The short answer
Shadow AI is staff using unapproved AI: a personal chatbot drafting a client letter, a summarising browser extension, a free meeting transcription app, a new AI feature in software you pay for. Useful tools and a slow or missing approved route cause it. Real risks: confidential data under unclear terms, inaccurate output, unchecked data protection duties. The fix is not a ban: discover, approve, set a policy, train, add controls.
Why it happens
The tools genuinely help
Faster drafting, summarising and rewriting; busy people use what works.
No approved option
Or it is harder to reach than a free website.
Nobody said what is allowed
Without a policy, judgement calls vary.
AI inside other software
Vendors add AI features; nobody has to install anything.
Most shadow AI is not malicious: treat it as a signal of demand, not misconduct.
The real risks
| Risk | What it looks like | Why it matters |
|---|---|---|
| Confidential data in consumer tools | A contract, client list or staff issue in a personal chatbot | It left your control, on terms you never agreed |
| Unclear retention and training | Prompts kept for an unknown period, possibly training the vendor's models | You cannot tell clients or regulators where information went |
| Inaccurate output in decisions | A summary missing a key condition, or a confident wrong figure | Errors reach clients and boards under your name |
| Data protection obligations missed | Personal data processed with no contract or assessment | The NDPA still applies, including its rules on transfers outside Nigeria |
| Unvetted access | Extensions and apps with broad access to mail, files or browsers | A new route for data loss or attack |
NITDA advises keeping personal, classified or confidential data out of public AI tools and using approved ones. Check outputs before relying on them, and whether prompt history can be deleted. Retention and training terms vary by service and plan, and change: check, do not assume.
For federal public institutions and regulated-sector organisations, NITDA's National Cloud Technical Guideline 2026 adds data-residency rules from 1 January 2027: classified data may not leave Nigeria (NITDA). Sector regulators, such as the CBN, may add their own. This is general information, not legal advice.
How to discover shadow AI
Start with evidence, not accusations.
Your security tools
Firewall and web gateway logs already show which AI sites people reach.
App and consent inventories
Device management lists apps and extensions; identity shows connected third-party apps.
Vendor feature reviews
AI features in admin settings: data use, on or off.
A no-blame staff survey
Tools, tasks and why; the goal is better tools, not discipline.
Network tools see only managed devices and networks; the survey reveals AI on personal phones and the tasks people want help with.
Discovery with Microsoft security tools
Microsoft Defender for Cloud Apps uses traffic logs from firewalls and proxies, or device data through Microsoft Defender for Endpoint, to give visibility of unsanctioned cloud apps (Microsoft Learn). Its app list includes a Generative AI category, so you can see which AI apps are used, review a risk assessment for each and sanction or block them (Microsoft Learn). Where your licences include it, Microsoft Purview can add insight into sensitive data in AI interactions.
Rather talk it through? If you suspect staff are pasting work into free AI tools but cannot see how much, we can help you find out and set up approved options quickly. Talk to a Promatics specialist
How to get it under control without banning AI
Bans push AI onto personal devices, out of sight. A better sequence:
- Approve toolsBusiness versions people want, with terms you have actually read.
- Short policyApproved tools, never-enter data, human review, disclosure, new requests.
- Train on tasksUsing approved tools well, what not to paste, checking output.
- Protect dataLabels and data loss prevention where licensed; block high-risk apps, warn on others.
- Keep a registerTools and use cases with owners; fast requests beat workarounds.
Business tools are usually priced in US dollars: budget for exchange-rate movement. On Microsoft 365, Microsoft 365 Copilot is often the natural candidate (alternatives: Copilot, ChatGPT and Gemini compared). Policy guide: AI acceptable use policy.
- We know which AI tools and features are in use, from logs and a survey
- At least one approved AI tool for staff who need it
- Retention and model-training terms reviewed for each approved tool
- A short AI use policy published and acknowledged
- Staff trained on what may and may not be entered
- High-risk AI apps blocked; data protection covers sensitive content
- Requests for new tools have an owner and a quick turnaround
When to bring in help
A small Microsoft 365 organisation can start alone (survey, one-page policy, an approved tool). Bring in help when:
- You handle health, financial or children's data
- A board, funder, auditor or regulator wants evidence
- Discovery and data loss prevention need configuring
- Vendor AI features need a risk assessment
Our AI governance and security service covers AI use policies, shadow AI discovery, risk assessments and AI application security testing, aligned with frameworks such as the NIST AI RMF and ISO/IEC 42001. We also provide cybersecurity and Microsoft 365 services, so we configure the controls ourselves, not just recommend them.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
- How do I discover AI apps and the sensitive data these use in my organisation?, Microsoft Learn
- Cloud app discovery overview (Microsoft Defender for Cloud Apps), Microsoft Learn
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- National Cloud Technical Guideline 2026, National Information Technology Development Agency
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.