Why it shows up
Shadow AI is the current version of shadow IT, and it comes from the same place: someone has to deliver something today and the approved tool cannot do it. The difference is adoption speed. Installing an unapproved SaaS takes a card and some friction; pasting a contract into a chat takes a browser.
That is why it appears in mature companies, with a written policy and up-to-date training. The policy says what is forbidden; it does not say what to do instead.
The risk that matters, and the part that is overblown
The core risk is data leaving. A contract clause, proprietary code, a payroll spreadsheet, a medical report. Once pasted, you have lost control of retention and of training use, and no deletion request returns what has already been processed.
The second is a decision made on unverified output, which lands in a report and becomes input to another decision without anyone checking the source.
What tends to be overblown is fear of the model itself. The problem is almost never the model; it is the path the data took to reach it.
How to find what is already in use
An anonymous internal survey returns more than people expect, and it is the cheapest method. Proxy and DNS logs show traffic to the tools' domains. OAuth grants in your identity provider show who authorized which application to read corporate mail or drive, which is the most serious case and the least remembered.
From the outside, anyone sweeping the surface finds prototype subdomains, API keys exposed in public repositories, and AI tool panels published without authentication. A good share of shadow AI becomes an internet-exposed asset before it becomes a data incident.
What to do after finding it
Blocking everything pushes usage to personal phones, where you have no logs at all. What works is offering a contracted alternative with defined retention, and being explicit about which class of data may go into it. A policy becomes useful when it answers "use this" instead of only "do not use that".