Beyond Authorized Adoption: Shadow AI, Governance Visibility, and Information Security Exposure in Knowledge Work
Main Article Content
Abstract
This study examined why formal authorization did not ensure that organizational use of generative artificial intelligence was visible enough to be governed. It used a theory-driven integrative literature synthesis across Shadow IT, generative artificial intelligence governance, information security governance, and AI-enabled knowledge work. The synthesis distinguished formal authorization as institutional status, governance visibility as epistemic capacity, and governability as organizational action capacity. Crossing authorization with visibility produced four ideal-type conditions consisting of Governed AI, Opaque Authorized AI, Detectable Shadow AI, and Deep Shadow AI. The analysis also separated information security exposure from vulnerability, incident, and realized harm. Opaque Authorized AI emerged as the most consequential conceptual correction because an approved AI-use practice could remain difficult to observe, reconstruct, and govern. The study concluded that approval alone was an insufficient basis for organizational AI governance and that governance analysis needed to focus on the visibility of actual AI-use practices in knowledge work.
Article Details
Section
References
Baird, A., & Maruping, L. M. (2021). The next generation of research on IS use. A theoretical framework of delegation to and from agentic IS artifacts. MIS Quarterly, 45(1), 315–341. https://doi.org/10.25300/MISQ/2021/15882
Berente, N., Gu, B., Recker, J., & Santhanam, R. (2021). Managing artificial intelligence. MIS Quarterly, 45(3), 1433–1450. https://doi.org/10.25300/MISQ/2021/16274
Birkstedt, T., Minkkinen, M., Tandon, A., & Mäntymäki, M. (2023). AI governance. Themes, knowledge gaps and future agendas. Internet Research, 33(7), 133–167. https://doi.org/10.1108/INTR-01-2022-0042
Brynjolfsson, E., Li, D., & Raymond, L. (2025). Generative AI at work. The Quarterly Journal of Economics, 140(2), 889–942. https://doi.org/10.1093/qje/qjae044
Butollo, F., Haase, J., Katzinski, A.-K., & Krüger, A. K. (2025). Generative AI and changes to knowledge work. Weizenbaum Journal of the Digital Society, 5(4). https://doi.org/10.34669/WI.WJDS/5.4.1
Chan, A., Ezell, C., Kaufmann, M., Wei, K., Hammond, L., Bradley, H., Bluemke, E., Rajkumar, N., Krueger, D., Kolt, N., Heim, L., & Anderljung, M. (2024). Visibility into AI agents. Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency, 958–973. https://doi.org/10.1145/3630106.3658948
Cobbe, J., & Singh, J. (2020). Reviewable automated decision-making. Computer Law & Security Review, 39, 105475. https://doi.org/10.1016/j.clsr.2020.105475
de Almeida, P. G. R., & dos Santos Júnior, C. D. (2025). Artificial intelligence governance. Understanding how public organizations implement it. Government Information Quarterly, 42(1), 102003. https://doi.org/10.1016/j.giq.2024.102003
Faraj, S., Pachidi, S., & Sayegh, K. (2018). Working and organizing in the age of the learning algorithm. Information and Organization, 28(1), 62–70. https://doi.org/10.1016/j.infoandorg.2018.02.005
Ferneley, E. H., & Sobreperez, P. (2006). Resist, comply or workaround? An examination of different facets of user engagement with information systems. European Journal of Information Systems, 15(4), 345–356. https://doi.org/10.1057/palgrave.ejis.3000629
Fürstenau, D., Rothe, H., & Sandner, M. (2017). Shadow systems, risk, and shifting power relations in organizations. Communications of the Association for Information Systems, 41, 43–61. https://doi.org/10.17705/1CAIS.04103
