Ask any team whether they use AI at work and most will say yes. Ask the IT department which tools and accounts they use, and the answer is often silence. That gap has a name: shadow AI. In 2026 it became one of the most common factors in data breaches.
What the data says
AI use is now normal. In Verizon’s 2026 breach report, 45% of employees were regular AI users, up from 15% a year earlier. And 67% of the people using AI on company devices did it with personal, not company, accounts.
Shadow AI is in almost half of breaches. IBM’s 2026 Cost of a Data Breach report found unsanctioned AI in 43% of the breaches it studied, up from 20%. Breaches with shadow AI cost $5.39 million on average.
Controls are missing. AI-related breaches grew to 21% of all breaches, from 13%. Of the companies that had one, 92% had no proper access controls for AI. And 68% had no AI governance policy at all.
Breaches cost more and last longer. The global average cost reached a record $4.99 million, up 12%. It took 247 days on average to find and contain a breach.
Why banning AI doesn’t work
When a company says no to AI, people don’t stop using it. They switch to their phone or a personal account, and the company loses the little visibility it had. The answer is the opposite: give people a good tool and set clear rules for it.
Five rules that work
- Offer an approved tool. Choose one or two AI assistants with business accounts, so company data stays under company contracts.
- Decide what data can go in. Client data, contracts, finances and personal data each need a clear yes or no. Put it on one page.
- Let AI see only what the person can see. An assistant connected to company systems must inherit the user’s access rights, not get a master key.
- Keep a record. Know which tools are connected, who uses them and what they can reach. Review it every quarter.
- Teach, then check. A 30-minute session on what is safe to paste does more than a 20-page policy nobody reads.
Where to start
Start with a map: which AI tools are in use, with which accounts and which data. An IT audit gives you that map, the risks ranked and a plan your board can approve, checked against GDPR where it matters.
Sources: IBM Cost of a Data Breach Report 2026; figures as summarised by Baker Donelson; Verizon 2026 DBIR via Help Net Security.