Shadow AI and AI Use Maturity Model: Five Levels

Most organisations cannot say which AI tools their staff use, what data goes into them or whether anyone checks what comes back out. This model describes five levels of maturity, from Ad hoc to Optimised, for governing how employees use AI at work: chat assistants, AI features in everyday software, browser extensions, note-takers and coding helpers. It scores seven dimensions of AI use and acceptable-use behaviour, with indicators, self-assessment questions and the steps to move up a level. It is written for CISOs, data protection officers, AI governance leads, HR and the managers who own day-to-day AI use. It deliberately covers people and behaviour, not the security of the AI systems the organisation builds or the identities of autonomous agents; those are scored in the AI Security Maturity Model. It uses the same Ad hoc to Optimised scale as the NHI Mgmt Group NHI Governance Maturity Model.

Key takeaways

Shadow AI is a demand signal before it is a breach. The Microsoft and LinkedIn 2024 Work Trend Index found 78% of AI users bringing their own AI tools to work. Maturity starts with understanding why, not with blocking.
Policy without visibility stays at Level 2. IBM's Cost of a Data Breach Report 2025 found that only 34% of organisations with an AI governance policy audited regularly for unsanctioned AI.
Level 3 is the first real target: a sanctioned tool for common tasks, data rules staff can apply in seconds, role-based AI literacy, a fast request route and discovery that covers the main channels.
Coaching at the point of use beats annual training. A prompt that explains why pasting customer data is not allowed, and where to go instead, changes behaviour faster than a policy nobody reads.
Measure behaviour, not bans: share of AI use on sanctioned tools, time to approve a request, sensitive data events per thousand prompts and how many people disclose their own mistakes.

The five levels

Level	Name	Description
1	Ad hoc	Staff use whatever AI tools they find, on corporate and personal accounts. There is no AI-specific rule, or a one-line ban that nobody enforces. Nobody knows which tools hold company data. Problems surface through incidents or press stories.
2	Developing	An AI acceptable use policy exists, often reactive after an incident. A list of approved and banned tools is published but rarely updated. Some web filtering blocks well-known AI sites. Awareness is a single module. Approval requests go to a general IT queue and can take months, so people work around them.
3	Defined	At least one sanctioned AI assistant with enterprise terms covers the common use cases. Data rules map the organisation's classification scheme to what may go into which tool. Discovery covers network, browser and SaaS channels. Role-based AI literacy is delivered and recorded. A request route returns a decision within a set number of days. Customer-facing and decision-making outputs need human review.
4	Managed	Controls act at the point of use: staff are coached or blocked in real time when sensitive data heads to an unsanctioned tool. Usage, request and coaching data are reported to leadership each quarter. Approved tools are reviewed at onboarding and renewal, including AI features switched on inside existing SaaS. Managers own AI use in their teams.
5	Optimised	Shadow AI is rare because sanctioned tools are good and approval is fast. Usage data drives which tools are bought and retired. Staff report their own mistakes without fear, and those reports improve controls. Rules adapt within weeks as new AI capabilities appear, and the programme's effect is measured over time.

The seven dimensions

Score each dimension separately. Organisations are rarely at one level across the board; a strong policy with no discovery is a common Level 2 to 3 split.

Dimension	Level 2 indicator	Level 3 indicator	Level 4 to 5 indicator
1. Visibility of AI use	Blocked-site logs and occasional reports from staff	Discovery across network, browser and SaaS consent logs, with a register of AI tools in use	Continuous discovery including AI features inside sanctioned SaaS; register reconciled monthly
2. Acceptable use and data rules	Policy text with examples of banned behaviour	Data rules mapped to classification levels and tools; short "can I paste this?" guidance	Rules embedded in tools and prompts; reviewed when new capabilities arrive
3. Sanctioned alternatives and approval	Approved list; requests via general IT queue	Enterprise AI assistant for common tasks; AI-specific intake with a published decision time	Usage data drives the catalogue; most requests decided within days
4. AI literacy and coaching	One awareness module	Role-based literacy (general staff, managers, developers, high-risk roles) with records	Just-in-time coaching at the point of use; content updated from real events
5. Point-of-use data protection	Category blocking of AI sites	Data loss prevention rules for AI destinations on managed devices, in monitor then enforce	Inline coach, redact or block by data class and tool, across browser and endpoint
6. Output review and accountability	"Users are responsible" statement	Human review required for customer-facing, legal, HR and financial outputs; disclosure rules for AI-generated content	Review proportionate to risk tier; errors traced and fed back to guidance
7. Culture, disclosure and enforcement	Disciplinary threat for misuse	No-blame route to report mistakes; consistent, proportionate enforcement	Self-reports exceed detected events; leaders model sanctioned use

