Kate Grasman, chief information officer at Heffernan Group, was telling someone last week to stop using a technology until she could review it. The week before, it was someone else. This is not a failure of governance at Heffernan. It is the current operating reality of insurance firms across the US.
"Just last week, I was telling someone to stop using a technology until I review it," she said at a recent Insurance Business US Leaders Network transformation roundtable. "We do a back-end search to see if people are using technology that they shouldn't, and that has, of course, happened."
The scale of the problem is documented in data the industry has been slow to confront. According to the IBM Cost of a Data Breach Report 2025, one in five organizations has already experienced a breach linked to unsanctioned AI, with shadow AI adding an average $670,000 to breach costs in affected organizations. UpGuard's State of Shadow AI report found that more than 80% of workers use unapproved AI tools. ISACA's 2026 research found that 25% of organizations have no active AI policy at all.
In insurance, where client data includes personal information, policy details, and financial records, and where E&O exposure attaches to the quality of the advice and documentation those records support, those figures carry specific weight.
Shadow AI is not sophisticated. It is an employee pasting a client's insurance application into a browser-based AI tool to generate a summary. It is a producer using a personal AI subscription to draft proposal language that includes proprietary company data. It is a CSR using an AI browser extension that has not been reviewed for data handling.
Each of those actions sends data outside the organization's security perimeter to a system that has not been assessed for compliance with the firm's data handling obligations, E&O coverage requirements, or carrier data agreements. Cyber insurers are increasingly scrutinizing this.
Unauthorized AI usage is emerging as a basis for claim denial alongside established reasons such as missing multi-factor authentication and undocumented incident response plans, according to current analysis of the cyber insurance market.
Kristen Skender, chief growth officer at Jimcor Agencies, describes the first step her firm took when consumer-level AI became accessible. "We first had to look at what are our procedures and expectations, and how do we communicate those clearly with all of our team members. As soon as the AI opportunity became at a consumer level where anyone could access it, that's when we were being clear about those procedures and expectations with regard to sign-offs and handbook."
The speed with which that communications step matters cannot be overstated. The gap between AI becoming accessible and an organization publishing a clear acceptable-use policy is the window in which the most damaging uses tend to become established habits.
Grasman's approach at Heffernan reflects that directly. "We also don't want to hinder creativity. How do you unlock and harness the capabilities that our team members have because they're actually doing the work day in, day out? So what we've done is we have certainly tried to put in ways that people can actually bring different capabilities to us so that we can review them from a security standpoint, make sure that the use is appropriate."
That vendor management process - "bring us the tech so that you can use it" - is a structured intake for staff-identified tools that preserves organizational security review while acknowledging that employees will continue to find useful technology on their own. The alternative, pure prohibition, simply drives usage underground where it cannot be monitored or reviewed.
Skender makes the same point from the organizational culture side. "Our end goal is to create collaboration and to create partnership in how we develop new ideas. Yes, we put the guardrails in, but we also are encouraging that people share and collaborate and work together and determine how we can authorize that use, how we can make it meaningful to what they do."
Jennifer Kessel, chief operating officer at USG Insurance Services, offers the most practical framing of the governance challenge. Automation will solve roughly 80% of a given workflow. The remaining 20% is where employees go looking for solutions on their own - and where shadow AI tends to proliferate.
"We can solve for maybe 80% of a problem by implementing some kind of technology solution. Our team is going to go find a solution for the other 20%. Where they're going, I need to be focused. Because they're going to solve a problem that they have. I need to explore to see if that problem they're looking to solve is an enterprise-wide problem, and then is that my solution?"
That reframe - treating shadow AI discovery as an enterprise intelligence function rather than a compliance problem - is the most useful governance posture available. The organization that treats employee tool-finding as a signal about unmet needs is in a better position than the one that treats it only as a risk to suppress.
The data exposure risk remains real and the governance infrastructure must exist. But the firms handling shadow AI most effectively are the ones that have accepted it as an ongoing condition rather than a problem to be solved once.
