Employees at a retail company have started using a free, publicly available GenAI tool to draft customer responses, without IT or security ever reviewing or approving it. What is this an example of?
Select an answer to reveal the explanation.
Short Explanation
An employee bringing in unvetted software and plugging it straight into customer data is a problem nobody signed off on and nobody's watching. That's shadow AI: a tool adopted outside official review, running where your IT and security team can't see it — the issue isn't that it works, it's that nobody vetted it.
Full Explanation
Shadow AI describes exactly this scenario: employees adopting and using an AI tool inside the business without IT or security ever reviewing it, which matters because the organization has zero visibility into how that tool stores data, what happens to the customer information it processes, or whether its outputs meet any quality bar. That visibility gap is the real risk, not the tool's raw capability. Model drift is a different problem entirely: it describes a model that WAS approved and deployed, then degrading in accuracy as real-world conditions shift out from under it, which has nothing to do with an employee grabbing an unvetted tool on their own. Rule-based automation is a technique category, systems that follow fixed if-then logic to automate deterministic decisions, and says nothing about governance or approval status. AI agent orchestration describes a technical capability, an agent sequencing multiple tools or steps toward a goal, which is likewise unrelated to whether a tool cleared review. Operationally, the test for shadow AI is simple: ask whether the tool went through a formal approval process before employees started feeding it company or customer data. If the answer is no, it's shadow AI, regardless of how well the tool performs.