Fürstenau, D., Rothe, H., & Sandner, M. (2021). Leaving the shadow. A configurational approach to explain post-identification outcomes of shadow IT systems. Business & Information Systems Engineering, 63, 97–111. https://doi.org/10.1007/s12599-020-00635-2
Haag, S., & Eckhardt, A. (2017). Shadow IT. Business & Information Systems Engineering, 59, 469–473. https://doi.org/10.1007/s12599-017-0497-x
Jaakkola, E. (2020). Designing conceptual articles. Four approaches. AMS Review, 10, 18–26. https://doi.org/10.1007/s13162-020-00161-0
Jung, J. Y., & Winter, S. J. (2025). Policy for sociotechnical Gen AI assessment. Leveraging end users. Journal of the Association for Information Systems, 26(2), 287–293. https://doi.org/10.17705/1jais.00934
Kopper, A., Fürstenau, D., Zimmermann, S., Klotz, S., Rentrop, C., Rothe, H., Strahringer, S., & Westner, M. (2018). Shadow IT and business-managed IT. A conceptual framework and empirical illustration. International Journal of IT/Business Alignment and Governance, 9(2), 53–71. https://doi.org/10.4018/IJITBAG.2018070104
Mäntymäki, M., Minkkinen, M., Birkstedt, T., & Viljanen, M. (2022). Defining organizational AI governance. AI and Ethics, 2, 603–609. https://doi.org/10.1007/s43681-022-00143-x
Novelli, C., Taddeo, M., & Floridi, L. (2024). Accountability in artificial intelligence. What it is and how it works. AI & Society, 39, 1871–1882. https://doi.org/10.1007/s00146-023-01635-y
Noy, S., & Zhang, W. (2023). Experimental evidence on the productivity effects of generative artificial intelligence. Science, 381(6654), 187–192. https://doi.org/10.1126/science.adh2586
Papagiannidis, E., Mikalef, P., & Conboy, K. (2025). Responsible artificial intelligence governance. A review and research framework. The Journal of Strategic Information Systems, 34(2), 101885. https://doi.org/10.1016/j.jsis.2024.101885
Raji, I. D., Smart, A., White, R. N., Mitchell, M., Gebru, T., Hutchinson, B., Smith-Loud, J., Theron, D., & Barnes, P. (2020). Closing the AI accountability gap. Defining an end-to-end framework for internal algorithmic auditing. Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, 33–44. https://doi.org/10.1145/3351095.3372873
Retkowsky, J., Hafermalz, E., & Huysman, M. (2024). Managing a ChatGPT-empowered workforce. Understanding its affordances and side effects. Business Horizons, 67(5), 511–523. https://doi.org/10.1016/j.bushor.2024.04.009
Silic, M., & Back, A. (2014). Shadow IT. A view from behind the curtain. Computers & Security, 45, 274–283. https://doi.org/10.1016/j.cose.2014.06.007
Silic, M., Barlow, J. B., & Back, A. (2017). A new perspective on neutralization and deterrence. Predicting shadow IT usage. Information & Management, 54(8), 1023–1037. https://doi.org/10.1016/j.im.2017.02.007
Silic, M., Silic, D., & Kind-Trüller, K. (2025). From Shadow IT to Shadow AI. Threats, risks and opportunities for organizations. Strategic Change. Advance online publication. https://doi.org/10.1002/jsc.2682
Snyder, H. (2019). Literature review as a research methodology. An overview and guidelines. Journal of Business Research, 104, 333–339. https://doi.org/10.1016/j.jbusres.2019.07.039
Storey, V. C., Yue, W. T., Zhao, J. L., & Lukyanenko, R. (2025). Generative artificial intelligence. Evolving technology, growing societal impact, and opportunities for information systems research. Information Systems Frontiers, 27(5), 2081–2102. https://doi.org/10.1007/s10796-025-10581-7
Sturm, S., Krause, F., & van Giffen, B. (2026). Beyond control? Governing AI in organizations for responsible use. European Management Journal. Advance online publication. https://doi.org/10.1016/j.emj.2026.06.003
Whittemore, R., & Knafl, K. (2005). The integrative review. Updated methodology. Journal of Advanced Nursing, 52(5), 546–553. https://doi.org/10.1111/j.1365-2648.2005.03621.x