The most expensive thing a small company can do about shadow AI is write the ban memo. It costs nothing to draft and it feels like control. What it buys is a staff survey in which nobody admits to using AI, which is the one result you cannot act on.
People did not adopt these tools to defy you. They adopted them because the work got faster, and a memo does not make the work slower again. Ban the tools and the work still needs to get done, so usage moves to personal phones and home laptops, where you can see none of it. You have traded a problem you could measure for one you cannot. After the ban your risk is unchanged and your visibility is gone.
The reflex is understandable, because the fear arrives pre-packaged. Advertisers pay $42.17 for one click on the search term shadow ai. That is the average cost per click in US Google Ads data, pulled through DataForSEO in October 2026, at about 3,600 searches a month. Set it beside small language models: roughly 2,900 searches a month at $1.64. The audiences are close in size and the price per visitor differs by a factor of about twenty-five. Nobody is frightened of small language models, so nobody is bidding for the people who search for them. Someone has decided that a person typing those two words is worth over forty dollars, and the likeliest bidders are vendors of security and detection software. (The measurement tells us the price, not who pays it.) The term is also climbing, from 2,400 searches a month in September 2025 to 3,600. If you run a small or mid-sized business, you are the target of a market that has noticed it can monetize anxiety.
That does not make the problem fake. It does mean you should read the statistics being used on you with some care. Shadow AI is the use of AI tools, models or browser extensions that never went through IT review, and the widely quoted numbers are striking. The 2026 CISO AI Risk Report, as summarized by Sennovate, found 75% of the 235 security leaders surveyed had identified shadow AI in their environment. Reco's 2025 State of Shadow AI Report, cited in the Cloud Security Alliance's 2026 whitepaper, says 91% of AI tools in enterprise environments operate outside IT control, averaging 269 shadow AI applications per 1,000 employees.
Notice who measured that. Reco sells SaaS and AI security software. Menlo Security, source of the 68% rise in shadow generative AI use and the finding that 57% of users entered sensitive data, sells browser security. Their numbers may be sound. They are also the numbers that help sell the product, and they describe enterprises, not a company with forty staff and one part-time IT person. A figure of 269 unsanctioned apps per 1,000 employees tells an SME almost nothing about its own exposure. The independent anchor is IBM's 2025 Cost of a Data Breach Report, which the CSA whitepaper cites: one in five organizations had a breach involving shadow AI, and those breaches cost $670,000 more on average. That is a large-company average too, but a breach is a breach, and the cost points at the real mechanism.
The mechanism is the paste, not the tool. Gartner analyst Andrew Walls put it plainly in comments quoted by Sennovate: "It's not the AI part of shadow AI that concerns them. It's the data that's being provided to an AI by the employee." A contract pasted into a public chatbot leaves your control. Whether it is retained, reviewed or used for training depends on terms nobody on your team read, and unlike an unapproved SaaS subscription you cannot recall it afterward. Your security tooling will not flag it either: a logged-in session on a legitimate AI site trips no alarm. A ban aimed at tools misses the thing that actually moves.
So skip the enterprise discovery platform, and ask your people. Tell them nobody will be disciplined for what they report, then ask which AI tools they use and for what. A page of honest answers beats a traffic-analysis project, because the answers include the reason, and the reason is the useful part.
Regulation is moving the same way. Frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework treat knowing what you run as the starting point, per the CSA analysis, and compliance commentary on the EU AI Act reads an inventory of deployed AI systems the same way. Which duties actually apply to your company under the AI Act (Regulation (EU) 2024/1689) or the GDPR is not something we assess here: take that to qualified counsel. If you serve EU clients, expect the question to arrive in a vendor questionnaire anyway. An inventory helps you either way.
Then sort by data, not by tool. Pasting a public marketing blurb into a chatbot is fine. Pasting customer records, contracts or payroll is not. Write down the short list of data that must never leave, and give people that rule instead of a list of banned apps.
The step most companies skip decides whether the rest works: provide something at least as good. If the approved option is slower than the free chatbot, people are back on the chatbot by Friday. The sanctioned tool has to be connected to the data people actually need, with access controls on it, and that is a systems job. An assistant wired into your Odoo or ERPNext data under the permissions staff already have will beat a browser tab, and it keeps the data where you can govern it. It is the kind of build our ERP services and AI services cover, and the decisions worth handing to it are sorted in AI in Odoo: where it improves decisions.
ThinqHub is an implementer and does not sell a shadow AI scanner, so we have no reason to want you frightened. We think the cheapest governance control a small company has is a good approved tool and an honest conversation, in that order, with detection a distant second. If you want help working out what your teams need and building it inside a governed system, our approach is where to start.
Sources:
- Sennovate, "Shadow AI in 2026," citing the 2026 CISO AI Risk Report (235 senior security leaders surveyed): sennovate.com/blog/shadow-ai-in-2026
- Cloud Security Alliance, "The Invisible Enterprise: Shadow AI and the Ungoverned Frontier," April 2026, citing Reco's 2025 State of Shadow AI Report, IBM's 2025 Cost of a Data Breach Report, and Menlo Security's 2025 enterprise analysis: labs.cloudsecurityalliance.org
- Search volume and cost per click: Google Ads data via DataForSEO, US, English, measured October 2026.
