Financial institutions that respond to shadow AI by blocking unapproved tools may be making their exposure worse, not better, according to John Denham of Napier AI.
In a recent analysis, Denham argues that restriction alone mistakes a demand problem for a technology problem, and in financial services that demand is here to stay.
Shadow AI, the use of unsanctioned AI tools by employees to get their work done, has become one of the more uncomfortable topics in information security. Napier AI points out that the sector is especially exposed because it combines relentless productivity pressure with tightly regulated data environments. Staff are turning to AI to accelerate reporting, compliance tasks, analysis and client communications, frequently moving faster than governance can keep up.
The scale is striking. Research cited by Napier AI found that more than 80% of workers, including nearly 90% of security professionals, use AI tools their employer has not sanctioned. Even the teams charged with enforcing controls are part of the trend.
Denham stresses that intent is usually good. Employees reach for public tools when secure, approved alternatives are missing or awkward to use. Yet the result can still be regulated or commercially sensitive data entering unmanaged systems. Given the strict audit, compliance and operational resilience duties financial firms carry, this becomes a regulatory risk rather than a mere IT nuisance.
Napier AI is clear that shadow AI is not simply shadow IT rebadged. Beyond unauthorised technology use, it introduces uncontrolled data exposure through prompts and outputs that may be wrong. Sensitive information can leave in a prompt, hallucinated or biased outputs can slip into decisions, and auditability suffers because there is no record of what was asked or returned. In regulated communications or customer-facing decisions, a hallucination quickly turns into a compliance, reputational and legal problem.
This is why blocking tends to fail. When restriction is the only response, Denham notes, staff find workarounds via personal devices or unapproved apps, removing visibility of the risk without removing the risk itself. Restriction without provision, in effect, turns a visible problem into a hidden one.
The firms handling this well, according to Napier AI, focus on enabling responsible adoption. That means providing secure enterprise tools, writing usage policies people can realistically follow, training staff on safe prompting and data handling, and defining clearly which data can be used with AI. It also means monitoring usage without fostering fear, keeping human oversight for high-risk decisions, and encouraging staff to flag mistakes early, since a risk surfaced quickly is far cheaper than one discovered during an audit.
Denham recommends extending existing security, compliance and operational risk frameworks rather than building AI governance as a separate discipline. The NIST AI Risk Management Framework, built around the continuous functions of govern, map, measure and manage, offers a strong anchor, while the Cyber Risk Institute has produced a financial services adaptation developed with more than 100 institutions.
Looking ahead, Napier AI warns that shadow AI will become harder to detect as AI is embedded into everyday software and autonomous agents emerge. The question will shift from which tools staff use to which decisions are being influenced, and whether firms can evidence them. With regulators increasingly focused on explainability and resilience, the winners will be those that balance innovation with visibility and control.
For more insights, read the full report here.
Copyright © 2026 FinTech Global
