Microsoft Copilot
Glossary
Shadow AI
Shadow AI is the use of AI tools, models or agents that an organization's IT and security teams have not approved or do not know about.
Also known as: unsanctioned AI, shadow artificial intelligence
Where it comes from
Shadow AI spreads the way shadow IT did, only faster, because signing up for an AI assistant takes minutes and no procurement. It ranges from an employee pasting company data into a public chatbot, to a team connecting an AI tool to a mailbox through an OAuth consent, to a maker building an agent on a site nobody approved for AI use.
Why it is a risk, and where control starts
Unseen use is the risk. Nobody assesses the data it touches or the exposure it creates, and the organization cannot account for it under the EU AI Act or GDPR.
Control starts with discovery, because a tool nobody knows about cannot be governed. A blanket ban pushes use further out of sight. Once use is visible, approve what earns its place under the same inventory, ownership and review as approved tools, and retire the rest.
Where Rencore fits
Shadow AI often leaves traces in places Rencore already inventories: Entra ID enterprise applications with the Microsoft Graph permissions they were granted, and agents built in Copilot Studio or on SharePoint. Rencore brings those into the same inventory, with owners and reviews, as the AI tools you approved.
