Anoop Paudval, Gulf News' head of information security governance, risk and compliance, warned unapproved artificial intelligence (AI) tools can send companies' sensitive data to outside services without oversight.
In a Gulf News column last updated Nov. 4, Paudval described “shadow AI” as employees’ use of AI services without their organization’s oversight. Workers may use these tools to summarize documents, prepare reports, analyze information or write code. He said they may seek alternatives when approved systems are unavailable, hard to use or slow to obtain.
The issue echoes earlier concerns about “shadow IT,” software used inside a company without formal approval. Paudval argues that generative AI adds a way for routine work to send company material to outside services.
That can leave employers without a reliable picture of the tools in use or the data employees share through them. Uploads may include confidential records, customer details, intellectual property or business strategies. A company may not know where submitted information goes or whether a service retains it.
Paudval urged firms to map AI use across browsers, devices, networks and cloud services, then assess security, privacy, retention and third-party risks. He recommended clear rules for approved tools, accounts and data sharing, alongside business and technical owners responsible for decisions. Employee training and recurring reviews of tools and possible exposure would help companies keep oversight aligned with actual use.
He places responsibility beyond information technology. Executives should support responsible adoption and integration, while boards should require leaders to show how AI risks are understood and managed. Paudval also called for secure alternatives that employees can use easily, addressing one reason they may turn to outside tools.
EconoTimes has covered a related accountability concern: Sopra Steria Next identified shadow AI as a risk to traceability and cost control as AI systems take on more consequential decisions.
