Shadow AI
AI tools or systems in use inside an organization that have not been logged, approved, or governed. They break AI inventories and create hidden regulatory risk.
Shadow AI is the use of artificial intelligence tools within an organization that have not been inventoried, approved, or brought under the AI governance program. They often appear as browser extensions, generative AI productivity tools, embedded features in SaaS platforms, or business-unit workarounds that bypass procurement.
Shadow AI is an Exhibit A problem first. The NAIC AI Systems Evaluation Tool starts by asking insurers to list every AI system in use, and a system nobody logged never makes that list, let alone the documentation and testing behind it. If the inventory is wrong, downstream risk tiering, testing, and monitoring all describe systems that do not match reality.
The fix is usually a short, directed campaign: map known systems, survey business units directly, cross-check SaaS and spend data, and put the remaining unknowns on the record rather than papering over them. The 30-day version of that campaign is in our guide to shadow AI in insurance.