Author: Shikha Pilley

A data analyst at a mid-size logistics company spent forty minutes on a Tuesday afternoon reconstructing a churn number from scratch. Not because the number didn’t exist anywhere. Because someone in sales had already pulled a number from a public chatbot, brought it into a leadership meeting that morning, and now the analyst had to prove it right or wrong before anyone would trust either version.

The number turned out to be close, but built on a customer segment definition that didn’t match what finance used. Nobody in that meeting knew that. They just knew there were now two churn numbers in the building, and someone had to lose the argument about which one was real.

This is the actual cost of shadow AI, and it rarely shows up in the way risk conversations describe it.

The tax isn’t where most people are looking

Most discussion of ungoverned AI use frames it as a security problem: sensitive data pasted into a public chatbot, sitting somewhere outside the company’s control. That risk is real. It is also not where the recurring cost lives.

The recurring cost lives downstream, on the data team, every time an ungoverned answer reenters the business as if it were a governed one. Someone asked a chatbot a question, got a plausible number, and used it. The data team didn’t produce that number and usually doesn’t find out it exists until it conflicts with something they did produce. At that point, the work isn’t optional. Someone has to figure out where the number came from, what it means, and why it doesn’t match, before the disagreement can even be resolved, let alone closed.

That work is a tax. It gets paid every time it happens, and almost nobody is tracking the total.

What the tax actually looks like

The verification tax. Every ungoverned number that reaches a meeting eventually needs someone to check it. That checking work rarely gets scheduled. It gets absorbed, usually by whoever is already stretched thin, at the exact moment a decision is waiting on the answer.

The reconciliation tax. Two numbers in a room means someone has to explain the gap. That explanation almost never has a quick answer, because the gap is usually a definitional mismatch: a different date range, a different customer segment, a different join that nobody wrote down. Resolving it means reverse engineering a query nobody kept a record of.

The credibility tax. Once a wrong number has been in a meeting, the data team’s numbers get a second look too, even the correct ones. Trust doesn’t erode evenly. One bad number from an ungoverned source can quietly increase scrutiny on everything the data team produces afterward, whether that scrutiny is warranted or not.

The opportunity tax. All of that verification and reconciliation time comes from somewhere. It comes from the roadmap, the actual analysis work the data team was supposed to be doing instead of playing defense against an answer they didn’t produce.

None of these show up on a dashboard. They show up as a data team that seems perpetually behind, without anyone being able to point to exactly why.

Banning the tool doesn’t remove the tax

The instinctive response to this is to block public AI tools at the network level and call the problem solved. It rarely works, and when it does work, it usually just moves the cost somewhere less visible. The underlying need, a fast answer to a specific business question, does not go away because the tool got blocked. It moves to a personal device, a different account, a colleague who still has access. The tax stays the same. The visibility into it gets worse.

Blocking access without offering a governed alternative treats the symptom and leaves the actual cause in place: business users have a real question and no fast, trustworthy way to ask it.

What actually removes the tax

The only way to remove the verification and reconciliation tax is to remove the reason it exists: a governed answer has to be at least as fast as an ungoverned one, or the ungoverned path stays attractive no matter what the policy says.

That means conversational access to data that resolves through certified definitions instead of a model’s best guess. When gross margin means the same thing everywhere it’s asked, and the answer comes with a citation back to the source table and the definition version behind it, there is nothing left to reconcile. The number that shows up in the meeting is the number the data team would have produced anyway, because it came from the same governed pipeline.

It also means every question leaves a prompt-level record: who asked, what was resolved, what ran, what came back. When a number is challenged, the answer to “where did this come from” is a lookup, not an investigation.

This is not a security control bolted onto an existing BI stack. It is what removes the actual incentive for the shadow path to exist in the first place, because the sanctioned path stops being slower.

The real question to ask

The shadow AI tax rarely gets calculated directly, because it is spread across dozens of small interruptions rather than one visible incident. A more useful exercise than trying to measure it after the fact is asking the data team a simpler question: how many hours this month went toward verifying, reconciling, or explaining a number that didn’t originate with them?

