Shadow AI in Finance: Risks, Evidence, and Controls

Shadow AI in finance is the use of AI tools, plug-ins, agents and automations by staff of a financial firm without the review, approval or monitoring that the firm's risk, compliance and security functions require. The practical problem is not the tool itself. It is that an unapproved tool touches customer data or influences a decision, and the firm cannot later show an auditor or regulator what happened. The remedy has three parts: find the AI in use, govern it with proportionate policy, and retain evidence that oversight actually operated.

This guide is written for risk, compliance and governance leaders at regulated firms. It covers where shadow AI appears, what US regulators and their UK counterparts expect, and how to build an inventory and an evidence trail without inserting new tooling into production systems.

TL;DR

• Shadow AI is unsanctioned AI use inside a firm, from public chatbots used to summarize documents to third-party plug-ins and autonomous agents connected through OAuth grants.
• The exposure is regulatory and evidentiary: customer data leaving the firm, inaccurate outputs reaching customers, and an inability to show supervision when examiners ask.
• Blanket bans tend to push use out of sight. Gated access to approved tools, a formal review process and an AI inventory give a firm something it can defend.
• Regulators on both sides of the Atlantic point to the same evidence: prompt and output logs, model versions, escalation decisions and documented human oversight.
• A read-only, metadata-only discovery layer can build the inventory and the evidence without touching customer data.

Table of Contents

• What shadow AI means in a regulated firm
• How common is unapproved AI use in banking?
• Why shadow AI is a supervisory and disclosure issue
• What US and UK supervisors expect
• Where shadow AI hides: a discovery approach
• Governing use without relying only on bans
• The evidence an examiner will ask for
• Our perspective: oversight you can verify offline
• Start with an inventory and an evidence pack
• A 90-day sequence for a US firm
• FAQ
• Sources

What shadow AI means in a regulated firm

Shadow AI is a newer, narrower form of shadow IT. Shadow IT covers any unapproved software, hardware or service. Shadow AI covers AI tools and AI-enabled SaaS used without formal approval or oversight from the IT department, typically for tasks such as text editing, summarizing or data analysis, as IBM's overview describes it.

In a regulated financial firm the definition needs one extension. The unapproved item is not only a chatbot in a browser tab. It can be:

• a public generative AI tool used by an analyst to summarize a credit memo or a client call transcript;
• a browser extension or plug-in that reads content on screen;
• an AI feature switched on inside an approved SaaS product without the vendor review being refreshed;
• a third-party agent or automation granted access to mailboxes, drives or calendars through OAuth, often created by an individual user rather than by IT;
• a script or low-code automation that calls an external model and writes results back into a workflow.

The last two matter most for governance teams. They persist after the person who created them has moved on, they hold standing permissions, and they can act without a human opening an application. Autonomy raises the stakes: Deloitte's analysis of agentic AI in banking lists unauthorized data access, unintended payment or document changes, opaque loan decisions, runaway execution and cascading errors among the risks, and it ties exposure to an agent's autonomy, its integration into banking workflows and its ability to pass outputs into downstream tasks.

How common is unapproved AI use in banking?

Usage is widespread, and restriction alone has not stopped it. An American Banker survey found that 30% of banks were restricting generative AI use, at least for some users. A restriction on paper is not the same as visibility into what staff actually do.

A separate Finextra report on a bank staff survey carries a headline that two-thirds of bank staff use unapproved AI tools. In it, a DeepL executive argues that the primary risk is not employee experimentation but a firm's failure to give frontline teams secure, fit-for-purpose solutions. That reading matches how most supervisory conversations go: examiners care less about whether staff were curious and more about whether the firm knew, assessed and controlled what they used.

Why shadow AI is a supervisory and disclosure issue

Customer data and privacy

FINRA has noted that AI applications in the securities industry may collect, analyze and share sensitive customer data, including personally identifiable information, biometrics, location, social-media activity and recorded communications, and that inadequate safeguards create customer-privacy concerns. FINRA's perspective is that firms should evaluate both the data fed into AI models and the information the models produce against their customer-privacy obligations. An unapproved tool defeats that evaluation, because nobody assessed it.

