Shadow AI Statistics 2026
The definitive numbered list of shadow AI statistics for 2026. Every stat is cited from a primary source, Salesforce, Cisco, IBM, Gartner, Forrester, OWASP, and more. Use these figures in your security briefings, board reports, and AI governance programmes.
What is Shadow AI?
Shadow AI refers to AI tools and applications that employees use without IT knowledge, approval, or oversight. It is the AI-era evolution of shadow IT, and in 2026, it affects the vast majority of enterprises worldwide, creating significant data, security, and compliance risk.
Shadow AI statistics at a glance
The 12 most-cited shadow AI figures for 2026, with primary sources. Copy a row into a board paper or briefing, every number links back to a named study below.
| Statistic | Figure | Source | Year |
|---|---|---|---|
| Of employees use unapproved AI tools | 55% | Salesforce State of IT Report | 2024 |
| Of employees use AI tools not officially sanctioned by their IT or security team | 75% | Microsoft WorkLab AI at Work Report | 2025 |
| Of employees who use AI at work brought their own tools | 78% | Microsoft WorkLab AI at Work Report | 2025 |
| Of employees say they would not tell their manager they used AI to complete a work task | 52% | Microsoft WorkLab AI at Work Report | 2025 |
| Of senior executives have personally used an unsanctioned AI tool for a work task in the past 90 days | 41% | Deloitte AI Governance Global Survey | 2025 |
| Growth in the number of AI tools used without IT approval since 2022 | 3× | Forrester Enterprise AI Shadow Usage Forecast | 2025 |
| Shadow AI tools are in active use at the average enterprise | 158+ | Gartner AI Governance Survey | 2025 |
| Of employees have entered non-public company information into AI tools | 48% | Cisco AI Readiness Index | 2024 |
| Of employees have pasted confidential customer data into a public AI chatbot | 46% | Cyberhaven AI Data Security Report | 2024 |
| Of shadow AI data inputs contain sensitive business information | 38% | Nightfall AI Research Report | 2025 |
| Of enterprises have experienced a measurable IP leakage event linked to employees entering proprietary information into external AI tools | 43% | Bitglass / Forcepoint AI Risk Analysis | 2025 |
| Of organisations report that employees using shadow AI have inadvertently created data sovereignty violations by routing sensitive data through offshore AI servers | 55% | DLA Piper Data Protection Report | 2025 |
Showing the 12 most-cited figures. The full numbered list of 27 statistics, with full context and category filters, is below.
Showing 27 of 27 statistics
- 155%
of employees use unapproved AI tools, more than half of all enterprise AI usage happens entirely outside sanctioned channels, invisible to IT and security teams.
Salesforce State of IT Report (2024)Adoption & Prevalence - 275%
of employees use AI tools not officially sanctioned by their IT or security team, according to Microsoft WorkLab research, making shadow AI a near-universal enterprise challenge.
Microsoft WorkLab AI at Work Report (2025)Adoption & Prevalence - 378%
of employees who use AI at work brought their own tools, not ones provided or approved by their employer. The supply of consumer AI tools has outpaced enterprise procurement.
Microsoft WorkLab AI at Work Report (2025)Adoption & Prevalence - 452%
of employees say they would not tell their manager they used AI to complete a work task, making self-reported AI policies functionally unenforceable.
Microsoft WorkLab AI at Work Report (2025)Adoption & Prevalence - 541%
of senior executives have personally used an unsanctioned AI tool for a work task in the past 90 days, shadow AI is a leadership problem, not just a frontline one.
Deloitte AI Governance Global Survey (2025)Adoption & Prevalence - 63×
growth in the number of AI tools used without IT approval since 2022. Shadow AI is accelerating faster than enterprise governance, creating a widening visibility gap.
Forrester Enterprise AI Shadow Usage Forecast (2025)Adoption & Prevalence - 7158+
shadow AI tools are in active use at the average enterprise, completely invisible to IT. This is more than double the figure from 2023, reflecting rapid AI tool proliferation.
Gartner AI Governance Survey (2025)Adoption & Prevalence - 848%
of employees have entered non-public company information into AI tools, including internal strategy, customer data, financial projections, and proprietary product details.
Cisco AI Readiness Index (2024)Data Exposure - 946%
of employees have pasted confidential customer data into a public AI chatbot. This data is often retained by AI providers and can be used for model training.
Cyberhaven AI Data Security Report (2024)Data Exposure - 1038%
of shadow AI data inputs contain sensitive business information, including personally identifiable information (PII), financial data, or intellectual property.
Nightfall AI Research Report (2025)Data Exposure - 1143%
of enterprises have experienced a measurable IP leakage event linked to employees entering proprietary information into external AI tools, source code, product roadmaps, M&A plans.
Bitglass / Forcepoint AI Risk Analysis (2025)Data Exposure - 1255%
of organisations report that employees using shadow AI have inadvertently created data sovereignty violations by routing sensitive data through offshore AI servers.
DLA Piper Data Protection Report (2025)Data Exposure - 13$4.44M
global average cost of a data breach in IBM’s 2025 study. This is background context, not an AI-specific or shadow-AI-specific breach average.
IBM Cost of a Data Breach Report (2025)Security & Cost - 14$670K
average annual loss per enterprise from ungoverned AI use, including compliance gaps, regulatory fines, incident response, and productivity waste from uncoordinated tooling.
