November 13, 2026 · AI Governance
Shadow AI: Why It Breaks Before Your AI Code Does
The fear around AI inside a FinTech is usually the code. Someone ships a feature built with a code assistant, and every reviewer asks what vulnerabilities the model may have introduced. It is a real question. In a well-run shop, AI-generated code gets more scrutiny than human code, not less: it goes through review, scanning, and testing like everything else.
The failure almost never starts there. It starts with an untracked tool, adopted by an ordinary employee, holding ordinary data. By the time anyone asks about the code, the shadow tools have already been touching customer PII for months. That is the order of operations nobody plans for: the thing you watched does not break first. The thing nobody was watching does.
The code is reviewed. The spreadsheet is not.
Think about the asymmetry. Your development pipeline has pull-request review, dependency scanning, and static analysis. Meanwhile an analyst pastes a customer list into a chatbot to save an hour. A desktop app transcribes every meeting, including the one where account balances were discussed. A "smart reply" feature inside the ticketing system quietly reads every support message. None of those went through a review. All of them touch live data.
This is why the question "do you use AI?" is the wrong one. Every company uses AI. The question that finds the problem is "which tools touch which data, and who decided that?" In most companies, nobody owns the answer.
Three ways shadow AI actually breaks
Data walks out through ordinary use
Not exfiltration. Not a breach. Ordinary workflow: a spreadsheet pasted into a free chatbot, a contract uploaded to a summarizer, a code snippet shared with an assistant to debug faster. Each one is small. Together, they describe your most sensitive data flowing into systems you have no visibility into, with retention rules you have never seen.
The approved vendor ships AI into the approved tool
The sneakiest category is the AI you technically said yes to. Vendors add AI features inside products you already approved and switch them on by default. Nobody made a decision; a feature flag flipped. In discovery work, embedded features inside approved SaaS routinely account for the biggest surprise, because the tool appears on every allowlist while its new AI behavior appears on none.
Agents and MCP servers get real access
The newest wave is tools that do not just answer questions but act: coding assistants with repository access, browser agents that fill forms, and MCP servers connecting AI to internal systems. These carry real credentials and real permissions. An untracked one is not a data-leak risk only; it is an unmonitored identity inside your environment, and it deserves the same scrutiny as any service account.
The day it surfaces, it surfaces on someone else's schedule
Shadow AI stays invisible until a trigger you do not control. A bank partner's questionnaire asks how AI use is governed and wants evidence. An examiner asks for the written policy and the inventory behind it. A vendor changes a model and changes your output quality with it. A customer asks, in writing, whether their data was used to train anything. When any of these land, the difference between a good week and a painful one is an artifact: what is in use, what is approved, what changed this quarter.
Regulators are formalizing this pressure. Texas's AI law has been in effect since the start of 2026 with an attorney-general complaint portal collecting tips, and the EU's rules now arrive in stages over the next two years. None of it requires perfection. All of it requires being able to show what you run and what you decided.
The sequence that prevents the break
The fix is not a ban, and it is not a six-month framework project. It is a short sequence, run in order:
Start with a one-page acceptable-use rule so there is a policy on day one. Run the discovery passes to inventory every tool in use: surveys, expense records, network and SSO review, then a reconciliation that assigns each finding an owner and a data tier. Let the findings shape the full policy, the approved-tools list, and the monitoring. Review new tool requests through a front door that is faster than the side door, or people will route around it.
We run this sequence end to end on our AI governance program, and the inventory method behind it is documented in detail in our inventory roadmap article.
Where to start this week
Ask one question in your next staff meeting: what AI tools are you using for work? Ask it as a fact-finding mission, not an enforcement action, or you will get nothing and learn less. The answers, plus an afternoon with your expense reports, will give you a rough inventory before any technology is involved.
From there, the choice is whether to build the program deliberately or wait for a bank partner or examiner to ask for it. The second option is still common. It is also the reason "we didn't know" shows up in incident reports. The full program, including the three-step approach and what examiners ask about AI, is on our AI governance page.