Mon, 26th Oct 2026 (Today)
MARA SUGUENews Editor
Planet IT has identified a governance risk it calls Ghost AI in UK businesses. The issue centres on approved AI tools that remain connected to systems without clear ownership.
Its analysis of UK Google search data found rising concern about AI oversight and unapproved use. Searches for “Shadow AI” rose 85% year on year, while “What is Shadow AI?” increased 191% and “Shadow AI meaning” climbed 1,000%, based on search volumes from September 2025 to August 2026.
Interest in formal controls also grew over the same period. Searches for “AI governance” were up 48% year on year, while “AI governance certification” rose 85%.
Planet IT, part of TalkTalk Business, said the figures suggest organisations are becoming more concerned about AI-related risks. But it argued that much of the focus remains on employees using unapproved tools, rather than older or overlooked systems that still have access to company data.
Bradley Collis, Security Solutions Architect at Planet IT, drew a distinction between the two issues. “Businesses are focusing on the AI tools they’re introducing today, but often don’t have visibility over the tools that were introduced six months or even two years ago,” he said.
“The employee who set it up may have left months ago, but the tool is still quietly accessing business data.”
In Planet IT’s description, Shadow AI refers to staff adopting AI systems without organisational approval. Ghost AI, by contrast, refers to approved tools, agents or automations that continue operating after a project ends or after responsibility for them becomes unclear.
“Shadow AI is AI that enters the business without approval,” Collis said.
“Ghost AI is AI that stays in the business without ownership.”
The issue is becoming harder to track as AI features appear in mainstream business software and organisations add more third-party tools to core systems. Productivity software, customer relationship management platforms and customer service applications now commonly include AI functions, while external tools are often linked to email, document stores and customer databases.
Collis said the practical risk often lies less with the supplier than with the permissions granted when tools are set up. “Businesses focus on whether they trust the AI provider, but often overlook what permissions the tool has once connected,” he said.
“A simple automation platform may be given administrator-level access to email systems, customer records or financial information because it was easier to configure that way during deployment.”
Those permissions can remain active long after the original business need has passed. That creates the possibility that systems no longer monitored by a named employee could still retrieve or process sensitive information.
Collis said this is a recurring finding in client environments. “We regularly discover abandoned integrations connected to business systemshedule and no clear revocation process,” he said
“In many cases organisations are unaware the connection still exists.”
The warning comes amid a broader public debate about AI safety, regulation and oversight. Search interest in AI-related safety topics increased during 2026, Planet IT said, against a backdrop of policy developments and wider discussion of AI risks.
Collis said public attention often settles on visible threats such as deepfakes, misinformation and chatbot failures, while internal governance issues receive less scrutiny. “The biggest threat to most SMEs isn’t necessarily a sophisticated cyberattack,” he said.
“It’s often a forgotten, unmonitored tool with excessive permissions.”
Planet IT said organisations should review existing AI deployments and make sure each connected system has a designated owner, defined permissions and regular oversight. Businesses should also check whether they can identify every AI tool linked to email, CRM or document systems, whether those permissions are reviewed, and whether access granted by former employees has been withdrawn.
The company also pointed to the principle of least privilege, under which tools receive only the access needed for a specific task. The approach is already common in cybersecurity and identity management, but Planet IT argued that AI adoption is exposing weak enforcement of those rules in many organisations.
Collis said AI does not remove old governance problems. “AI doesn’t remove governance challenges,” he said.
“It amplifies the ones that already exist.”
For businesses trying to tighten control over AI use, he said the starting point is basic visibility rather than reacting to the latest public scare. “The businesses that get ahead of this won’t be those waiting for the next AI headline,” he said.
“They’ll be the ones asking a much simpler question: what AI tools do we actually have, who owns them, and what can they access?”
ChatGPT
Key takeawaysExplain why it mattersCreate action planFuture watch
Claude
Key takeawaysExplain why it mattersCreate action planFuture watch
Perplexity
Key takeawaysExplain why it mattersCreate action planFuture watch
Grok
Key takeawaysExplain why it mattersCreate action planFuture watchShareShareAdd us as a preferred source on Google
Image: Bradley Collis
Related stories
Microsoft expands Project Perception to police AI agentsReco raises USD $55 million with AT&T Ventures backingThales expands Google Cloud tie-up to secure AI agentsReco raises USD $55 million in AT&T Ventures-backed roundMost firms run AI agents without proper security tools
Top stories
UK launches TechFirst scheme to place women in tech jobsSuppliers back traceability & origin verificationUK small firms race to build AI tools without oversightGlobal cyber attacks jump 48% as phishing risesAcronis adds dark web monitoring to MDR service
