Shadow AI: how analysts can keep the speed and lose the risk

You've probably been there. A deadline is close, the approved tool can't do what you need, and a chatbot or a quick agent can. So you use it, the work gets done, and nobody asks how. Multiply that across every analytics team, and you get work that's moving faster than ever, but outside of IT's visibility — without approved tools or oversight. That's shadow AI. 

I've done it myself, and most analysts I know have too. So the question is, how can you keep that speed without the risk that comes with it?

What is shadow AI?

Shadow AI is any AI tool, model, or agent used at work without IT's knowledge or sign-off. It used to mean pasting data into a chatbot. Increasingly, it means agents, and that raises the stakes, because an agent doesn't stop at producing a number. It can email a customer, update a record, or approve a refund based on it.

"We just needed to get it done": why does shadow AI still happen in 2026?

Let's be honest, no one sets out to break rules. When you step outside official platforms, it's usually because:

• It takes too long to get access.

• The approved tools are too rigid, or don't let you build agents at all.

• You're under pressure to deliver fast results.

Put those together and the math is simple: spinning up an agent in a consumer tool takes an afternoon, while getting one approved can take months. So, you find your own way — combining chat assistants, copilots, personal API keys, and shared folders. It works… until it doesn’t.

And you’re far from alone. In Microsoft research from October 2025, 71% of UK employees said they’d used unapproved consumer AI tools at work, and 28% said their company doesn’t offer an approved alternative. To see why that’s a problem, it helps to start with what analysts are actually trying to do.

What analysts really want

I've been an analyst myself and I've worked with thousands over the last decade. And nine times out of ten, people aren't trying to avoid governance, they just want to:

• Access the data they need.

• Work quickly without jumping through hoops.

• Hand off the repetitive parts of their job to an agent.

• Share results confidently.

If the official tools block that? They’ll work around them. If a warehouse table isn’t accessible, they’ll find a colleague to email them an Excel export. If they can’t find that best practice example that already exists, they’ll whip up a new set of business logic from scratch. And if a supply chain analyst wants to automate the weekly vendor-risk review, they’ll build an agent in whatever tool is closest and plug in a personal API key.

That last one is where things get interesting. The agent works, because the analyst knows exactly which vendors deserve a second look. But that knowledge now lives somewhere nobody else can see, check, or build on. And that’s how shadow AI grows when there isn’t a platform built that supports both speed and security.

What happens when IT loses visibility

Invisible work doesn’t stay harmless for long, and the person who built it is usually the first to feel it. When AI is built outside IT’s visibility:

• No one knows what data was used (or if it was accurate), so your numbers get second-guessed.

• Teams duplicate work or come to different answers.

• Leadership starts asking: “Which number is right?” (Or, more and more often, “Why did the agent do that?”)

• Critical data products and agents can break with no easy way to fix them, and you’re the one who gets the call.

The crux of the issue is this: IT can’t do its job without some level of control. And neither can you, because how your work gets built and shared decides whether anyone trusts what it finds.

Without quality checks, alerts, and deployment testing, that late night change made the day before a critical meeting can lead to a broken data product — leaving leadership without the numbers they need to make their pitch. Agents raise the stakes further, since a prompt you tweak on a Friday can change how an agent handles customer requests all weekend. And that risk isn’t hypothetical. In IBM’s 2025 Cost of a Data Breach Report, one in five organizations reported a breach tied to shadow AI.

The good news? Visibility doesn’t have to mean slowing teams down. If shadow AI exists because the governed path is too slow, then the fix is to make that path faster.

What a better path with Dataiku looks like

That’s what Dataiku, the Platform for AI Success, is built for. To see what it looks like day to day, go back to that vendor-risk agent.

This time, the analyst describes the review in plain English: pull this week’s supplier data, flag vendors with late shipments or credit changes, and draft a summary for procurement. With Dataiku Cobuild, that description becomes a visual Flow built from templates colleagues already made, so the analyst can click into each step, adjust the logic, and send it for review. The agent runs on approved data and models, so there’s no personal API key.

Then comes the part the workaround could never offer. The agent carries its lineage and sign-offs, so when someone asks why it flagged a vendor, the answer is a click away. If the analyst changes roles, someone else can pick it up.

Same agent, same expertise. The difference is that now it’s visible, trusted, and reusable. And every agent built this way makes it easier for IT to say yes to the next one.

Shadow AI is a symptom, not the root problem

Shadow AI is a sign that you aren’t being fully supported and that your workflows aren’t built for the way you actually work today. And as AI becomes more agentic and more decentralized, the gap only widens. If governance can’t keep up, teams will inevitably go around it.

The answer isn’t just stricter controls, but a better foundation. With the right platform, there’s no need for shadow AI because the governed path is just as fast as the workaround.