What it is
Shadow AI refers to employees adopting consumer chatbots, browser extensions, or unmanaged agents to handle company data without security review. It parallels 'shadow IT' but focused on generative AI usage.
Why it matters
When reps paste Salesforce customer data into a public chatbot to draft an email, that data leaves your CRM's compliance boundary with no audit trail. For mid-market teams handling regulated data or sensitive deal terms, this creates real breach and compliance exposure long before anyone touches an official AI rollout. It also fragments customer experience, since untracked tools produce inconsistent answers no one can trace back or improve.
Key components
- Unsanctioned tool usage
- Data leakage risk
- Policy/audit gap
How it connects
Agentforce and its governance and trust layer aim to bring AI usage into a sanctioned, auditable environment instead of shadow tools.
Good to know
Start with an AI usage audit and an approved-tools list before writing policy—enforcement without alternatives just pushes usage further underground.
Related terms
Agent Governance
The policies, controls, and monitoring systems that ensure AI agents operate safely, compliantly, and within business-approved boundaries.
AI Readiness Assessment
A structured evaluation of whether your Salesforce org, data, processes, and team are prepared to deploy AI agents successfully.
Guardrails
The boundaries you set on AI agents to control what they can discuss, what actions they can take, and when they must escalate to a human.
Trust Layer
Salesforce's AI trust and safety framework that ensures agents operate within compliance boundaries, prevent misuse, and maintain data security.