Why these dimensions

The dimensions follow how AI use actually goes wrong. OWASP lists Sensitive Information Disclosure as LLM02 in its 2025 Top 10 for LLM Applications, covering personal data, confidential business data, credentials and source code entering or leaving a model. In 2023 Samsung staff pasted source code and meeting notes into a public chatbot within weeks of being allowed to use it, and the company first capped prompt size, then temporarily restricted generative AI on company devices; see the Samsung ChatGPT source code leak. The lesson is that permission without data rules, literacy and a sanctioned alternative produces exactly the behaviour a later ban tries to undo. The Work Trend Index also found that 52% of AI users were reluctant to admit using it for their most important tasks, which is why culture and disclosure is a dimension of its own.

Regulation that sets a floor

EU AI Act Article 4, AI literacy: applies from 2 February 2025 to providers and deployers of AI systems, including organisations whose staff use general-purpose assistants. The AI Omnibus, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, reworded the duty to taking measures to support the development of AI literacy, without guaranteeing a specific level for any individual. The European Commission's AI literacy questions and answers say no certificate is required, an internal record of training and initiatives is sufficient, and staff using a chatbot for tasks such as writing advertising text should be told about risks such as hallucination. Confirm the current text and national supervision arrangements. See the EU AI Act AI Literacy Obligations (Article 4) Guide.
Data protection law: personal data entered into an AI tool is processing under GDPR and UK GDPR. The ICO publishes guidance on AI and data protection and an AI and data protection risk toolkit. A sanctioned tool needs a lawful basis, a processor contract and, where risk is high, a data protection impact assessment.
Government frameworks as models: the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) and its Generative AI Profile, NIST AI 600-1 of July 2024, and the UK Government's AI Playbook of February 2025 with its ten principles for civil servants both treat staff use as something to govern, not only to restrict. See the NIST AI RMF Guide.

Self-assessment questions

Answer yes only with evidence: a register export, a policy version, a training record, a dashboard. Two or more "no" answers in a dimension place you below the level named.

Visibility (Level 3)

Can you list the ten most used AI tools in the last 30 days, with user counts, from your own telemetry?
Do you see AI features switched on inside sanctioned SaaS, not just standalone AI sites?
Do you review OAuth consent grants to AI apps on a schedule?

Acceptable use and data rules (Level 3)

Can an employee tell in under a minute whether a given document may go into a given tool?
Do the rules use your existing classification labels rather than new AI-specific categories?
Was the policy reviewed in the last six months?

Sanctioned alternatives (Level 3)

Does a sanctioned tool cover drafting, summarising, translation and coding help?
Is there a published target time for deciding an AI tool request, and do you meet it?

Literacy and coaching (Level 3 to 4)

Do developers, managers and staff handling personal data receive different AI literacy content?
Do you keep records of AI literacy measures that would satisfy an Article 4 enquiry?
Do staff receive guidance at the moment they attempt a risky action?

Point-of-use protection (Level 4)

Are data loss prevention rules for AI destinations in enforce mode for your most sensitive data classes?
Do controls cover managed browsers and endpoints, not only the corporate network?

Output review and culture (Level 3 to 5)

Is human review mandatory for AI-generated content sent to customers or used in decisions about people?
Have any staff reported their own AI mistake in the last quarter, and was the response proportionate?

Scoring and evidence

Dimension	Evidence that proves Level 3	Common false evidence
Visibility	AI tool register with source telemetry and owners	A list of tools staff say they use
Acceptable use	Policy mapped to classification, with acknowledgement records	A policy on the intranet with no version history
Sanctioned alternatives	Licence counts, active users and request decision times	An approved list nobody updated this year
Literacy	Role-based completion records and content dates	A generic module completion rate
Point-of-use protection	DLP policy export and event trend for AI destinations	Category blocking that personal devices bypass
Output review	Review steps in workflows for high-risk outputs	A disclaimer in the policy
Culture	Self-reported incidents and their handling	Zero reported incidents

Where identity fits

AI use stops being purely behavioural once a tool connects to company systems. An AI note-taker granted calendar and mailbox access, a browser extension reading every page or a coding assistant given a personal access token becomes a non-human identity with standing access. At Level 3 the visibility dimension should include OAuth grants and API keys issued to AI tools; from Level 4 those grants are reviewed and revoked like any other third-party access. Detailed agent and token controls sit outside this model: see the Unsanctioned AI Agents and MCP Servers Guide and Unsanctioned AI Coding Assistants.

