F. Paul Greene and Margaret K. Rhoda discuss how organizations face increased risks from the use of unsanctioned or personal generative AI tools, known as shadow AI, which can lead to data breaches and regulatory reporting obligations. What makes shadow AI such a difficult threat to manage is the speed at which AI solutions are coming to market. In the rush to find utility and efficiencies through Artificial Intelligence (“AI”), primarily generative AI solutions, many organizations have not adequately assessed the resulting risk. This is also true of organizations that have banned or restricted the use of generative AI solutions for organizational purposes.