The NCSC Says Shadow AI Will Persist—Blanket Bans Miss the Risk

In a briefing published on 7 September 2026, the UK’s National Cyber Security Centre warned that unapproved workplace AI is unlikely to disappear completely. It defines “shadow AI” as AI use outside an organisation’s approved systems and processes, and recommends understanding why employees adopt it, reducing the resulting risks and providing secure alternatives rather than assuming prohibition will end the practice.

The immediate implication is operational: organisations need evidence of which AI services are being used, what information reaches them and what authority connected agents possess. An IT Pro report published on 8 September highlighted the warning’s focus on sensitive-data exposure, loss of organisational control and the access available to compromised agents.

Why a ban cannot establish that use has stopped

The NCSC is not proposing unrestricted access to every AI service. Its point is that a policy cannot by itself prove compliance: when approved systems do not meet a business need, employees may adopt new services before security and procurement teams have assessed them. Falling prices and wider availability make that behaviour harder to eliminate completely.

A block on a known service may prevent one route of access without revealing comparable tools used through personal devices, software integrations or other channels. The organisation can then retain the exposure while losing visibility into the task employees were trying to complete and the information they supplied.

The briefing cites a study in which 71% of employees reported using AI tools that their employer had not approved. That figure describes respondents to a particular survey; it is not a universal prevalence rate and should not replace an organisation’s own inventory. Its useful implication is narrower: unapproved use may be sufficiently common that organisations should verify behaviour rather than infer it from written policy.

Agent privileges create a separate level of risk

Supplying company or customer information to an unapproved consumer service creates a data-governance exposure. Information may be stored, retained or used outside established security arrangements unless suitable privacy controls are present, reducing the organisation’s visibility and potentially increasing the risk of a breach, intellectual-property loss or regulatory failure.

Agents raise a different concern because they can act through connections to business systems. If an attacker exploits a vulnerability in an agent, the attacker may obtain the same data, services and legitimate privileges available to that agent. The decisive question is therefore not only whether AI is in use, but what the system can read, change or cause another service to do.

This separates contained experimentation from consequential access. Producing generic text without confidential inputs is materially different from allowing an unassessed agent to retrieve customer records, alter shared files or operate through a privileged account. Risk rises with the sensitivity of accessible data, the breadth and duration of permissions, the consequences of an action and the organisation’s ability to monitor or reverse it.

A decision tree for discovered shadow AI

Once unapproved use is found, the first branch is the underlying business need. The organisation needs to determine whether the activity is optional experimentation, a workaround for a missing feature or a workflow that has become dependent on an external service.

The second branch concerns exposure: what information entered the tool, where it may be processed or retained, which integrations were enabled and what permissions the service or agent received. Those findings support three proportionate outcomes:

• Approve with controls if the service meets a genuine need and its data handling, supplier terms, access boundaries and monitoring satisfy organisational requirements.
• Restrict the use if risk can be reduced by excluding sensitive inputs, removing integrations, narrowing privileges or requiring human approval for consequential actions.
• Replace the service if its processing or access cannot be made acceptable, while providing an approved tool that addresses the task driving adoption.

This decision tree is an editorial translation of the NCSC’s risk-reduction approach, not a compliance standard issued by the agency. A Secarma analysis dated 8 September similarly identifies discovery of existing use, realistic policies, supported alternatives and proportionate controls as the practical response.

Implementation remains an organisational decision

The publication sets a direction rather than announcing a new enforcement regime or prescribing a universal technical control. It does not establish one discovery method, a fixed approval threshold or a standard permission model for agents. Those choices depend on the organisation’s systems, information, sector and legal obligations.

The unresolved questions are therefore local: which services are already embedded in work, which unmet needs drive their use, what data has crossed organisational boundaries and which agents hold meaningful privileges. A ban can express an organisation’s position, but it cannot demonstrate that hidden use has been found or that the resulting exposure is controlled. The NCSC’s current advice leaves organisations to build that evidence and choose whether each use case should be approved, restricted or replaced.

Also read:

• 10 Signs Your Marketing Agency Is Creating Risk, Not Growth
• 5 Things You should do to Improve Risk Management at Work
• 10 Hottest Trends in Data and Analytics that Will Disrupt Your Business