ARTIFICIAL INTELLIGENCE
Taking AI out of the shadows
R
esearch from the Department for Science, Innovation and Technology’s (DSIT) highlights a massive gap between those who build the tech and those who use it. Legislation and standards are aimed at AI producers and providers, and users of high-risk AI. This leaves 85 per cent of AI business users in an uncertain regulatory position, facing operational liabilities if they inadvertently adopt an unsafe third-party AI tool. Organisations therefore need to take an AI essentials approach to ensure AI is being used in a trustworthy and ethical way. Artificial intelligence is transforming the way organisations operate, helping employees work more efficiently, automate routine tasks and unlock new insights from data. Shadow AI is when AI tools, applications or services are being used outside an organisation’s governance processes. The rise of freely available generative AI tools has made shadow AI easier than ever to introduce into the workplace, often creating significant confidentiality, intellectual property, compliance and operational resilience risks. Employees may use public AI platforms without fully understanding how information is being processed or stored. In many cases, staff are simply seeking to improve productivity and may not realise they are exposing sensitive business information. Employees are not the only source of shadow AI. Personal mobile phones and unmanaged devices, such as smart speakers, can provide access to AI applications outside corporate controls. A member of staff might upload work-related content to an AI assistant on their personal device, bypassing organisational security measures. Similarly, third-party suppliers and software providers are embedding AI capabilities into existing products and services. Organisations may therefore be using AI indirectly without fully understanding where it is operating, what data it is processing or what risks it introduces. This creates a significant challenge for organisations. Sensitive commercial information, customer data, intellectual property and strategic plans could potentially be exposed to systems that have not been
By Iain Bowes, head of management system assurance, TÜV SÜD Business Assurance
formally assessed or approved. Organisations may also struggle to understand how AI- generated outputs are being used to support decision making, creating concerns around accuracy, accountability and governance. Shadow AI often develops because employees see value in the technology before organisations have established clear policies and controls. Attempts to simply ban AI use are unlikely to succeed and may drive adoption further underground. Instead, organisations need a balanced approach that enables innovation while ensuring that AI is used responsibly and securely. AI Essentials provides organisations with a practical framework for identifying, managing and governing their use of artificial intelligence. Rather than focusing solely on technology, organisations can establish the policies, processes and oversight needed to support the trustworthy use of AI. A key part of controlling shadow AI is first understanding where AI exists within the organisation. AI Essentials encourages organisations to maintain an inventory of AI systems and services, enabling them to identify both approved and unapproved use cases. This visibility helps organisations understand what data is being processed, who is using AI tools and what controls are required.
The framework also promotes the development of clear acceptable-use policies
20 OCTOBER 2026 | ELECTRONICS FOR ENGINEERS
and guidance for employees. Staff need to understand not only the benefits of AI, but also the risks associated with sharing confidential information, customer data or intellectual property through external AI platforms. Effective awareness and training help ensure that employees become part of the solution rather than the problem.
AI Essentials also supports stronger governance by encouraging organisations to assess the risks associated with AI systems, evaluate third-party suppliers and establish appropriate oversight mechanisms. This helps ensure that AI adoption remains aligned with organisational objectives, legal obligations and risk appetite.
Shadow AI is not simply a technology problem; it is a governance challenge. Cybersecurity focuses on the ‘plumbing’ – keeping hackers out of your network and ensuring your data isn’t stolen. AI security needs to look at many more dimensions, because of the probabilistic nature of AI, such as it being misused or having unauthorised influence. Organisations that fail to recognise its presence may find themselves exposed to significant operational, legal and reputational risks. By implementing a structured approach, organisations can benefit from the opportunities offered by AI, while being confident that its use remains secure, responsible and trustworthy.
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42