The American Bar Association's June 2026 analysis adds that unauthorized AI use involving nonpublic data can create privacy, cybersecurity, reporting, notification, enforcement, litigation and contractual risks in the US, including under the Gramm-Leach-Bliley Act and state privacy laws.

Inaccurate outputs and consumer harm

The US Government Accountability Office has reported that AI models may produce inaccurate information about financial products or services, potentially harming consumers or investors, and that AI used to market credit products carries fair-lending risks. See GAO-25-107197. When the model in question is a staff member's personal account, no one tested it for either problem.

The Financial Stability Board makes a related point about transparency: insufficient disclosure about AI's role in financial products and services can prevent customers from understanding or challenging decisions that affect them or from seeking redress. A firm that does not know where AI sits in its processes cannot disclose it.

Securities disclosure

Shadow AI has now reached public-company disclosure. A Wilson Sonsini analysis describes a Form 8-K prompted by unauthorized AI use and lists the exposures that follow: regulatory scrutiny, customer or shareholder litigation, and emerging liability theories about the adequacy of an organization's AI governance framework and its enforcement of internal AI policies. The last point is the one for compliance leaders to note. A written AI policy that is not enforced or evidenced can become the issue itself.

Separately, the SEC's Investor Advisory Committee proposed in a draft 2025 recommendation that issuers disclose their board oversight mechanisms for AI deployment. It is a recommendation for discussion, not a rule, but it shows the direction of questions boards may face.

What US and UK supervisors expect

There is no single US "shadow AI rule." Existing obligations apply to AI like any other technology, and supervisors have said so.

The FCA publication also notes that firms should set up multi-disciplinary AI governance bodies, such as data ethics committees, to set principles and risk tolerances. For a US firm with a UK or EU entity, the practical result is one governance model that satisfies several regimes rather than separate programs. The EU AI Act's Article 26 deployer obligations, including human oversight and logging, point the same way, and our guide on building an Article 26 ready program covers that side.

Where shadow AI hides: a discovery approach

A ban list cannot find what it does not name. Discovery has to start from the systems every firm already runs and ask which AI is connected to them.

1. Start from identity, not from devices. Shadow AI that matters connects to corporate accounts. Review OAuth grants and third-party app authorizations in the email, document and collaboration platforms the firm uses, and list every grant that carries AI functionality or an unfamiliar publisher.
2. Include automations created by staff. Scripts and low-code workflows inside productivity suites can call external models. Record who created each one, what it can read and where its output goes.
3. Review approved vendors for new AI features. A tool approved two years ago may now include a generative feature that changes the data flow. Treat feature releases as triggers for re-review. Our plan for third-party AI risk lays out a staged approach.
4. Map each item to a business owner and a decision. An inventory entry should name the owner, the data classes reachable, and whether the output influences a customer-facing or financial decision.
5. Rank by concentration. Ten harmless summarizers matter less than one agent that can read treasury mailboxes and send messages. Rank by what an entry can reach and what it can change, including potential financial exposure.
6. Repeat. Discovery is a recurring control. NYDFS expects risk assessments to be refreshed at least annually, and an inventory that is a year old at that point is not evidence of anything.

This is where an identity graph helps: it links each AI agent to the accounts, permissions and downstream systems it can reach, so a reviewer can see relationships rather than a flat list. Our explanation of AI identity graphs and audit replay shows how that works without agents installed on endpoints.

Governing use without relying only on bans

Bans are easy to write and hard to evidence. The American Banker coverage cited above describes firms moving toward gated access to approved AI tools, internal AI portals, sandboxes for experimentation and training on responsible use. Jennifer Smith, chief technology and operations officer at Zions Bank, is quoted there describing gated access and sandboxes as effective ways to meet employee needs while protecting data.

