What is shadow AI?

Shadow AI is any use of AI that happens outside approved, governed channels. It includes browser chat tools, desktop apps, browser extensions, coding assistants and AI agents that employees adopt on their own, often with good intentions and personal accounts. It is the AI version of shadow IT, and it is growing quickly.

How common and how costly is shadow AI?

IBM and the Ponemon Institute's 2026 Cost of a Data Breach study found shadow AI involved in 43% of the breaches studied, up from 20% the year before [1][2]. Breaches involving shadow AI averaged $5.39 million, compared with a record global average of $4.99 million across all breaches [3]. Among organizations with an AI-related incident, 92% lacked proper AI access controls [3]. The prior edition found that 63% of breached organizations had no AI governance policy [4].

The behavior behind these numbers is ordinary. One 2025 workplace study reported that 77% of employees paste data into generative AI prompts, and 82% of those pastes came from personal accounts [5]. Shadow AI breaches have also been reported to take longer to detect, 247 days versus 241 on average [6].

Why shadow AI matters for New Jersey businesses

Whether you run a firm in Central Jersey, Newark, Jersey City or the wider NJ and NYC metro area, two local signals are worth knowing.

The state is already drawing the line. New Jersey's own guidance for state employees, Joint Circular 25-OIT-001, issued by the Office of Information Technology and the NJ Cybersecurity and Communications Integration Cell (NJCCIC), says only tools approved through their review processes may be used for transcription and summarization when sensitive content is involved [7]. State employees are also told not to put sensitive or private information, such as personally identifiable information, into AI prompts [8]. The state went further and built the NJ AI Assistant, a protected environment, because generative AI software often captures inputs to improve its models, which could expose internal data [9]. The pattern is the one to copy: approve, restrict and provide a safe option. This guidance covers state employees, not private companies, but it shows what a careful approach looks like.

The New Jersey Data Privacy Act raises the stakes for customer data. The Act took effect on January 15, 2025, and applies to businesses and nonprofits that meet its thresholds [10][11]. Among other duties, covered businesses must use reasonable data security practices, conduct data protection assessments for higher-risk processing such as profiling and sensitive data, and keep records of those assessments [11]. If employees paste customer personal data into an unapproved AI tool, it becomes much harder to show that those duties are being met. The Act is enforced through the state, with rules to be issued by the Division of Consumer Affairs, and it has no private right of action [10]. Whether it applies to you is a question for your counsel.

Step 1: Discover what is actually in use

Build an inventory of AI tools, extensions, desktop apps, coding assistants and agents, not just the approved list. Include the tokens and service accounts they use, since unapproved agents can reach systems through credentials no one is tracking [12]. Combine a short survey of your teams with a review of network and SaaS logs.

Step 2: Define the rules in plain language

Write a one-page acceptable use policy. Sort data into a few classes (public, internal, confidential, regulated) and state which tools may handle each. Be explicit about personal accounts, which typically have no enterprise retention controls, audit trail or contractual data protections [6]. The NIST AI Risk Management Framework is a vendor-neutral reference for structuring this work [13].

Step 3: Control it by design

A policy alone will not stop a rushed paste. Add access controls, data classification and monitoring so the rules are enforced inside the workflow. Prioritize the places customer personal data lives, because shadow AI incidents disproportionately expose it and cost more per record [14].

Step 4: Provide a safe, convenient alternative

Blocking AI outright rarely works, because the productivity benefits are real and people find workarounds. Offer approved, governed tools that are as easy to use as the risky ones, and explain why the rules exist. New Jersey's AI Assistant for state staff is a public-sector example of this approach [9].

Quick checklist

• We know which AI tools, extensions and agents are in use
• Our policy says which data can go into which tools
• Controls and logging enforce that policy
• Approved alternatives exist and are easy to find
• Counsel has reviewed how the NJ Data Privacy Act applies to us

Frequently Asked Questions

What is shadow AI?