Whatever that number turns out to be, it is not a cost the business decided to pay. It is a cost that accumulated because the sanctioned path was slower than the alternative. Fixing that gap is what actually stops the tax from being collected again next month.

A wrong number rarely gets caught the first time it’s said out loud in a meeting. It gets caught the third time, once it has already shaped a decision or two, when someone finally asks where it came from.

That delay is the actual challenge with shadow AI. It doesn’t announce itself. There’s no login screen, no request ticket, no line item anywhere that says “business question answered outside governed systems.” The evidence is scattered across normal-looking behavior that only reads as a pattern once someone is looking for it.

Here’s what to actually look for, and what it usually means when you find it.

Analysts talk about double-checking more than they used to

Listen for a specific phrase: “let me just double-check that.” If it’s coming up more often, especially attached to numbers the analyst didn’t personally produce, that’s usually a sign someone upstream got an answer from somewhere other than the governed system and brought it into a conversation as if it were settled.

The double-checking itself isn’t the problem. It’s a reasonable response to uncertainty. The problem is what created the uncertainty in the first place: a number entered circulation without going through anything the data team controls.

A number shows up that nobody on the data team recognizes

This is usually the first hard signal, and it typically arrives sideways. Someone references a figure in a meeting, a data team member hears it, and has a moment of “wait, where did that come from?” If that moment is happening even occasionally, it’s worth treating as a signal rather than a one-off.

The specific tell is not that the number is wrong. Sometimes it’s approximately right. The tell is that nobody can trace it back to a query, a report, or a person who built it deliberately.

People describe getting answers “faster” from somewhere else

If you hear language like “I just asked it directly” or “it was quicker to check myself,” pay attention to what “it” refers to. Often this is completely legitimate, someone found a faster path through an approved tool. Sometimes it isn’t, and the faster path is a public AI assistant that has no connection to certified definitions, no access controls, and no record of what was asked or answered.

The distinguishing question is simple: can the data team see what was asked and what came back? If the honest answer is no, the speed came from somewhere ungoverned.

Reconciliation requests are increasing

A rising number of “why doesn’t this match” questions is one of the more measurable signals available, because it usually leaves a trail in tickets, Slack threads, or email. If reconciliation requests are trending up without a clear cause like a new data source or a metric redefinition, ungoverned answers entering circulation is a reasonable hypothesis to test.

The pattern to watch for specifically is reconciliation requests where the second number has no clear origin. A mismatch between two known systems is a data quality issue. A mismatch where one side traces to nothing is usually shadow AI.

Nobody can say with confidence where a specific number came from

This is the clearest version of the problem, and also the hardest one to notice, because the absence of an answer doesn’t feel like an event. Try it as a direct exercise: pick a number that appeared in a recent leadership deck and ask whoever presented it to trace its exact origin, the source table, the definition used, the person or system that produced it.

If that trace takes more than a few minutes, or comes back with genuine uncertainty, that’s not a one-time gap. It’s evidence of how numbers are currently entering the organization, and it will keep happening the same way until something changes about the path itself.

The data team has started asking “did this come from us?” first

This is a late-stage signal, and it means the organization has already been through enough incidents that the data team has adapted its default posture. When “did this come from us” becomes a routine first question rather than an unusual one, the shadow AI problem has been present long enough to change behavior, not just create occasional friction.

What to do with this list

None of these signals alone proves anything. A single moment of double-checking, a single unfamiliar number, a single fast answer, all of those happen in healthy organizations too. What matters is whether several of these are showing up together and trending in the same direction.

If they are, the next step is not a policy memo banning specific tools. That tends to move the behavior somewhere less visible rather than removing it, since the underlying need for a fast answer to a business question doesn’t disappear because the tool got blocked.

The more durable fix is making the governed path at least as fast as the ungoverned one: conversational access to data that resolves through certified definitions, with every question and answer logged automatically. When the sanctioned path is no slower than the alternative, there’s no longer a reason for the alternative to exist quietly in the background.