A workable policy set for a regulated firm usually contains:

• An approved-tools register with data classes each tool may handle.
• A formal intake and review path that is fast enough that staff use it. FINRA expects review and approval with both business and technology expertise, and a slow path is a reason for shadow use.
• A sandbox tier for experimentation with synthetic or public data only.
• Role-based segregation so that the person who builds or deploys an automation is not the one who approves its risk acceptance. See segregation of duties for AI.
• Training tied to the register, so staff know what is approved and where to request a new tool.
• A named governance body. The FCA's suggestion of a multi-disciplinary committee fits any firm size when scaled to its size, and the FCA is explicit that existing frameworks can be adapted.

Controls need to be testable. Engineering-oriented guidance on model monitoring mapped to NIST governance shows how dashboards, spot checks and lifecycle documentation connect to a formal framework, which helps a compliance team translate a policy statement into something an examiner can inspect.

The evidence an examiner will ask for

Policy describes intent. Evidence shows operation. The FCA's good-practice review found firms keeping records of consumer prompts, outputs, model versions, applied filters and escalation decisions, and documenting human oversight and decisions, as described by the FCA. The same publication recommends continuous monitoring, such as dashboards with thresholds, spot checks for model drift and audit trails of AI interactions.

FINRA's 2026 oversight report is consistent: firms should monitor prompts, responses and outputs, which may involve storing prompt and output logs for accountability and troubleshooting, and should test GenAI for privacy, reliability and accuracy while keeping documentation across the lifecycle (FINRA GenAI section). If a firm relies on GenAI within its own supervisory system, its policies may also consider that model's integrity, reliability and accuracy. An industry practitioner's comment on a FINRA notice makes the same point sharply: governance has to extend to the AI used for supervision, with documented model validation and prompt oversight.

A useful evidence checklist therefore includes:

Some of these rows involve content, and content logging raises its own privacy duties. Several of them, however, can be proven from metadata alone: that an agent exists, who owns it, what scopes it holds, when it was reviewed. We explain that boundary in proving AI oversight on metadata alone and in the companion piece on proving data minimization without raw data.

Our perspective: oversight you can verify offline

Most firms we speak with can describe their AI policy. Fewer can produce, on request, a dated record of which AI agents are connected to their environment, who owns them and what they can reach. That gap is where shadow AI becomes a finding.

We built AETHER Pulse around a simple position: governance tooling for regulated firms should not itself become a new risk. It connects through OAuth metadata only, touches no customer data, and installs no endpoint agents. From that metadata it builds an inventory and identity graph of AI agents, surfaces risk concentration including financial blast-radius exposure, and generates evidence packs that are signed with HMAC-SHA256 so that an auditor can verify them independently and offline. Each risk classification is deterministic and traceable to public regulatory and industry sources, which means a reviewer can re-run the logic and reach the same answer.

This matters for shadow AI specifically. A discovery tool that needs privileged access to production systems or customer content asks the security and privacy teams to approve a new exposure before the firm learns what it already has. A read-only metadata layer lets risk and compliance start the inventory without that dependency, and it produces something tamper-evident that can sit in the audit file. Our view is that the firms who handle the next examination best will be those who treated discovery as a recurring, evidenced control rather than a one-off survey. The practical shape of that rollout is covered in our agentless governance plan and the four-function governance framework.

— Eleye

Start with an inventory and an evidence pack

If you want to see what an agentless inventory looks like for your own environment, AETHER Pulse offers Free, Pro and Enterprise plans on the main site, and Design Partner, Production and an Article 26 readiness audit on the pricing page. Pricing is not published, so the pricing page is the place to check current terms and scope. You can also review how signed evidence infrastructure for AI agents works.

For teams building the oversight view itself, the dashboard requirements for regulated firms list what a risk committee should see, and the guide to deterministic controls for AI explains how to make those controls reproducible.