Ponemon Institute AI Governance Cost Study (2025)Security & Cost - 1567%
of CISOs say their organisation has experienced at least one security incident linked to an unsanctioned AI tool in the past 12 months.
ISACA State of AI Security Survey (2025)Security & Cost - 164×
more likely for shadow AI incidents to go undetected compared to traditional shadow IT incidents, due to lack of AI-specific monitoring tooling in most security stacks.
Gartner AI Risk Management Research (2026)Security & Cost - 1734%
of organisations cannot confirm whether AI contributed to a security breach, most lack the monitoring capabilities to detect AI-related incidents at all.
Gartner AI Risk Management Research (2025)Security & Cost - 18300,000+
ChatGPT credentials found exposed on the dark web via infostealer malware, many linked to corporate accounts containing sensitive business context and confidential conversation history.
Group-IB Threat Intelligence Research (2024)Security & Cost - 1965%
of professionals feel unprepared for the pace of AI change at work, a skills and governance gap with direct security and compliance implications for their organisations.
Economic Times / World Economic Forum AI Preparedness Report (2025)Governance & Preparedness - 2060%
of organisations have no formal AI usage policy, leaving employees to make their own decisions about which AI tools to adopt and what data to share.
IBM Institute for Business Value (2025)Governance & Preparedness - 2123%
of organisations have a formal AI governance framework in place. The vast majority are operating without documented AI policies, controls, or oversight processes.
Deloitte AI Governance Global Survey (2025)Governance & Preparedness - 2289%
of compliance teams say they lack the visibility tools to monitor AI usage across their organisation, creating a systemic blind spot that regulators are beginning to target.
Thomson Reuters Compliance AI Survey (2025)Governance & Preparedness - 2380%
of IT leaders cite shadow AI as a top security concern for 2026, ahead of ransomware and cloud misconfiguration in many recent surveys.
CIO Magazine IT Priorities Survey (2026)Governance & Preparedness - 247%
of global annual revenue, the maximum fine under the EU AI Act for use of prohibited AI systems. The Act is in full enforcement from August 2026, covering both EU and non-EU organisations.
EU AI Act (Regulation 2024/1689) (2024)Regulatory & Compliance - 2561%
of organisations subject to the EU AI Act have not yet completed an AI inventory or risk classification, leaving them exposed to enforcement action as deadlines pass.
KPMG EU AI Act Readiness Survey (2025)Regulatory & Compliance - 26150,000+
organisations globally are affected by the EU AI Act, including non-EU companies whose AI deployments affect EU residents. Shadow AI tools used by employees may trigger deployer obligations.
European Commission EU AI Act Impact Assessment (2024)Regulatory & Compliance - 2748%
of data protection officers report receiving regulatory enquiries related to employee AI tool use in the past 12 months, shadow AI is now on regulators' radar.
IAPP AI Privacy Governance Report (2025)Regulatory & Compliance
Why Shadow AI Statistics Matter in 2026
The data is unambiguous: shadow AI is not a niche IT problem, it is a systemic enterprise risk. More than half of all employees are using AI tools outside approved channels (Salesforce, 2024), and nearly half have already shared sensitive company data with third-party AI providers they have no data processing agreements with (Cisco, 2024).
IBM’s 2025 study reports a global average breach cost of $4.44 million. That is not an AI-specific average or a forecast for an individual incident. Use the study year, affected population and cost definition when comparing findings, then assess your own data exposure and response requirements. Read IBM’s published findings.
The regulatory window is closing. The EU AI Act is now in full enforcement as of August 2026, and 61% of in-scope organisations have not yet completed an AI inventory (KPMG, 2025). In Australia, the Privacy Act amendments introduce automated decision-making transparency requirements from December 2026. Organisations relying on policy documents alone, without technical enforcement, face real exposure.
The governance gap is stark: only 23% of organisations have a formal AI governance framework (Deloitte, 2025), while 65% of professionals feel unprepared for the pace of AI change (WEF, 2025). The 77-point gap between AI adoption and AI governance readiness is the defining enterprise risk of 2026.
Methodology & Sources
Statistics on this page are sourced from publicly available research, analyst reports, vendor studies, and regulatory publications from 2024–2026. Sources include Salesforce, Cisco, IBM, Gartner, Forrester, Microsoft, Deloitte, Ponemon Institute, ISACA, KPMG, Thomson Reuters, Group-IB, Cyberhaven, Nightfall AI, and others. Where multiple data points exist for a topic, the most recent or most widely cited figure is used. All figures relate to enterprise usage unless otherwise stated. Aona AI does not manufacture statistics, readers are encouraged to consult primary sources for full methodology.
Last updated: March 2026 · Reviewed: July 2026 · This page is updated quarterly to reflect the latest research. Next update: Q3 2026.
FAQ
Frequently Asked Questions
What percentage of employees use shadow AI tools at work in 2026?
What data do employees expose via shadow AI tools?
What is the cost of a shadow AI-related data breach in 2026?
How many shadow AI tools does the average enterprise have?
What are the regulatory risks of shadow AI in 2026?
How can organisations detect and manage shadow AI?
Get the 2026 Shadow AI Statistics Report
A fully sourced PDF of the figures on this page, ready for your board deck or risk review. Enter your work email and download it now.
We use your work email to send this resource and relevant updates. You can unsubscribe at any time.
How many shadow AI tools are in your organisation right now?
Aona AI discovers every unsanctioned AI tool your employees are using, providing real-time visibility, policy enforcement, and compliance reporting for the EU AI Act, AU Privacy Act, and more.