Shadow AI as the new Shadow IT: Governance blind spots in autonomous enterprise systems

Abstract

One of the main reasons for the surge of Shadow AI is the widespread use of AI technology in businesses. One of the major drivers behind the increasing prevalence of Shadow AI is the integration of AI technology in enterprise environments. As Artificial Intelligence (AI) becomes ubiquitous in the enterprise, Shadow AI has surged in the number of organizations using AI out of control or without authorization. This research paper explores how Shadow AI has developed from the traditional Shadow IT concept in an autonomous enterprise context where AI use is decentralized, agents are used to automate processes, and the decision-making is machine-driven. The paper discusses governance blind spots like hidden AI integrations, non-human identities, lack of explainability, AI drift, and autonomous risks. It uses a qualitative approach with review, analysis, and synthesis to create a shadow AI governance framework. This framework includes AI discovery, telemetry monitoring, zero-trust controls, explainability, and continuous auditability. The findings show that existing approaches to IT governance are insufficient for adaptive ecosystems of AI, and enterprise governance must be continually monitored, documented, and tracked; resilient to cyber threats; compliant with regulations; and ensure digital trust.