A 90-day sequence for a US firm

A realistic first quarter does not try to govern everything. It aims to be able to answer the examiner's first three questions: what AI is in use, who owns it, and what has been done about it.

1. Weeks 1 to 3: scope and discover. Agree a definition of shadow AI with legal, security and compliance. Pull OAuth grants, automation inventories and vendor feature lists. Produce the first inventory, accepting that it will be incomplete.
2. Weeks 4 to 6: classify and rank. Tag each entry by data class reached, decision influence and autonomy. Rank by concentration of access and potential financial exposure. Choose the handful that need immediate action.
3. Weeks 7 to 9: decide and document. For each priority item, approve with conditions, move to a sandbox, replace with an approved tool, or retire. Record the decision, owner and date.
4. Weeks 10 to 12: publish the pathway and the evidence. Launch the intake path and approved-tools register, brief staff, and file the first dated evidence pack with the risk assessment. Schedule the refresh.

The point of the sequence is repeatability. The second inventory will show change over time, and change over time is what demonstrates that oversight operates rather than exists on paper.

FAQ

What is the difference between shadow AI and shadow IT?

Shadow IT is any technology, application or service used without approval. Shadow AI is the subset involving AI tools, such as public chatbots, AI plug-ins and AI-enabled SaaS. It adds concerns about how models handle data, generate outputs and influence decisions, which a typical unapproved spreadsheet tool does not.

Should a financial firm ban generative AI?

A ban is a policy choice, but it is hard to evidence and can push use out of sight. Firms described in American Banker coverage have moved toward gated access to approved tools, internal portals, sandboxes and training. Whatever the policy, the firm still needs an inventory to show the policy is followed.

Which US rules apply to shadow AI?

No single rule is named for it. FINRA says its existing rules apply when firms use GenAI and expects reasonably designed supervisory systems. NYDFS expects AI-related risks in annual risk assessments. Privacy laws such as Gramm-Leach-Bliley and state statutes can apply when nonpublic data is involved. Confirm the specifics with counsel for your charter and regulator.

What evidence should we keep to show oversight?

Keep an inventory with owners, approval records, escalation and human-review decisions, and, where content is in scope and permitted, prompt and output logs with model versions. The FCA and FINRA both point to audit trails and documentation across the AI lifecycle. Metadata can prove existence, ownership and permissions without storing customer content.

Can we discover shadow AI without accessing customer data?

Yes, for a large part of it. Identity and authorization metadata shows which AI agents and apps are connected, who owns them and which scopes they hold. That supports an inventory and risk ranking without reading customer records, though content-level testing still needs its own controlled process.

Sources

• What Is Shadow AI? | IBM
• Agentic AI risks in banking | Deloitte Insights
• Rise of 'shadow AI' presents dilemmas for tech leaders | American Banker
• Two-thirds of bank staff using unapproved AI tools | Finextra
• Key Challenges and Regulatory Considerations | FINRA
• What We Do in the Shadows . . . with Shadow AI | American Bar Association
• GAO-25-107197, Artificial Intelligence | US GAO
• Sound Practices for Responsible Adoption of Artificial Intelligence | FSB
• "Shadow AI" Triggers First SEC Form 8-K for Unauthorized AI Use | Wilson Sonsini
• Recommendation of the SEC Investor Advisory Committee | SEC
• GenAI: Continuing and Emerging Trends | FINRA
• Cybersecurity Risks Arising from AI and Strategies to Combat Related Risks | NYDFS
• AI in financial services: good practice and areas for improvement | FCA
• Jaime Arroyave Comment on Regulatory Notice 26-14 | FINRA
• Map Signals to NIST Governance: Engineer First Model Monitoring

Recommended

• Build Audit Ready Deterministic Controls for AI in Regulated Finance
• AI Agent Governance for Finance: Four Functions, Evidence by Design
• Segregation of Duties for AI: Audit Ready ADEL for Compliance Teams
• 30/90/180-Day Audit-Ready Plan for Third-Party AI in Regulated Firms