Moving up a level

From 1 to 2, write it down: publish a short AI acceptable use policy with concrete examples, a list of approved and prohibited tools, and a contact for questions. Start from the AI Acceptable Use Policy Template. Run discovery in monitor-only mode to establish a baseline before enforcing anything.
From 2 to 3, give people a better option: procure a sanctioned assistant for the most common use cases found in discovery; map data rules to classification; launch an AI intake route with a decision target (see the AI Use Case Intake Form Template); deliver role-based literacy and keep records.
From 3 to 4, act at the point of use: pilot coaching prompts and DLP rules for AI destinations with one department in monitor mode, review false positives, then enforce for the highest data classes. Roll back by returning a rule to monitor mode if it blocks legitimate work. Add supplier AI reviews to procurement and renewals. See the Generative AI Data Loss Prevention Guide.
From 4 to 5, close the loop: use usage and request data to retire unused tools and add demanded ones; publish a no-blame self-reporting route; review rules quarterly against new capabilities; measure trend, not snapshots.

Small organisations can reach Level 3 with one sanctioned assistant, a one-page policy, browser-based discovery and a short literacy session. Large organisations need business-unit owners, multiple discovery channels and tiered approval by risk. See Block vs Sanction vs Coach for choosing a stance per tool and data class, and Network vs Browser vs Endpoint Shadow AI Discovery for discovery options.

Metrics that show maturity

Metric	What it shows	Level 3 expectation	Level 5 expectation
Share of AI activity on sanctioned tools (%)	Whether sanctioned options meet demand	Majority of use	Shadow use is rare and explained
Median time to decide an AI tool request	Whether approval drives people around controls	Within published target	Days, not weeks
Sensitive data events per 1,000 AI interactions	Risky behaviour at the point of use	Measured and trended	Falling, with fewer blocks and more coaching
Role-based AI literacy coverage (%)	Reach of literacy measures	Recorded for all staff in scope	Refreshed as tools change
Self-reported AI mistakes versus detected events	Trust and culture	Self-reporting route exists and is used	Self-reports exceed detections

Avoid metrics that reward hiding use, such as counting blocked attempts as success. A falling block count can mean people moved to personal devices. See AI Governance Metrics.

Framework mapping

Dimension	NIST CSF 2.0	NIST SP 800-53 Rev. 5	Other
Visibility	ID.AM-02	CM-11 User-installed Software, AC-20 Use of External Systems	ATT&CK T1567 Exfiltration Over Web Service; ATLAS AML.T0136 Exfiltration via AI User Interface
Acceptable use and data rules	GV.PO-01	PL-4 Rules of Behavior, PL-4(1) Social Media and External Site/Application Usage Restrictions	ISO/IEC 27001:2022 A.5.10
Sanctioned alternatives	ID.AM-02	CM-10 Software Usage Restrictions	NIST AI RMF Govern
Literacy and coaching	PR.AT-01	AT-2 Literacy Training and Awareness	EU AI Act Article 4; ISO/IEC 27001:2022 A.6.3
Point-of-use protection	PR.DS-01	AC-20	OWASP LLM02:2025 Sensitive Information Disclosure
Culture and enforcement	GV.RR-04	PL-4	UK AI Playbook principles

Common failure patterns

Ban first, think later: blocking public AI without a sanctioned alternative pushes use onto personal devices, where there is no visibility at all.
Approval as a dead end: AI requests that wait months in a general queue teach staff that asking is pointless.
Forgetting embedded AI: governing standalone chatbots while suppliers switch on AI features inside sanctioned SaaS.
Literacy as a checkbox: one generic module with no role content and no record, which helps neither behaviour nor Article 4 evidence.
Punishing disclosure: disciplining the first person who reports a mistake guarantees nobody reports the next one.

Practitioner checklist

Run AI discovery across network, browser and SaaS consent logs and keep a register with owners.
Publish an AI acceptable use policy that maps data classes to approved tools, with examples.
Provide at least one sanctioned AI assistant under enterprise terms for common tasks.
Set and publish a decision time for AI tool requests, and report against it.
Deliver role-based AI literacy and keep records of the measures taken.
Pilot point-of-use coaching and DLP for AI destinations in monitor mode before enforcing.
Require human review for AI outputs sent to customers or used in decisions about people.
Offer a no-blame route for staff to report AI mistakes, and track self-reports.
Review AI features in existing SaaS at every renewal.

Shadow AI & AI Use Maturity Model: Five Levels for Governing How Staff Use AI