Shadow AI: Governance, Risk, and Organisational Resilience

The rapid proliferation of generative and predictive AI tools has introduced a new and largely unregulated phenomenon: Shadow AI—the unsanctioned, informal use of artificial intelligence technologies within organisations. This paper conceptualises Shadow AI as a distinct sociotechnical challenge, emerging at the intersection of digital innovation, organisational culture, and governance failure. Through a multi-layered analysis, we develop a typology of Shadow AI use cases, propose a risk classification framework, and explore diverse stakeholder perspectives on its implications. Drawing on anonymised case studies from sectors including healthcare, finance, defence, and education, we demonstrate how Shadow AI introduces systemic vulnerabilities that are poorly addressed by conventional cybersecurity or compliance frameworks. The paper concludes by offering a set of actionable recommendations for organisations, policymakers, and educators, and outlines two forward-looking research agendas focused on secure AI deployment and cyber statecraft. By framing Shadow AI as both a risk and a signal of latent demand, this paper calls for an adaptive, ethically grounded approach to AI governance—one that balances innovation with resilience in an era of decentralised technology use.