance mechanisms organisations in Sweden, using Microsoft Copilot, implement to manage risks associated with Shadow AI. A qualitative research approach was adopted, combining semi-structured interviews with fourteen representatives from seven organisations and documentary analysis of internal AI policies. The findings show that organisations implement governance mechanisms across both technical and organisational dimensions, and that neither category is sufficient on its own. The primary risks identified in relation to unsanctioned AI tools were data leakage, output quality and over-reliance, and vendor and supply chain exposure. The study further suggests that Shadow AI is best understood as a structural outcome rather than individual non-compliance, and that restrictive governance approaches risk pushing unsanctioned use further from organisational oversight rather than reducing it.