Shadow AI = AI used in business outside official IT/security framework.
Risks: data leaks to OpenAI/Anthropic/Google, GDPR non-compliance, IP loss, AI Act fines up to €35M.
Solution: don't ban (impossible) but frame: deploy Enterprise versions + DLP + training.