From hidden use to accountable governance: an ethical maturity model for shadow AI in organizations

Abstract

Shadow AI involves employees using public, personal, or other unauthorized artificial intelligence tools without having obtained formal approval or oversight from the organization. This article contends that Shadow AI is more than just a Cybersecurity or compliance issue; it is also an ethical governance problem because hidden use obscures accountability, reduces transparency, shifts responsibility onto individual workers, and gives rise to concerns regarding privacy, fairness, and the need for human oversight. By means of an integrative literature review and the construction of a conceptual model, the study draws together evidence from research on Shadow IT, studies concerning the use of generative artificial intelligence in the workplace, the AI ethics literature, and international governance frameworks. The patterns identified are converted into governance capabilities and are then arranged according to the degree of dependency to produce the Shadow AI Governance Maturity Model (SAGMM), a five-level framework that progresses from Invisible through to Visible, Controlled, Enabled, Adaptive governance. The model is conceptually assessed using evidence traceability, comparisons with existing frameworks, and examples from actual organizations, and it is also applied to anonymized data collected from an organization with 520 employees over a six-month period. The results of the organizational assessment show how the SAGMM indicators and the interpretation of maturity levels can be applied in real-world situations, although the model is not formally validated by this assessment. The one-year improvement figures are clearly presented as illustrative and non-predictive governance objectives rather than as actual measured outcomes or causal estimates. The ethical analysis is based on deontological, consequentialist, justice, and virtue approaches and explores the conflict between organizational visibility and employee privacy, surveillance, and autonomy. The key contribution of the SAGMM is a discovery-first approach combined with control and enablement for cases of partially hidden AI use by employees. The article maintains that organizations have a shared responsibility for establishing the conditions under which legitimate, governed AI use is both practical and proportionate and is more appealing than concealment.