Shadow AI and compliance drift: what IAM teams need to know

TL;DR: Shadow AI use outside approved workflows is creating visible compliance and data-loss risk, with Cisco reporting that 74% of organisations have already experienced data leakage through unsanctioned AI use. The core issue is that consumer AI adoption bypasses identity, logging, and third-party controls that SOC 2 and HIPAA assume are in place.

NHIMG editorial — based on content published by Pomerium: How Shadow AI Impacts SOC 2 and HIPAA, and What to Do About It

Questions worth separating out

Q: How should security teams govern shadow AI use in regulated environments?

A: They should treat shadow AI as an identity and policy enforcement problem.

Q: Why does shadow AI create compliance risk for SOC 2 and HIPAA?

A: Because both frameworks assume that access, data handling, and third-party use are controlled and observable.

Q: What do organisations get wrong about managing unsanctioned AI use?

A: They often focus on banning tools instead of governing the request path.

Practitioner guidance

• Map approved AI use paths Identify every sanctioned AI service, then bind each one to enterprise identity, device trust, and policy enforcement before data can be entered or uploaded.
• Block consumer AI pathways for regulated data Prevent uploads, copy-paste workflows, and browser access to unsanctioned AI services from systems that handle PHI or audit-scoped data.
• Require audit-ready logs for AI activity Log who accessed which service, when the access occurred, what data was transferred, and which policy decision allowed or denied the request.

What's in the full article

Pomerium's full blog post covers the operational detail this post intentionally leaves for the source:

• Per-route policy examples for allowing approved AI services while blocking uploads and attachment flows.
• Structured logging details that show who accessed which AI service, when access occurred, and what policy applied.
• HIPAA-oriented route patterns for clinical staff, managed devices, and time-bound access rules.
• Example SIEM integration patterns for continuous monitoring and alerting on AI activity.

👉 Read Pomerium's analysis of shadow AI risks for SOC 2 and HIPAA →

Shadow AI and compliance drift: what IAM teams need to know?

Explore further

View Full Forum →  |  NHI Foundation Course →