Shadow AI on Mobile: The Data Risk Hiding in Plain Sight

Ask an Irish IT or security lead whether their organisation has a handle on AI and the answer usually comes with a list of approved tools and a policy in the staff handbook. Ask which AI apps are running on the phones and tablets that connect to company email, files and customer records, and the conversation tends to go quiet.

That second question is where Shadow AI sits. People are using AI apps the organisation has never approved to summarise documents, draft replies, transcribe meetings and tidy up proposals, and a growing share of that activity happens on mobile devices that sit outside the controls built for laptops and the corporate network. Each individual use feels harmless. Added together, they amount to a steady flow of company and client data into services nobody has vetted, with no record of where any of it went.

AI Use at Work Has Outpaced the Rules

Irish workers have embraced AI faster than most of their employers have planned for. A Censuswide survey of 1,000 employees in the Republic, commissioned by Landmark Technologies, found that 87 per cent of office workers use AI tools for work, and almost half of those use them every day. The tools they reach for are often their own. Accenture’s research found that only 34 per cent of employees in Ireland said they used AI tools provided by their employer.

Policies and guidance are still catching up. In many organisations, people have been given little clarity on which AI tools are acceptable or what information they can safely put into them, so they make their own judgement calls, usually with the best of intentions and usually on the device closest to hand.

Trinity College Dublin’s AI Economy report points out that Ireland ranks fourth globally for AI adoption, and that countries with high adoption often go through a phase where everyday use settles in faster than governance matures. That is the phase many Irish organisations are in right now.

Why Mobile Is Where Shadow AI Hides

The phone is the device people have with them all day, and it is often the quickest route to an answer. Lookout estimates that 52 per cent of generative AI use now takes place on mobile devices, outside the reach of firewalls, web gateways and existing governance controls, with more than 25,000 AI-enabled apps already available in the major app stores.

Much of that activity never passes through the corporate network at all. It runs over home broadband or mobile data, frequently on personal devices, and often inside apps that look like any other productivity tool. A Lookout study found that 93 per cent of security executives were confident in their AI governance, while traditional network perimeters had no view of a large volume of mobile AI activity. The same research found that enterprises lack visibility into a large share of mobile AI activity on both corporate-owned and personal devices. Confidence and visibility have drifted a long way apart.

What Is Actually at Risk

The most obvious risk is data leaving the organisation. A client’s contract details pasted into a chatbot, a photo of a whiteboard uploaded for summarising, a screenshot of a spreadsheet shared with an AI assistant: each one moves information to a third party with its own terms on storage and reuse. As soon as personal data is involved, that becomes a GDPR matter, with all the questions about lawful processing and data transfers that follow.

Access is the second concern. When people authorise unvetted AI assistants or productivity plugins, those tools can inherit existing single sign-on access, which means an app downloaded in a spare minute may end up with a view of email, calendars and shared files. Counterfeit versions of popular AI apps add a third layer of risk, because a convincing copy in an app store is easy to mistake for the real thing.

Why It Has Become a Board-Level Question

NIS2 places accountability for cyber risk management with management boards, and that expectation is already reaching Irish organisations through customer security questionnaires, insurer renewals and supply chain assessments, well ahead of the National Cyber Security Bill. Questions about how AI use is controlled are starting to appear alongside the familiar ones about patching and access control.

The EU AI Act adds its own pressure. Some of its later deadlines have moved, but the groundwork has not changed. The hard part of compliance is finding every AI system in the organisation and keeping that inventory current as new tools arrive. For most organisations, the phones in their people’s pockets are the hardest place to build that inventory.

NIS2, the AI Act and GDPR each approach the issue from a different direction, and all three arrive at the same question: which AI tools are in use, by whom, and with what data? Many Irish organisations can answer it for their laptops. Very few can answer it for mobile.

What Good Looks Like

Banning AI outright tends to push it further out of sight, because people who find AI useful will keep using it on whatever device lets them. The organisations handling this well start with visibility, discovering which AI apps are present across both managed and personal devices and what each one can access. From there they classify apps by risk and data handling, allow the ones that help people work, warn on the ones that need care, and block the ones that put sensitive data at risk.

The final step is keeping a record. When a customer, insurer or auditor asks how AI use is governed, the answer becomes a report showing what is in use and what the policy did about it, which carries far more weight than a paragraph in a policy document.

The Opportunity for Partners

For MSPs and resellers, Shadow AI is a timely way to open a mobile security conversation with customers who have never prioritised it. Customers are already being asked about AI governance by their own clients and insurers, and many do not know where to start. A partner who can show them what is running on their devices, and help them put a sensible policy in place, is offering something with clear and ongoing value.

Upcoming Webinar

On Thursday 19th November at 11am, Renaissance and Lookout are hosting a session for Irish organisations and partners on Shadow AI on mobile. Michael Simpson, Senior Sales Engineer at Lookout, will show how Shadow AI takes hold on mobile devices, what it exposes, and the practical steps organisations can take to bring it under control.

In the session we will cover:

How Shadow AI takes hold on mobile devices and why it rarely shows up in existing security reporting
What unapproved AI apps expose across the mobile attack surface, from client data to credentials
How to see which AI tools are in use across managed and personal devices
How to put sensible governance in place that protects data without holding back productivity
How to evidence control of AI use for NIS2, the EU AI Act, GDPR and the questions coming from customers and insurers

If your approach to AI stops at the laptop, this session will show you what the rest of the picture looks like. Register now by following the link: https://renaissance.renaissance.ie/c/458941/