How Many AI Agents Are Running in Your Company?

A Monday morning question from a finance manager:

“Yesterday, I pasted fake interview data into Claude to evaluate a student candidate. The same day, a system admin ran database optimization queries in a ChatGPT tab. Our e-commerce team set up a tool to auto-generate product descriptions — they thought it was one-off, but it’s been running for three months. How many AI tools are actually in use at this company? Nobody knows.”

This question has become standard in most corporate environments.

What Is Shadow AI?

Artificial intelligence usage without documented policy, unclear ownership, and no record in organizational systems. These include:

• Individual browser tabs running ChatGPT, Claude, Gemini. Every employee, every day, asking questions through personal accounts.
• A hastily written script or small automation. One person writes it, others start using it, the entire workflow stays vague.
• Webhooks or bots on internal platforms. A Slack channel knows “there’s a bot that does this,” but no specification exists, no backup, owner unclear.
• Third-party SaaS AI tools. Who pays? Where does the data go? Answers are murky.

Their common trait: they are in use, but undefined.

The Accounting Problem

Three major issues with shadow AI:

Data Risk

An employee pastes customer data into ChatGPT. The shift ends, the data stays in the cloud. If this data is personal or corporate confidential, the company carries a breach risk — but nobody knows, nobody is accountable.

Absence of Responsibility

When the e-commerce team auto-generates product descriptions, those descriptions sell to customers. If a description is wrong, the customer returns. Whose fault is it? The system’s, the AI’s, the manager’s? Without defined responsibility, this remains unclear.

Loss of Internal Control

If nobody checks a three-month-old automation, is it still correct? Is it slow? Is it producing errors that have gone unnoticed for weeks? These questions have no answers.

Scale Difference

A “one-off” script is now used by 10 people. A “test” bot has saved the company 200 hours, but there is no budget to manage it. A “personal account” AI front-end is now making real business decisions.

Shadow AI’s scale differs vastly. According to McKinsey’s 2024 report, in major enterprises, undocumented AI use is 3x larger than documented corporate AI. The AI the organization knows about is smaller than the AI it does not.

Starting Point

A simple step to begin this Sunday: ask across the organization what AI tools and automation have been used in the last three months.

• Who uses what, why?
• Which ones are used once, which ones continuously?
• Which ones produce outputs that decide for the company, which ones decide outside the company?

This question’s answer will map the scope of shadow AI. From there, distinguishing between the defined and the undefined, establishing controls, assigning responsibility — these are the next steps.