Shadow AI is the use of AI tools by employees without the organization's approval, visibility or governance. Examples include personal chatbot accounts, unapproved browser extensions and coding assistants.

How common is shadow AI in data breaches?

IBM's 2026 Cost of a Data Breach study found shadow AI in 43% of breaches studied, up from 20% a year earlier [1][3].

How much does a shadow AI breach cost?

Breaches involving shadow AI averaged $5.39 million in IBM's 2026 data, compared with $4.99 million for breaches overall [3].

Does New Jersey have rules about employees using AI at work?

New Jersey has issued AI guidance for state employees, Joint Circular 25-OIT-001 [7]. For private businesses, the New Jersey Data Privacy Act sets data security and assessment duties for covered organizations [10][11]. Ask your counsel whether it applies to you.

Should we ban AI tools to stop shadow AI?

Bans alone rarely work because people find workarounds. A better approach combines clear rules, technical controls and approved tools that are easy to use.

What is the first step to controlling shadow AI?

Start with an inventory. You cannot govern tools you do not know about, so identify which AI tools, extensions and agents your teams actually use.

Ready to Bring AI Under Control in New Jersey?

AI adoption does not have to mean giving up visibility. The SamurAI's AI Governance capability helps New Jersey organizations control what they deploy and trust what they build, with practical policies, controls and oversight designed around how your teams really work.

Not sure which AI tools are active in your environment today? That is a good place to begin. Book a consultation with our Bridgewater, NJ team to map your AI footprint, or learn more about AI Governance.

References

1. IBM X-Force, "AI-powered adversaries and the enterprise risk challenge: Preparing for the new reality" (2026 Cost of a Data Breach analysis). https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk
2. CIO, "Claude Code, Codex and Cursor have become part of your software supply chain, without approval." https://cio.com/article/4245820/claude-code-codex-and-cursor-have-become-part-of-your-software-supply-chain-without-approval.html
3. CoreWin, "IBM Cost of a Data Breach Report 2026." https://corewin.ua/en/news-en/cost-of-a-data-breach-report-2026/
4. Passwork, "What is Shadow AI: The hidden threat costing enterprises $670K per breach" (summarizes IBM's 2025 report). https://passwork.pro/blog/what-is-shadow-ai/
5. Entagl, "Shadow AI Risks and Governance in 2026" (cites LayerX Enterprise AI and SaaS Data Security Report 2025). https://www.entagl.com/blog/shadow-ai-risk-governance-2026
6. Matters.ai, "Shadow AI Data Breach Cost: $670K More Per Incident." https://www.matters.ai/article/shadow-ai-data-breach-cost
7. State of New Jersey, Joint Circular 25-OIT-001, "Guidance on Responsible Use of Generative AI" (OIT and NJCCIC). https://www.nj.gov/it/docs/ps/25-OIT-001.pdf
8.  StateScoop, "New Jersey publishes generative AI policy for state employees." https://statescoop.com/new-jersey-generative-ai-policy-state-employees/
9. NJ Office of Innovation, "NJ AI Assistant," 2024 Impact Report. https://innovation.nj.gov/impact-report/2024/ai-assistant
10. WilmerHale, "New Jersey Enacts Comprehensive Privacy Law" (January 2024). https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20240117-new-jersey-enacts-comprehensive-privacy-law
11. Ogletree Deakins, "New Jersey Joins Data Privacy Party: New Jersey Data Protection Act Becomes Effective in January 2025." https://ogletree.com/insights-resources/blog-posts/new-jersey-joins-data-privacy-party-new-jersey-data-protection-act-becomes-effective-in-january-2025/
12. CIO, as in source 2 (coding assistants and agents adopted without approval).
13. NIST, AI Risk Management Framework. https://www.nist.gov/itl/ai-risk-management-framework
14. Nudge Security, "Shadow AI: The emerging threat in IBM's 2025 breach report." https://www.nudgesecurity.com/post/shadow-ai-the-emerging-security-threat-in-ibms-2025-cost-of-a-data-breach-report