Shadow AI: if your teams already use AI, where does your data end up?

Hypothetical scenario. Imagine a risk analyst at an insurer on a Thursday at six in the evening. She has to deliver tomorrow a summary of a forty-page policy and its annexes. The tool approved by the company does not exist, or takes three weeks to be authorized. She opens a personal account of an AI assistant in her browser, pastes in the whole document and gets a useful summary in minutes. There is no ill intent: there is a deadline, a tool that solves the task and no approved alternative at hand.

In an organization that has not inventoried this kind of use, there may be no documented answer about where the text ended up, which conditions apply, who could access it or how long it is kept.

That is shadow AI: the use of artificial intelligence tools that the organization has not approved, inventoried or monitored. It is the current version of the old shadow IT, with a difference that matters to a committee: what is shared is not a spreadsheet in a personal cloud, but context, customer data and business judgment, written in natural language.

This article is for whoever answers for general management, finance, operations, sales or technology at a bank, a fintech, an insurer, a retail chain or a regulated company. It covers five things: what the studies with method say, why a ban on its own can fall short, where the exposure lies in Mexico, which frameworks already exist for governing, and how to evaluate an approved alternative.

What the studies say, and where they come from

Almost everything published about shadow AI comes from surveys by vendors and analyst firms, not from official statistics. That does not invalidate them, but it requires reading them for what they are: samples from whoever commissioned them, with a declared method and possible biases. These are the ones we were able to review at the original source.

Use. Microsoft and LinkedIn's Work Trend Index 2024, with 31,000 knowledge workers in 31 countries (a survey conducted between February and March 2024 by an independent firm commissioned by Microsoft), reports that 78% of those who use AI at work bring their own tools, and that the proportion rises to 80% in small and medium-sized businesses [1]. It is a vendor study of knowledge workers in general, not about Mexico or regulated sectors.

Exposed data. Cisco's 2024 Data Privacy Benchmark Study, an anonymous survey conducted in the summer of 2023 among 2,600 privacy and security professionals in 12 countries, reported that 48% of respondents said they had entered non-public company information into generative AI tools and 45% employee names or information [2]. It is self-reporting by respondents, not a measurement of traffic or an estimate for Mexico.

Cost. IBM's Cost of a Data Breach 2025 study was conducted by the Ponemon Institute and sponsored and analyzed by IBM; it collects the breaches experienced by 600 organizations between March 2024 and February 2025. One in five organizations reported a breach that it attributed to shadow AI; only 37% have policies to manage or detect it; and those that reported high shadow AI use saw, on average, USD 670,000 more in cost per breach than those with low or no use. In shadow AI incidents, personal data was compromised in 65% of cases and intellectual property in 40% [3]. These are associations reported in the sample, not a causal estimate or a cost applicable to Mexico. IBM clarifies that this is the first year in which this series examines AI security and governance, so there is not yet a multi-year trend.

Three precautions when citing them in a committee. First: they are from vendors. Second: they measure different populations (users, privacy professionals, organizations with a breach) and cannot be added together or compared with each other. Third: for the metrics cited here, the results are published as global aggregates; Microsoft and Cisco included participants from Mexico, but these figures do not allow inferring a national or sector-level prevalence. They serve to say "this happens and has a measured cost at a global scale," not to say "this costs us so much."

Other, more spectacular figures circulate, such as a percentage of employees who use AI "without approval" attributed to analysts, or the proportion of what is pasted into public assistants that would be confidential. We do not use them: we could not locate them in a primary source with a published method.

Why a ban on its own can fall short

A committee's usual reaction is to block: close off the domains of AI assistants and issue a circular. Cisco reports that 27% of organizations banned generative AI, at least temporarily, while 63% limited which data can be entered and 61% limited which tools can be used [2]. Limits on data and tools were reported more often than a total ban. Since the answers may overlap, the study does not allow us to say that they are mutually exclusive alternatives or that there is a sequence between them.

The practical reason is simple. If the urgent task continues and there is no authorized alternative that solves the case, some people may look for routes outside corporate control: their phone, their personal account, their home network. A block can push part of the use into less visible places, and what cannot be seen is hard to govern or to explain to an auditor. This is our operational inference, not a conclusion measured by the studies cited: the surveys show that use is widespread even where rules exist, and do not measure what happens after a ban.

The useful question, then, is not "how do we stop it?" but "what do we give in exchange that is better?"

Why it matters in Mexico, even without an "AI" rule

The LFPDPPP is a relevant starting point for private organizations. It is the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (the Federal Law on the Protection of Personal Data Held by Private Parties), whose enacting decree was published in the DOF (Diario Oficial de la Federación, Mexico's official gazette) on March 20, 2025 [4]. Among its obligations are the privacy notice, consent where applicable, the processing of sensitive data and certain transfers: in short, it regulates the informed and controlled processing of personal data. For a financial institution, an insurer or a regulated company, that analysis does not replace a review of the sector regulation, contractual obligations and internal criteria that apply to its case.

In July 2026, the Secretaría Anticorrupción y Buen Gobierno (the Ministry of Anti-Corruption and Good Governance), which today oversees the law on personal data held by private parties, fined the Federación Mexicana de Futbol (the Mexican Football Federation) 42,849,095 pesos over its fan identification system. According to the authority's press release, it faulted the failure to properly inform fans that their biometric data were sensitive personal data and improper consent for processing them. The release does not mention a leak or an unauthorized access, and notes that the Federation may challenge the ruling [5]. It is not an AI case and we do not present it as one.

