They were only trying to help… Good intentions paving the road to non-compliance You don’t discover it during an audit. You discover it on a random Tuesday. An employee — smart, curious, trying to help — has built their own AI model using open‑source APIs. They trained it on internal documents. They deployed it somewhere you can’t see. And now nobody knows where your data lives, who has access, or what the model is doing. Shadow AI isn’t a rumor. It’s already inside your orga