Shadow AI: The ITSM Risk Nobody Is Talking About

Most organisations are still debating whether they should adopt Artificial Intelligence. The reality is that many employees have already made that decision for them.

Across service desks, project teams, development groups, and support organisations, staff are increasingly using AI tools such as ChatGPT, Copilot, Gemini, and others to help them work faster, write documentation, analyse information, and solve problems.

Often, this is happening without formal approval, governance, risk assessment, or security review.

This phenomenon has become known as "Shadow AI" the use of AI tools outside of approved organisational processes and controls.

While much attention has been given to the opportunities presented by AI, far less attention has been paid to the risks of unmanaged adoption.

For IT Service Management professionals, Shadow AI may be one of the most significant emerging risks facing organisations today.

What Exactly Is Shadow AI?

Shadow AI is similar to Shadow IT. Just as employees once downloaded unauthorised software or subscribed to cloud services without IT approval, they are now adopting AI tools independently to improve productivity. The intention is usually positive.

• An analyst wants to draft a customer response faster.

• An engineer wants help interpreting logs.

• A project manager wants assistance writing documentation.

• A service delivery manager wants help summarising meeting notes.

None of these activities seem particularly risky in isolation. The challenge is that many employees do not fully understand what information they are sharing, where it is being processed, or what organisational obligations may apply.

The Service Desk Is Particularly Vulnerable

Service desks are uniquely positioned at the intersection of technology, customer information, operational data, and business processes.

Every day, analysts work with:

• Incident records

• Customer information

• Technical documentation

• Configuration data

• Internal procedures

• Security-related information

• Commercially sensitive information

Without guidance, it can be tempting to use AI tools to speed up routine work.

• An analyst may copy an incident description into an AI tool to generate troubleshooting steps.

• A support engineer may upload log files for analysis.

• A team leader may ask AI to summarise a customer complaint.

While these actions may improve efficiency, they can also introduce significant risks if appropriate controls are not in place.

The Risks Hidden Beneath the Productivity Gains

The challenge with Shadow AI is that the benefits are often immediate and visible, while the risks remain hidden until something goes wrong.

Information Security Risks

One of the most obvious concerns is the handling of sensitive information.

Employees may inadvertently submit:

• Customer names

• Contact details

• Internal system information

• Configuration data

• Commercially sensitive information

• Security-related information

Without understanding how a particular AI service stores, processes, or retains information, organisations may expose data in ways they never intended.

Accuracy Risks

AI tools are capable of generating highly convincing responses that appear authoritative. However, confidence should not be mistaken for accuracy.

• An AI-generated troubleshooting step may be incorrect.

• A customer response may contain misleading information.

• A proposed solution may fail to consider important business context.

When AI output is accepted without review, service quality can suffer.

Compliance Risks

Many organisations operate under contractual, regulatory, or industry-specific obligations.

These requirements often extend to how information is processed and shared. Using AI without understanding these obligations can create compliance challenges that may not become apparent until an audit, investigation, or customer enquiry occurs.

Knowledge Management Risks

An overlooked consequence of Shadow AI is the impact on organisational learning. If analysts increasingly rely on AI to provide answers without understanding the underlying issues, organisations risk creating a workforce that consumes knowledge rather than develops it.

Service desks should be building capability, not outsourcing critical thinking.

Why Banning AI Usually Fails

Faced with these risks, some organisations respond by attempting to prohibit AI entirely. Unfortunately, this approach rarely succeeds.

Employees are often drawn to AI because it genuinely helps them work more efficiently.

If official guidance is absent, people will often find their own solutions.

The result is not less AI usage. The result is less visibility. Shadow AI thrives in environments where governance lags behind technology adoption.

A Better Approach: Govern, Don't Ban

The most effective organisations recognise that AI is becoming a standard workplace tool.

Rather than focusing solely on restriction, they focus on responsible adoption. This starts with clear governance.

Define Acceptable Use

Employees need practical guidance. For example:

Acceptable:

• Drafting internal documentation

• Creating meeting summaries

• Improving communication quality

• Generating knowledge article templates

Unacceptable:

• Uploading customer-sensitive information

• Sharing credentials or security information

• Using AI-generated content without review

• Making customer-impacting decisions solely based on AI recommendations

Establish Human Accountability

AI should support decision-making, not replace it.

Humans must remain accountable for:

• Customer communications

• Incident prioritisation

• Risk decisions

• Change approvals

• Technical validation

If an AI recommendation is wrong, responsibility still sits with the organisation.

Update Existing ITSM Processes

Many organisations view AI governance as a separate initiative. In reality, existing ITSM practices already provide a strong foundation.

Consider incorporating AI into:

• Information Security Management

• Risk Management

• Change Enablement

• Knowledge Management

• Supplier Management

• Continual Improvement

AI should be managed as another technology capability, not as a special exception.

Educate Before You Regulate

Most employees are not intentionally creating risk. Often, they simply lack awareness.

Training should focus on:

• Appropriate use cases

• Data handling requirements

• Verification of AI-generated outputs

• Organisational expectations

The goal is to create informed users, not fearful users.

The Opportunity Hidden Within the Risk

The emergence of Shadow AI highlights something important. Employees are actively searching for ways to work more effectively. That should be viewed as an opportunity.

Instead of asking: "How do we stop people using AI?"

Leaders should ask: "How do we help people use AI safely and effectively?"

The organisations that succeed will be those that combine governance with enablement. They will provide approved tools, clear guidance, appropriate controls, and ongoing education.

Most importantly, they will recognise that AI is not replacing people. It is changing how people work.

Final Thoughts

The biggest AI risk facing many organisations today is not the AI initiative they are planning.

It is the AI usage they don't know about.

Shadow AI is already present in many service desks, support teams, and operational environments. Ignoring it will not make it disappear.

ITSM professionals have a unique opportunity to lead the conversation by applying the same principles that have long governed technology adoption: risk management, service management, information security, and continual improvement.

The question is no longer whether employees are using AI. The question is whether your organisation is prepared to manage it responsibly.