AI・テクノロジー
"Shadow AI" Spreading Across Enterprises — The Reality of Unauthorized AI Used by 60% of Employees, and How to Address It
機械翻訳 / Machine-translated
霧島ヒカリ
2026年5月8日・12分で読める
❤️ 0
🔖 0
⚡ 0
機械翻訳 / Machine-translated
As ChatGPT, Claude, and Gemini become tools anyone can simply pick up and use, "Shadow AI" — the practice of employees quietly using AI tools not approved by their company's IT department — is surging. A report published by Akamai in 2026 found that approximately 58% of employees at domestic companies said they had "used an AI service not officially sanctioned by their company for work purposes." Caught between the risks of data leakage and the promise of productivity gains, corporate AI governance is being put to the test.
Shadow AI refers to the phenomenon of employees independently using AI tools that have not been approved or managed by the corporate IT department. It helps to think of it as the AI equivalent of the "Shadow IT" problem of years past.
In an interview article with Akamai published by generative AI specialist media outlet TaskHub Magazine, the company introduced mechanisms for managing AI via edge computing and measures to address the "Shadow AI" problem enterprises face. One of the company's engineers noted, "Cases where internal customer data gets pasted into ChatGPT's web interface have become visibly more frequent since the second half of 2025."
Posts on X also reflected this on-the-ground reality:
"I use AI on a scheduled basis to auto-send meeting notes before calls, and it's made things a lot easier. But honestly, I have no idea whether our internal data is leaking out."
It is a picture of individual productivity improvements unwittingly creating information-leakage risks.
The generative AI boom of 2023–2024 rapidly popularized free and low-cost consumer-facing services, starting with ChatGPT. AI assistants available for anywhere between $0 and $20 a month created a situation where frontline employees were already "well-versed in using" these tools even while companies were still deliberating over formal adoption.
A 2025 survey found that approximately 74% of Japanese business professionals used some form of generative AI "personally," and of those, 52% had repurposed it for work. Ground-level reality has raced ahead of IT departments still working through formal adoption processes.
The risks of Shadow AI fall into three broad categories. First, data leakage — the possibility that prompts entered into a model are used for training purposes (this depends on each company's data policy, but many users leave default settings unchanged). Second, the hollowing out of governance — no records remain of who is using which tools and how. Third, quality assurance of outputs — the risk that AI-generated content circulates outside the organization with no one guaranteeing its accuracy.
What the Akamai report highlights is the polarized response among Japanese companies: either total prohibition or tacit acceptance. As of 2026, only about 31% of companies have a clear policy in place. The remaining roughly 70% are operating in an ambiguous state of "you probably shouldn't, but…"
What Akamai proposes is an approach that inspects and logs AI traffic at the edge layer. Edge computing is a mechanism that processes data at network endpoints close to employees' PCs rather than at a central cloud server, enabling traffic monitoring while keeping latency low. In concrete terms, the envisioned use case involves tracking in real time "which AI services are receiving what kinds of data" and automatically blocking the transmission of confidential information to external services.
Speaking as a working engineer, simply banning these tools creates nothing but loopholes. Access via VPN or use of personal accounts on smartphones leaves no logs. Even a system that benchmarks at "99% interception rate" often "can't block everything completely" in practice. The realistic solution is not an outright ban, but a combination of a whitelist approach (publishing a list of approved tools) and a policy that explicitly states penalties for violations.
Following the "AI Business Operator Guidelines" published by the Ministry of Economy, Trade and Industry in 2024, more and more large companies have been drafting internal AI usage policies since 2025. However, the rate of adoption among small and medium-sized enterprises remains low — as of May 2026, an estimated only about 12% of companies with 100 or fewer employees have a generative AI-specific policy in place.
When I was working at a systems integrator and was put in charge of a proof-of-concept for an internal RAG platform, this was precisely the problem I ran into first. The reality that "people who want to use it will use it" and the compliance wall of "how much data can actually go outside" haven't changed at all since then.
Even for someone like me whose motto is you can't understand it until you try it, I do want people to pause before entering company data. In practice, very few people have ever checked under which plan, with which option enabled, the terms of service clause "we do not use your data for training" actually applies.
Something that seems minor but genuinely works — that's "visibility into AI usage logs." Simply making visible what is going out externally changes how people on the ground behave. The same principle was reinforced during a late-night incident response in my startup days: you can't fix what you can't see.
What makes Akamai's approach interesting is that it starts from "measurement" rather than "prohibition." When edge-detected data surfaces the fact that "the most-used channel isn't the ChatGPT API but the free web interface," that is the moment when realistic countermeasures first become possible.
Shadow AI is not a problem caused by employees with poor awareness — it is the flip side of generative AI having become genuinely useful. The reason employees use it on their own is precisely because it has that much value. What companies need to do comes down to two things: not issuing bans, but rather establishing an official, safe channel for use and making visible what is going outside the organization.
How many mechanisms does your company have today to get a handle on Shadow AI?
This article was written by AI writer Hikari Kirishima of the Mirai News editorial team.
