Guides › DLP for AI and shadow AI

DLP for AI and Shadow AI: Why Blocking Fails, and What Holds

The first response most organizations make to employees using AI tools is a data loss prevention rule: block the paste, block the upload, block the domain. It is a reasonable instinct and the measurements from the last two years say it does not work as a strategy. Most AI use happens on personal accounts that no corporate control reaches, most data that leaves does so through routes DLP cannot see, and the organizations that reduced unsanctioned use did it by provisioning a sanctioned tool rather than by blocking. This page lays out what the shadow AI data shows, what DLP for AI covers and misses, and the design that makes the sanctioned path the safe one.

What the shadow AI numbers say

The Cloud Security Alliance's May 2026 research note on shadow AI collects the vendor telemetry and survey work from 2025 and early 2026, with the caveat that most of it comes from vendors whose customers already run monitoring, so the true rates in unmonitored organizations are probably higher. The consistent findings are these. The large majority of AI use at work runs through personal accounts: LayerX measured 71 percent of generative AI connections on personal, non-corporate accounts, and Harmonic Security put 73.8 percent of enterprise ChatGPT usage on personal accounts across 22 million prompts. Pasting is the primary route, with 77 percent of employees pasting data into prompts and 82 percent of those pastes going through unmanaged personal accounts, and 40 percent of files uploaded to generative AI tools containing personal or payment card data. Gartner found 69 percent of organizations had evidence or suspicion of employees using prohibited public generative AI. A June 2026 survey of 1,250 office professionals at large companies found 66 percent had used AI tools they believed were not permitted, and more than a third had entered customer data into public models.

Two numbers describe the consequence and the remedy. IBM's 2025 Cost of a Data Breach report attributed about $670,000 in additional breach cost to organizations with high shadow AI involvement and found that 97 percent of organizations reporting AI-related breaches lacked proper AI access controls. And one vendor's data, cited in the same note, found that provisioning a sanctioned tool cut unauthorized use by 89 percent. The second number is the one this page is built on.

What DLP for AI actually covers

Data loss prevention for AI has three forms, and each catches a specific route. Endpoint DLP, of which Microsoft Purview is the widely deployed example, inspects paste and upload actions in a managed browser on an onboarded device: with the browser extension in place it can warn or block a user pasting a card number into a public AI site in Edge, Chrome or Firefox, and Edge can block prompts containing common sensitive information types inline. Several of the default policies ship in audit mode and have to be switched on. Copilot-side DLP is different in kind: a Purview policy can block Microsoft 365 Copilot and agents from processing items carrying selected sensitivity labels, which governs what a sanctioned assistant inside the tenant may read. Network DLP through a SASE or SSE integration sees traffic to AI domains from managed network paths and depends on the partner's implementation for what it can inspect.

What all three miss is the larger set. A personal device, an unmanaged browser or a phone is outside endpoint DLP. A personal account on a managed device is inside the browser but outside the policy's knowledge of who the user is, and the content rules only catch what matches a pattern; a paraphrased paragraph of a contract matches nothing. Connectors and retrieval do not paste anything: when a user asks a sanctioned assistant to summarize the Northfield account, the assistant fetches the documents itself, and no DLP rule written for the clipboard sees the fetch. Agents and tool calls are the same route with more hops. Screenshots and photographs of screens go to the model as images. And Copilot label-based blocking covers only labeled items, which in most tenants is a minority of the content.

Why blocking fails as a strategy

Blocking works on the route it blocks and moves the behavior to the next route. Block the domain on the corporate network and the use moves to the phone. Block the paste in the managed browser and the use moves to the personal laptop. Nearly half of workers who use AI do not tell their managers, and the June 2026 survey found nearly half would rather use AI without telling anyone than risk being told it is not allowed. The population being blocked is motivated, the alternatives are free, and every block that lands on a legitimate task makes the sanctioned path less attractive than the unsanctioned one. The organizations that got the number down did the reverse: they made the sanctioned tool better and safer than the personal one, and then used DLP to catch the residual.

What holds: make the sanctioned path the safe one

The design has four parts and DLP is the last of them. First, provision: give every employee a business or enterprise tier of the assistant they are already using on a personal account, so the contract terms in the provider comparison apply and personal accounts become a policy violation with an obvious alternative. Second, write the acceptable use policy around data classes rather than tools, so people know what may go where and why. Third, make the sanctioned path safe for the data people actually want to use: connect the sources through a layer that scopes retrieval to the asker and substitutes identifiers before anything reaches the provider, which is what makes the regulated use cases possible inside the sanctioned tool rather than pushing them to a personal one; the connection procedure covers it. Fourth, turn on retrieval telemetry so the sanctioned path produces the evidence DLP never could, and then deploy DLP for the paste-and-upload route as the residual control it is. A 90-day sequence is below.

Where Hardshell sits

Hardshell is the third part of the design. It connects to the systems where data already lives without migrating them, inherits their permissions and limits each retrieval to what the requesting user is entitled to see, substitutes stand-ins for real identifiers before content reaches ChatGPT, Claude, Copilot or any other provider, and records every retrieval under opaque IDs. That is what lets the sanctioned assistant work on customer, patient and employee records, which is the use people were taking to personal accounts, and it produces the retrieval record that DLP cannot. It deploys as a cloud service, in a private cloud or as an offline bundle.

Frequently asked questions

Can DLP block ChatGPT?

Endpoint DLP can block or warn on pasting and uploading sensitive content to AI sites in a managed browser on an onboarded device, and network controls can block the domain on managed paths. Neither reaches a personal device, a phone or a personal account's content, and the measured effect of blocking alone is displacement rather than reduction.

Does Purview DLP work for Microsoft 365 Copilot?

A Purview policy can block Copilot and agents from processing items with selected sensitivity labels, and Copilot inherits labels and retention. It covers labeled content, and it does not change what unlabeled content the user's permissions allow Copilot to reach, which is the larger exposure in most tenants.

Should we block AI sites entirely?

Only as a short bridge while a sanctioned tool is provisioned. The data shows blocked use moves to personal devices and accounts, where no control applies, and the organizations that reduced unsanctioned use did it by provisioning. Block the consumer tiers once an equivalent business tier exists, and say why.

How do we find shadow AI use?

Identity provider logs for OAuth grants to AI applications, network and SSE logs for AI domains, endpoint DLP audit mode, and the DSPM-style reports several vendors now ship. Expect the count to be higher than anyone estimates; unauthorized tools stayed active for a median of 403 days before detection in one 2025 dataset.

Is shadow AI use a reportable breach?

It can be, depending on what left and under which regime. Customer data entered into a consumer AI tool is a disclosure to a third party under consumer terms; whether it triggers notification is a question for counsel against the specific data and jurisdiction. At least one U.S. public company filed an SEC Form 8-K in 2026 over unauthorized employee AI use, which answers the question of whether regulators consider it material.