Why do staff use unapproved AI tools?

Because the approved route is too slow. In aibl’s survey of 755 UK mid-market leaders, 55% say people regularly use AI tools that were never signed off. That isn’t indiscipline. It’s people working faster than procurement can keep up, and the fix is speed, not policing.

What shadow AI actually is

Shadow AI is any AI tool your staff use for work without approval, review or oversight. Think a free chatbot, a browser extension, a personal account quietly doing company work. It isn’t a rogue-employee problem. Most of it is ordinary people reaching for something faster than the tool procurement gave them.

It’s common. In aibl’s survey of 755 UK mid-market leaders, 55% say it happens regularly around them. That’s not a fringe problem in a handful of firms. We’ve looked at the unapproved tools mid-market teams already use in more detail.

The reality is most of it isn’t malicious. Someone found a tool that saves an hour. The official channel would have taken a week to say yes.

Why your team reaches for unapproved tools

Staff use unapproved AI because the approved path is slower than the work in front of them. Speed beats compliance every time someone is under a deadline. It isn’t a discipline problem and it isn’t about rule-breaking. It’s a queue problem, and it’s the single clearest driver in the whole dataset.

Look at the pattern by governance maturity. In aibl’s survey of 755 UK mid-market leaders, shadow AI runs at 75% among ungoverned companies. It falls to 35% among the most mature.

Nothing about the temptation changes there. What changes is whether the official route is fast enough to bother using. When it is, people stop routing around it.

The pace of approval tells the same story on its own. Companies that approve a new tool in days report 62% measurable ROI. Those that take months report 38%, with far more shadow use alongside it.

Frankly, staff aren’t waiting for permission out of laziness. They’re waiting because the queue is genuinely too long, and the work doesn’t stop while they wait.

Is shadow AI a security risk, or just a symptom?

Shadow AI carries real risk: data leaving your control, no audit trail, no idea which tools touch client information. But treating it purely as a security problem misses the bigger pattern in the numbers, where the firms that decide what to do about it, either way, outperform the ones that don’t.

The risk is real enough on its own terms. Unapproved tools mean unapproved data flows, and nobody signed off on where that information goes.

But the data points somewhere more useful than “lock it down”. Returns are actually highest at both ends of the shadow AI scale, not the middle.

Companies that firmly control unofficial AI report 61% ROI. Companies that fully embrace it, on purpose, report 63%. Almost identical. The companies stuck in the middle, tolerating shadow AI without ever deciding what to do about it, report just 43%.

So the security framing is true but incomplete. The real cost sits with the businesses that never made a decision either way.

How do you actually reduce shadow AI?

You reduce shadow AI by making the approved route faster, not by adding more rules. Policing a workaround doesn’t remove the reason it exists; a quicker official path does. The two governed extremes prove it: firmly control it, or fully embrace it, but don’t leave it drifting in the tolerated middle.

This is why the two governed extremes both work and the tolerated middle doesn’t. Firm control removes the option. Full embrace removes the need to hide it. Both are decisions. Drift is not.

In practice that means three things. Cut the approval queue from months to days wherever you safely can. Give staff one clear list of what’s sanctioned, reviewed on a fixed schedule. And decide, deliberately, whether your stance is control or embrace, then say so.

What doesn’t work is a policy nobody enforces sitting next to a queue nobody trusts. That combination is exactly what produces the 43% middle.

None of this is about trusting your team less. It’s the opposite. It’s admitting the workaround only exists because you built a bottleneck.

The connection to governance maturity

Shadow AI isn’t really a standalone problem. It’s a readout of how well your AI governance is working everywhere else. If unapproved tools are spreading across your teams, the tools aren’t the story. The speed of your approval process is.

The 75%-to-35% swing tracks the same maturity ladder that drives measurable return. No governance sits at 22% ROI, mature and embedded at 85%, a 63-point gap. Shadow AI and unproven returns come from the same root cause.

So if unapproved tools are showing up across your teams, don’t start with a memo. Start by timing your own approval process and asking who actually owns the decision.

Frequently asked questions

Read the full research

This is one finding from State of UK AI Adoption 2026, aibl’s benchmark of 755 UK mid-market leaders, in partnership with Executive Summary. The full report breaks down shadow AI by function and shows exactly how the fastest-approving companies built their process.

Read the full State of UK AI Adoption 2026 report →