The lesson for a committee is a different one. The authority sanctioned failures in informing about, and obtaining consent for, the processing of personal data. If employees at your company paste customer data into a tool you have not inventoried, the question "where did that data end up, on what basis and who authorized it?" may have no documented answer. That, and not only a leak, is the exposure. A specific legal opinion on your case is a matter for your legal advisor.

Govern before banning: two frameworks that already exist

There is no need to invent a method. There are two references that can be used as a checklist for the committee.

NIST AI Risk Management Framework 1.0, published on January 26, 2023 by the United States standards institute. It is voluntary and is organized into four functions: govern, map, measure and manage [6]. NIST states today that version 1.0 is under revision. In July 2024 it published a specific profile for generative AI [7]. For an executive, what is useful is that "govern" cuts across the other functions: it defines accountability and policy while the organization identifies its AI systems, their uses and their risks. The inventory does not replace governance; it feeds it.

ISO/IEC 42001:2023, the international standard for AI management systems: a framework for establishing, implementing, maintaining and improving an AI management system within an organization [8]. It can help organize policies, responsibilities and continuous improvement; it does not replace the legal or contractual obligations of each organization.

Neither solves the problem for you. But both agree on something the committee can use starting this week: it is hard to govern what you have not inventoried.

The approved alternative: making the right thing also the easiest

Governing is not just policy. It is giving people a tool that solves the same task with control. An approved alternative should be evaluated against five business and control criteria:

1. It queries only sources authorized for the use case, so that it answers with the company's own information, without depending on an employee copying and pasting documents.
2. It applies the permissions defined by the company. A person does not get through the AI what they cannot query in the original system.
3. It keeps the usage evidence that the retention policy allows and requires: what was asked, which data was used and what was answered, so that it can be explained.
4. It handles sensitive data according to the classification, policy and obligations that apply, for example what is hidden or blocked before reaching a model.
5. It documents where the data is processed, which third parties are involved and which contractual conditions govern those flows. For some data and processes, a provider's cloud with an adequate contract may be enough. For others, a regulated company may prefer that the model run on its own infrastructure.

That last criterion is the one that most changes the conversation with the board and with the compliance area. Your own infrastructure can reduce certain flows to third parties, but by itself it does not resolve permissions, copies, backups, support, logs, retention or contractual obligations. The decision must rest on a documented map of flows and responsibilities.

Scenario (illustrative, no client). An insurer detects that its claims area uses public assistants to summarize reports and adjusters' emails. Instead of banning them, it evaluates an internal tool that would query the claim files with the user's permissions, summarize and draft, and record every query. The hypothesis to validate would be that an authorized alternative, useful for the same task and accompanied by clear rules, reduces the incentive to copy files into personal accounts. The committee would have to measure adoption, exceptions and available evidence before concluding that the risk went down.

Five questions for your next committee

1. Do we know today how many AI tools are used in the company and who uses them? If the answer is an estimate and not an inventory, that is the first finding.
2. Which types of data are prohibited from going to an external assistant? Customers' personal data, sensitive data, non-public financial information, code and contracts. Is it written down and do people know it?
3. What approved alternative did we give them? If the answer is "a circular," the committee does not yet have evidence of an authorized, usable and adopted alternative.
4. Are there clear executive accountability and a decision structure for AI uses? A policy without a named owner has no one to enforce it.
5. If an authority, a customer or an auditor asks us where data that someone pasted into a tool ended up, can we answer with evidence? Which tool, which data, on what basis and with what audit trail.

If two or more answers are "I don't know," there is enough reason to agree on an owner, an initial scope and a joint review by business, technology, security, privacy and legal.

Where to start this week

Before deciding on a project, it is necessary to agree on an initial scope, an executive owner and an inventory proportional to the risk.

Ask Security, Privacy, Legal and the areas with the greatest exposure (claims, credit, collections, customer service, finance) to define a brief, confidential, non-punitive survey: tools used, purpose, categories of data and source system. The goal is for the usage to come to light, with a mapping approach and not a sanctioning one. With that survey, make a preliminary classification into three groups: what can continue with a business account and contract, what needs an internal tool with control and what should not happen. That classification must be validated against the applicable obligations before authorizing, restricting or redesigning a use. It is also an input for "map" in the NIST framework and for an inventory such as a management system would require.

If the exercise reveals that what is done most is summarizing, drafting and querying your own documents, you already know where the value of evaluating an approved alternative lies.

What Hábil does

If your organization identifies the need for an authorized alternative for a specific process, Hábil AI and Nova are options you can evaluate with Hábil. Hábil AI connects AI with the systems a company already has, with control over who can see what and an audit trail of what is queried; when the data must not leave the organization, Nova is the AI that runs on your own infrastructure. Which option fits depends on the process, the authorized sources, the sensitivity of the data, the permissions, the applicable obligations and the evidence your organization needs to keep. For access control, the page Control who has access.

The first assessment conversation is at no cost: it serves to review the case, its dependencies and the next step that makes sense. Write to us on WhatsApp.