A study by SAP and Oxford Economics, released in September 2026, found something most leadership teams would rather not look at directly: 82% of organizations in Brazil have employees using third-party AI tools without formal approval or oversight — so-called “Shadow AI.” The most common reaction is to treat this as indiscipline. That is the wrong diagnosis, and the wrong diagnosis is expensive.
Why Shadow AI grows: the gap nobody closes
Research from Abiacom, with Brazil Panels and the Lideres.ai business school, exposes the mechanism behind the number: only 38.4% of AI use inside Brazilian companies happens through an official channel, against 47.4% that is unauthorized. That is not a rebellious minority — it is nearly half the workforce solving, on its own, a problem the company itself never solved.
The mechanism is easy to understand and hard to admit: when a company’s AI policy is either nonexistent or too restrictive (“no AI tools, period”), employees don’t stop needing the productivity — they just stop asking permission. They keep using a personal AI account to summarize a contract, review code, or draft a report, only now outside any of the company’s control perimeter. Shadow AI is not a symptom of careless employees; it is a symptom of policy that never caught up with real demand.
The cost of treating this as an IT problem, not a governance one
The numbers on the risk side are concrete. In the SAP/Oxford Economics survey, 43% of Brazilian companies already reported a data leak or intellectual-property exposure tied to unauthorized AI use. Globally, IBM found a similar pattern: organizations with high Shadow AI usage had an average data-breach cost US$670,000 higher than companies with little or no uncontrolled use. In Brazil, that risk carries a specific regulatory price tag — the LGPD lets the national data-protection authority fine companies up to 2% of revenue, capped at R$50 million per violation.
That changes the question leadership should be asking. It isn’t “how do we block unauthorized AI use” — blocking without an alternative just pushes the behavior to an even more invisible channel, like a personal phone entirely off the corporate network. The right question is: why is the official policy losing this fight so badly that nearly half of all usage happens outside it?
AI governance is a culture decision, not an IT checklist
In the view of João Paulo Batistella, an innovation executive with a career spanning Ericsson, Telefônica/Vivo, and five years as CEO of EISA, the hardest obstacle to change in an AI transformation is rarely the technology — it’s the organizational culture that, in practice, decides whether a new rule gets followed or worked around. A policy announced by email and never revisited meets the same fate as any rule a company’s culture doesn’t actually sustain: it becomes a dead letter, and the real behavior migrates under the radar.
That’s why an outright ban tends to fail and “approve case by case, with an auditable trail” tends to work: the second approach acknowledges that the demand for productivity is legitimate and gives it an official path, instead of pretending it will disappear because it was forbidden.
A three-step framework to bring usage inside the perimeter
1. Audit before you regulate. You cannot govern what you haven’t measured. An honest survey — which AI tools already circulate informally, on which teams, for which tasks — is the only reliable starting point. A written rule without that diagnosis regulates an imagined use, not the real one.
2. Approve by use case, not by category. “No AI allowed” is an easy rule to write and an impossible one to follow. “Approved for summarizing an internal document, not approved for entering customer data” is a rule someone can actually follow — because it separates the real risk (sensitive data leaving the perimeter) from the legitimate use (a productivity gain on a task with no sensitive data involved).
3. Offer the official alternative before you shut down the informal one. Blocking access to personal tools without delivering an equivalent corporate tool — with data controls but the same convenience — just recreates the problem on another channel. An auditable trail only exists if the official path is, in practice, as fast as the informal one it’s replacing.
None of these three steps eliminates the risk entirely — and no institutional communication should promise that it does. What they do is trade an invisible risk, measured only after the incident, for a visible one, measured and managed before it. For most companies discovering their own Shadow AI number, that trade is already the gain that matters.
Follow Eleva Tecnologia for more analysis on technology applied to business: follow @ElevaTechno on X, @elevatechnologies on Instagram or Eleva Technologies on LinkedIn, or learn more about the group at elevatec.net/about.
