Dr Leon Furze

In April I wrote about shadow AI and the VINE GenAI Guidelines 2026: the three-zone model, the difference between shadow and covert use, and the idea of a “paved road” that makes the official path easier than the workaround. The obvious next question for any school leader reading it is a simple one: how much of this is actually happening at our school?

The honest answer is that nobody really knows, and that includes in education research. So, I went looking for what has been studied, in education and outside it, to see what we can say with some confidence about how much shadow AI exists in our schools and universities.

Shadow AI: Bringing covert AI use out of the dark

What we know from workplaces

The best large-scale data comes from outside education. The 2025 global study by KPMG and the University of Melbourne surveyed more than 48,000 people across 47 countries. More than half of employees (57%) admitted to using AI in non-transparent ways, such as avoiding revealing when they had used it or presenting AI-generated work as their own. Almost half (48%) had uploaded company information into public AI tools, and 56% had used AI at work without knowing whether it was allowed. In Australia, 44% of employees had used AI in ways that contravene their organisation’s policies, and 51% had presented AI-generated content as their own.

There’s also a finding in that study which backs up exactly what we wrote in the VINE Guidelines: uploading company information into public AI tools was most common in organisations that had banned generative AI (67%). The researchers’ reading is that outright bans may be ineffective, and that having a policy doesn’t guarantee compliance.

Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of people who use AI at work bring their own tools, and that over half of them are reluctant to admit using it for their most important tasks. Beyond those two studies, most of the numbers come from vendors selling security products: depending on who you ask, somewhere between half and four in five employees use AI their employer hasn’t approved.

What we know from education

Not a lot, and almost none of it from K-12 schools.

In higher education, a joint study by EDUCAUSE, NACUBO, CUPA-HR and AIR surveyed close to 2,000 university staff, administrators and academics in the US. As reported, almost all (94%) were using AI tools in their work, but only around half (54%) knew whether their institution had policies governing that use, and more than half (56%) were using AI tools their institution hadn’t provided.

The most useful education study I found isn’t specifically about AI. A 2025 preprint surveyed 375 educators across schools and universities about “unsanctioned technology”, the article itself is titled, “It’s not approved, but many, like myself, ignore the rule.” The researchers deliberately recruited educators who were already using unsanctioned tools, so it can’t tell us how common the practice is, but it tells us something about how it works. Between them, the educators listed 1,373 unsanctioned apps, and ChatGPT was, predictably, near the top of the list. Most had heard about their tools from colleagues, but fewer than a third claimed to know of any institutional policy. Only 24 mentioned privacy or security as something they considered when choosing a tool. And of the 107 participants who had received a formal warning about their technology use, only 33 actually changed their behaviour.

So, bans don’t work, and warnings mostly don’t work either, which is what the broader shadow IT literature has been saying for years.

There is also some early qualitative work, including a recent preprint on how university educators legitimise informal AI use in the absence of institutional guidance, and a CHI 2026 study of teachers in a US district with no district-wide AI policy. In both, educators define the boundaries themselves, based on their own professional judgement. This sounds very familiar to my current surveys in schools of how students use AI: they don’t believe rules are being communicated to them, but they do have a set of internal rules they follow themselves.

I couldn’t find any study measuring shadow AI among K-12 staff (shout out if you’ve done this study…). And I couldn’t find any study, at any level of education, that asked non-teaching staff in schools. That’s obviously a significant gap, because the people in enrolments, wellbeing, learning support and the business office handle the most sensitive information in the building.

What fifteen years of shadow IT in business research tells us

Shadow IT has been studied in information systems research since at least the early 2010s, and the findings are pretty consistent.

Here’s an AI-assisted (Claude Opus 5.5) TL;DR:

• It’s driven by unmet needs. People go around official systems when those systems are slower, harder to access or less capable than the alternative. In our initial VINE consultation, one digital learning leader echoed this: “If the system of the school doesn’t respond quickly enough, the teacher will just go somewhere else.”
• It’s mostly well-intentioned. Staff use shadow IT to do their jobs better, not to cause harm. Most staff aren’t trying to expose data or share illicit IP…
• It’s a signal as well as a risk. Researchers have argued for over a decade that shadow IT is a source of innovation: it tells the organisation what people actually need. This is the logic behind Business-Managed IT, which the VINE Guidelines borrow as a transition pathway for bringing tools into the light. Silic, whose 2014 work with Back helped establish that argument, has since extended it to shadow AI in a 2025 paper with colleagues in Strategic Change.
• People make their own justifications. Research on security policy violations finds that employees neutralise rule-breaking with ready-made justifications like “no harm done”, “I had no choice”, “the rules don’t reflect my real work”. In the AI context, the obvious candidate is “it’s fine as long as I take the names out”, or “ChatGPT is better than Copilot for what I’m doing”.
• Too many rules makes it worse. Clear policy improves compliance, but policy overload pushes people towards workarounds.

What should schools do about it?

All of the research around shadow IT, and the emerging research around shadow AI, suggests four possible situations:

• “Paved Road”: the approach we outlined in the VINE guidelines: approved tools, used openly. This is the ideal goal.
• Quiet: approved tools, but staff hide their use because of how it might look or because they’re unsure if there are rules, let alone what they are. That’s a culture/norms and communication problem, and leaders modelling open AI use is a good start.
• Shadow: unapproved tools, used deliberately or without realising they’re unapproved. That’s a governance conversation.
• Covert: tools staff believe they’re not allowed to use, used without anyone responsible knowing. This is the worst form of the problem, and the culture problem the VINE Guidelines warn about. It’s also exacerbated by punitive responses to IT.

Measuring shadow AI use in schools

Putting the research together, a useful measure of shadow AI in a school would need to:

1. Ask about information, not just tools and apps. The risk isn’t that a teacher uses ChatGPT; it’s what goes into that application. The VINE zones (no student data, de-identified, identifiable student information) are a far better measure of risk than a list of brand names.
2. Compare beliefs with reality. Staff often don’t know what’s approved. If the school’s ICT team records what’s actually approved, the gap between that and what staff believe is approved is a direct measure of whether the paved road can be seen at all.
3. Ask leaders. What leaders believe about staff AI use, and about how clear the school’s guidance is, is an important measurement. The gap between leaders’ estimates and staff reports is the number most likely to change a leadership conversation.
4. Include everyone. Not just teachers.
5. Be genuinely safe to answer. Anonymous isn’t enough. Staff need to believe the results won’t be used to find out who did what, which means the school committing in writing, before anyone answers, that they won’t be.
6. Treat every unapproved tool as information. If fifteen staff are paying for the same tool out of their own pocket, the school has learned something about a gap in its approved toolset.

I’m launching a survey for 2027 to help schools and other education providers understand the extent and impact of shadow AI in their own context. The Education Shadow AI Survey is built on the research above and the VINE Guidelines framework, and designed to give leadership teams a clear picture of what’s being used, what information is involved, why, and what to do about it.

If you’d like more information, or want to be one of the first schools to take part, get in touch using the form below.

Want to learn more about GenAI professional development and advisory services, or just have questions or comments? Get in touch: