Shining a Light on Shadow AI - Responsible Data Protection When AI is Everywhere

As someone who has had the honor of delivering keynotes at both Oracle and SQL Saturday data events, I’ve spent time with professionals on both sides of the database world.  I’ve held the title of database administrator, developer, engineer and architect for structured, transactional giants and the analytics-heavy ecosystems of eight different database platforms, (not counting Cloud platforms).  My keynotes have often been focused on a topic that unites us all today: the urgent need to address the threat of Shadow AI.

Shadow AI refers to the unauthorized or unmonitored use of artificial intelligence tools - particularly public, cloud-based generative AI.  This risk is often unintentional by employees or teams and as expected, without official IT oversight. It’s the new Shadow IT, but far more dangerous. In my keynotes on data protection and ethics in the AI era, I’ve emphasized that the biggest security gap in AI today isn’t the models - it’s the humans using them.

Recent research by Harmonic AI discovered that sensitive personal information (PII), including names, emails, and even health data, was estimated between 8% in 4^th quarter of 2024 and upwards of 16% by 1^st quarter of 2025 just in the free version of ChatGPT.  This unintentionally exposes organizations and customers to potential misuse or unintended storage in AI model training data. Add to that authentication keys, source code, internal documents, and employee records being submitted for "help" or "summarization" and you’ve got a ticking compliance time bomb.

Database professionals know what’s at stake. We've spent decades architecting systems to protect PII, meet HIPAA, PCI-DSS, and GDPR requirements, and now a single unauthorized API call to a free AI tool can bypass all that governance built into our relational systems.

Shadow AI poses a unique and unprecedented risk:

• It operates outside corporate audit trails.
• It often runs on systems that have no SLA, no enterprise support, and no logging.
• And it’s being fed the exact kind of sensitive data we’ve spent years safeguarding.

This isn’t a philosophical problem, it’s a very real and growing liability. The answer isn’t to stop AI innovation. It’s to approach it responsibly, with clear policies, well-communicated training programs, and the use of enterprise-grade AI tools that are approved, governed, and monitored.

Organizations must:

• Define what AI tools are authorized.
• Train employees on how and when to use them safely.
• Block or sandbox access to public AI tools whenever data classification policies are violated.
• Ensure enterprise tools are configured to comply with data governance and retention requirements.

The future of AI is powerful, but it must also be ethical, secure, and compliant. If you have access to critical data, the threat of Shadow AI is real, and our collective responsibility is to ensure we don't trade innovation for risk. Let’s start to talk about the risk of Shadow AI and build data-driven organizations with policies and protections in place to ensure it doesn’t bypass everything we’ve all worked so hard to secure at the database level.

DBAKevlar Out

Kellyn Gorman

Join the debate, and respond to the editorial on the forums

AI initially seemed amazing with its many capabilities

In more than 10 years of experience...

Rob Farley praises the textual nature of SQL Agent.

Happy T-SQL Tuesday! This month, Andy Levy 

I’m hosting T-SQL Tuesday this month

Most of the time, we use wait stats to identify SQL

Too many IT teams run index rebuild jobs on autopilot. Every night. Every index. No questions asked. Here’s the truth: if you’re doing this daily on indexes smaller

David Wiseman shows off an open-source product: For T-SQL Tuesday #186, Andy Levy asks, “How do you manage and/or monitor your SQL Server Agent jobs?” 

Is OUTPUT Broken In SQL Server? Going Further If this is the kind of SQL Server stuff you love learning about, you’ll love my training. I’m offering a 75%

In the fast-paced world of business, fast, effective

In my last post I described issues that might stop...

DevOps Devour Hour – New York City Lunch & Learn – May 23, 2025 Going Further If this is the kind of SQL Server stuff you love learning about.

We’re delighted to share the Pre-Con schedule for Monday, November 17 and Tuesday, November 18, 2025. Take a look at the line-up of industry experts here!

Early bird rates for sponsor packages at the 2025 PASS Data Community Summit end May 22. Join us Nov 17-21 at the Seattle Convention Center. Sign up early for lower pricing, prime booth locations, coveted speaking times, extended branding, and more. Packages start at $9,000.

A self-service analytics tool should allow non-technical

In this blog post I am going to explain how to use a Python Notebook with Semantic Link Labs

Jeffry Schwartz looks for exceptions

Kinesh SatiyaIntroductionIn a digital advertising with Robust Ads Event Processing Pipeline

Adron Hall takes us through a branching strategy: ...

Stephen Planck adds one more layer of complexity

Gilbert Quevauvilliers does a bit of writing: In this blog post I am going to explain how to use a Python Notebook using the Semantic model

Trevor Olson announces a feature has become GA

Direct Lake + Import composite mode explained

Nicky van Vroenhoven explains that TANSTAAFL

Nikola Ilic performs a comparison

Fabric Data Factory Pipeline Execution from Azure Data Factory

Marco Russo has a guide: When I presented “Choosing Between Import Mode, Direct Lake, and Composite Models” at Fabric Conf 2025 in Las Vegas, the room overflowed.

After publishing my last post on Oracle Wait Class, let's talk about a specific wait event!

Lukas Vileikis explains how hash indexes work in MySQL

Welcome back to our journey of understanding MySQL...

SQL Server Performance Office Hours Episode 11

A SQL Server Query Plan Answer Going Further 

If you're a data analyst juggling varied datasets

Haripriya Naidu is trying to slam a lot of transactions through the same door: When operations wait to acquire a latch on a page

PostgreSQL 18 beta has been released!

Umair Shahid takes us into partitioning strategies.

This week saw the routine quarterly round of PostgreSQL

Physical streaming replication in PostgreSQL

Learning something new has elements of bliss

Umair Shahid pushes the contents of the write-ahead log to another machine: Physical streaming replication in PostgreSQL allows you to maintain a live copy

Making AI available for everyone

Employers are increasingly favoring skill-validated certifications

Patrick Gruenauer elevates our access