The use of unauthorized AI tools, known as shadow AI, can pose various patient safety, data privacy and compliance risks; still, clinicians are turning to these tools in their daily workflows. According to a 2025 Wolters Kluwer Health survey, 40% of healthcare professionals have encountered an unauthorized AI tool in their organizations, and nearly 20% have used them.
Shadow AI poses three primary risks, according to Sunny Kumar, M.D., partner at venture capital firm Informed Ventures. First, AI models are probabilistic by nature, making them prone to hallucinations. A rise in shadow AI use means a greater number of patient care tools aren't being monitored for such errors.
Second, data security risk rises significantly when multiple unauthorized AI tools are used within an organization, Kumar shared.
Third, patient concerns about AI usecould be exacerbated if unauthorized AI tools continue to proliferate.
To combat these risks, health system leaders must clamp down on shadow AI. But before they can develop strategies to contain its use, they must understand why clinicians are turning toward it in the first place.
Why clinicians are using shadow AI tools
The use of shadow AI tools is rising primarily due to the need for faster workflows, with half of health professionals citing this as a top factor driving shadow AI use in the Wolters Kluwer Health survey.
However, as demand grows, health systems may struggle to keep up, particularly as AI technology evolves, Girish Nadkarni, M.D., chief AI officer of the Mount Sinai Health System, said.
"AI governance was built for predictive AI, one use case at a time," he said. "It doesn't work for generative AI. Workforce demand points to the need for much faster deployment."
However, AI deployment processes tend to move slowly. Kumar noted that requests for proposals, procurement, IT and security clearances and long healthcare sales cycles can "drag adoption out for months or years."
In lieu of quick deployment to meet workforce needs, clinicians may turn to unsanctioned AI tools to fill the gap. Health IT leaders have shared with Kumar that clinician demand is increasingly driving enterprise AI tool adoption; so much so that they are willing to pay out-of-pocket for AI tools that ease their workflows.
According to health IT leaders, if organizations did not adopt a single enterprise solution, clinicians would buy their own tools, leading to multiple, unauthorized tools within a single organization and increasing IT complexity.
Additionally, Kumar shared that clinicians are eager to experiment with AI tools that can take ancillary and administrative tasks off their plates. While the clamor for these tools may not be as loud as something like scribing, Kumar expects clinical demand to grow here as well.
Offering efficient alternatives can curb shadow AI
Understanding and meeting clinicians' AI demand is critical to mitigating shadow AI utilization. The risk associated with multiple shadow AI tools and potential compliance gaps is high enough that health system leaders need to focus on streamlining technology selection and implementation processes to get these tools into clinicians' hands faster, according to Kumar.
Additionally, leaders should ensure that the enterprise AI tools they implement are tailored to organizational workflows, Kumar said. The easier leaders can make it for clinicians to adopt enterprise AI tools, the less likely clinicians will be to turn to shadow AI technologies.
Mount Sinai is using this approach to stem shadow AI use. According to Nadkarni, the health system is expanding the secure use of Microsoft Copilot and Google Gemini via single sign-on capabilities.
"The solution here is not to prohibit [AI tools] without a usable alternative, but to give sort of secure government enterprise-grade alternatives to the workforce so that it's easier to use those tools as opposed to paying for your own tools and using them," he said.
Additionally, the health system has a code of conduct governing AI use. Nadkarni shared that the code of conduct includes AI product specifications, use cases and policies. An executive AI steering committee creates and updates the AI code of conduct.
Nadkarni further emphasized that the health system does not use disincentives or penalties to curb the use of shadow AI; instead, it focuses on providing effective enterprise AI tools in a timely manner and on enhancing communication about AI tool availability and support.
"We send out broadcast notifications, we have town halls, we have regular communication policies, we have an email address that people can easily reach out to, we have a digital concierge where people can ask questions," Nadkarni said.
Not only that, but the health system has an AI hub where people can share comments, questions and suggestions about AI utilization.
Transparency is another critical aspect of encouraging clinicians to use authorized AI tools, according to Kumar. Being honest and open about the health system's AI strategy -- and the reasoning behind it -- can help clinicians understand the organization's AI roadmap and dissuade them from using shadow AI tools to fill perceived gaps.
Health AI utilization will continue to grow, and as the technology evolves, so will its use cases and potential to ease workflows. However, to prevent new bottlenecks and security risks from emerging due to disparate, unauthorized adoption of these tools, health system leaders must ensure they are meeting their clinical staff's needs.
Anuja Vaidya has covered the healthcare industry since 2012. She currently covers healthcare IT and innovation, including artificial intelligence, digital healthcare, EHRs and interoperability.
