Issue Shadow AI puts autonomous decision-making outside any governance perimeter

Summary

Deloitte warns that many of the most pressing AI risks now originate inside the organisation, and names shadow AI as a leading example. Shadow AI refers to unsanctioned AI deployed by individual teams across an enterprise. It creates governance blind spots and brings in autonomous decision-making systems that can reach sensitive data, make consequential choices and interact with other systems. Each such deployment is a potential source of data leakage, model manipulation, model drift or unauthorised access. The report suggests that approaches developed for shadow IT, such as monitoring the network to discover all applications and setting policies so new deployments meet privacy and security standards, can be adapted. It pairs shadow AI with inadequate controls on agentic AI as the two main internal threats.