John Freerksen
Artificial intelligence is quickly becoming part of everyday business. Employees are using AI to draft emails, summarize documents, analyze information, conduct research, and automate repetitive tasks. While these capabilities can improve productivity, they also introduce a growing concern for financial institutions: Shadow AI.
For community banks and credit unions, addressing Shadow AI in banking is increasingly important as regulators establish clearer expectations for identifying, assessing, and governing AI use.
What Is Shadow AI?
Shadow AI is the use of artificial intelligence systems, applications, or services for business purposes without appropriate authorization, security review, risk assessment, or governance oversight.
Similar to "Shadow IT," Shadow AI often occurs when employees adopt technology faster than their organization can evaluate and approve it. An employee might upload a document to a public AI application for summarization, use an AI assistant to analyze a spreadsheet, or enter information into a generative AI chatbot to help write a report.
Employees using unauthorized AI tools are usually not trying to bypass security. They are often looking for faster and easier ways to perform their jobs. When an organization does not provide approved AI capabilities or simply tells employees not to use AI employees may seek readily available alternatives.
The result is that sensitive business or customer information could be processed by AI systems the institution has never evaluated.
Why Shadow AI Creates Risk for Banks and Credit Unions
The fundamental problem with Shadow AI is visibility. An organization cannot effectively manage the risks of an AI system it does not know is being used.
One of the greatest concerns is data leakage. Employees could inadvertently enter customer information, NPI, PII, internal financial information, confidential reports, security information, policies, contracts, or other sensitive information into an unauthorized AI service.
Shadow AI can also bypass the bank's established third-party risk management processes. The AI provider may never have undergone vendor due diligence, security review, or contract evaluation. The institution may not know how information is retained, whether it is used for model training, which third parties have access to it, or how it can be deleted.
Other risks include inaccurate or fabricated AI output, intellectual property concerns, inadequate record retention, privacy violations, regulatory compliance issues, and inappropriate reliance on AI-generated recommendations.
For Shadow AI in community banks and credit unions, these concerns can be particularly challenging because smaller institutions may have limited technology and compliance resources available to continuously identify new AI applications.
How Can Banks Prevent Shadow AI?
Preventing Shadow AI should not rely solely on blocking AI applications. One of the most effective strategies may be to provide employees with risk-assessed and approved enterprise AI solutions that meet legitimate business needs while operating within the institution's governance framework.
Depending on the technology and its configuration, enterprise AI solutions can provide greater control over authentication, access, logging, retention, data handling, administrative oversight, and the use of organizational information for model training.
Providing approved AI also gives the institution an opportunity to establish clear expectations. Employees should understand which AI systems are approved, what information can and cannot be entered into them, when AI-generated information requires human validation, and which AI use cases require additional approval.
Banks should consider several fundamental controls for preventing Shadow AI:
- Establish an AI governance and acceptable-use policy.
- Maintain an inventory of approved AI systems and AI-enabled applications.
- Provide approved enterprise AI tools where appropriate.
- Establish a formal process for evaluating and approving new AI use cases.
- Use security controls such as web filtering and data loss prevention to identify unauthorized AI activity where appropriate.
- Train employees on AI risks and acceptable use.
- Periodically reassess AI usage as applications and capabilities change.
The objective is not necessarily to eliminate AI. Instead, banks should move AI use from the shadows into a visible, controlled, and risk-managed environment.
Shadow AI and the CSBS AI Supervisory Framework
Understanding AI use has become even more important following the September 2026 release of the Conference of State Bank Supervisors (CSBS) Artificial Intelligence Supervisory Framework.
The framework provides state financial regulators with a risk-based resource for evaluating AI use at financial institutions. It includes a Core Examiner Guide, Examiner Work Program, and AI Use Case Risk Tiering Worksheet. CSBS states that the framework can also be used by financial institutions to assess their own AI programs, strengthen AI governance and risk management, and prepare for examinations.
Importantly, the framework is discretionary. Individual state regulatory agencies determine how extensively it will be incorporated into their supervisory processes. However, the framework provides valuable insight into the areas institutions should be prepared to address.
Among the areas identified by CSBS are governance and oversight, AI inventories and use cases, and generative AI and emerging uses.
This makes Shadow AI directly relevant to examination preparedness. A bank cannot maintain an accurate AI inventory if employees are using AI outside approved channels. Likewise, management may have difficulty demonstrating effective governance if it lacks reasonable processes for identifying and addressing unauthorized AI tools.
Community banks should therefore be prepared to answer questions such as: Where is AI being used? Who approves AI use cases? How are those use cases risk assessed? How does the institution govern generative AI? How does it identify unauthorized AI use? And can management demonstrate that these controls are operating effectively?
Don't Just Block AI—Govern It
AI adoption is already occurring throughout the financial industry. The question is increasingly not whether employees will use AI, but whether the institution can provide the governance, visibility, and controls necessary for them to use it safely.
Providing employees with appropriately secured enterprise AI solutions can be an important part of that strategy. When employees have useful approved tools and understand the institution's expectations, they have less reason to turn to unauthorized alternatives.
At the same time, management gains greater visibility into AI use and a stronger foundation for demonstrating effective governance to regulators.
The goal should be simple: make the approved path the easiest path.
Build an AI Governance Program Before AI Moves into the Shadows
Financial institutions need a practical approach that allows them to benefit from AI while protecting customer information and managing regulatory, operational, security, and third-party risks.
Bedel Security's AI Risk Management and Oversight Program can help banks and credit unions identify AI use, address Shadow AI, develop appropriate policies, evaluate AI risks, establish governance and oversight processes, and prepare for evolving regulatory expectations.
Don't let AI operate in the shadows. Engage Bedel Security to learn how our AI Risk Management and Oversight Program can help your financial institution govern AI safely while enabling employees to take advantage of AI's benefits.