Notifications
Clear all
Topic starter
20/08/2026 5:44 pm
TL;DR: Shadow AI is already influencing production code, with 35% of AI tool usage in development happening through personal, ungoverned accounts and 52% of ChatGPT usage occurring via personal accounts, according to Sonar. The governance problem is no longer tool adoption alone but enforcing consistent controls at the code level, because bring your own AI usage can bypass corporate oversight and leave security teams blind to provenance and risk.
NHIMG editorial — based on content published by Sonar: the State of Code Developer Survey findings on shadow AI and AI tool usage
By the numbers:
- 35% of AI tool usage in development happens through personal, ungoverned accounts rather than work-sanctioned channels.
- 52% of ChatGPT usage occurs via personal accounts.
Questions worth separating out
Q: How should security teams govern AI-assisted code when developers use personal accounts?
A: They should govern the output, not just the tool access.
Q: Why does BYOAI create a governance problem for engineering leaders?
A: BYOAI fragments control because developers can choose different tools, accounts, and contexts that sit outside central oversight.
Q: What breaks when AI code generation is controlled only through sanctioned tools?
A: The main failure is that sanctioned access does not guarantee sanctioned behaviour.
Practitioner guidance
- Inventory AI tool usage by workflow Map which AI tools are used in IDEs, browsers, documentation, refactoring, and code review, then distinguish sanctioned from personal-account usage so policy matches actual behaviour.
- Enforce code-level assurance in CI/CD Add automated checks for security, quality, and provenance on every commit and merge, so AI-generated code is governed before release regardless of the source account.
- Tighten account provenance controls Require corporate identities for approved AI services where possible and log the account context used for code generation to preserve auditability and incident response evidence.
What's in the full report
Sonar's full report covers the operational detail this post intentionally leaves for the source:
- The complete chapter data on developer AI tool preferences across GitHub Copilot, ChatGPT, Claude, Gemini, Cursor, and other assistants.
- The survey breakdown showing how personal-account usage varies by tool, team size, and developer seniority.
- The report’s discussion of how AI adoption affects technical debt, agentic workflows, and code verification bottlenecks.
- Chapter-level findings that help engineering leaders compare sanctioned deployment patterns with BYOAI behaviour.
👉 Read Sonar's full report on shadow AI and developer tool usage →
Shadow AI in developer workflows: what IAM and security teams miss?
Explore further
20/08/2026 6:27 pm
Shadow AI is becoming a governance problem before it becomes a tooling problem. The article shows that developers are not waiting for central approval to use AI in daily work, and that means governance based only on sanctioned tools will miss a large share of real usage. The decisive issue is not whether the organisation approved the platform, but whether it can govern the code and context produced through unmanaged accounts. Practitioners should treat shadow AI as a provenance and accountability gap, not a procurement gap.
A question worth separating out:
Q: How can organisations reduce shadow AI risk without blocking adoption?
A: Start by discovering every AI tool and enriching it with owner, data access, and integration details. Then approve, restrict, or retire assets based on exposure rather than assumptions. This lets teams keep useful AI in production while removing the unmanaged paths that create avoidable risk.
👉 Read our full editorial: Shadow AI is reshaping code governance in development teams
