Shadow AI: The Silent Risk Stalking India's IT and GCC Corridors

Walk into any global capability centre (GCC) in Bengaluru, Hyderabad, or Pune today, and you will find engineers quietly pasting code snippets into free AI chatbots, analysts feeding spreadsheets into unapproved copilots, and recruiters running candidate résumés through tools not vetted by the security team. 

This is shadow AI: the unsanctioned use of generative AI tools by employees, often with good intentions and little awareness of the consequences.

The consequences can be colossal. In 2023, Samsung Electronics banned employees from using ChatGPT and Gemini Bard after engineers pasted proprietary semiconductor and hardware source code into ChatGPT to fix software bugs, upon discovering that its sensitive internal code was leaked.

The numbers back that growing concern. A recent global survey of 300 enterprise decision-makers by security platform provider WitnessAI found that over 40% of respondents reported AI-related incidents costing their organisations $2 million or more in the past year. 

Strikingly, WitnessAI's respondents named IT and infrastructure teams, the very departments meant to police AI use, as the biggest source of shadow AI activity.

For India's technology services and GCC ecosystem, this finding lands close to home. Organisations are rapidly integrating AI across projects and business functions, yet only a few have responsible AI governance controls in place. 

According to the Nasscom-Zinnov GCC Landscape Report, more than 1,200 GCCs have already embedded AI and machine learning capabilities. 

That scale of AI adoption, layered onto a workforce under constant delivery pressure, creates exactly the conditions in which shadow AI thrives.

"In an outsourcing hub like ours, a single careless prompt can expose a client's source code or customer database to a public model, and the client will hold the vendor accountable, not the individual employee who typed it in. We are seeing engineering teams adopt copilots faster than our compliance teams can even map them," Ravi Kumar, a Chennai-based AI governance consultant and shadow AI auditor, tells AIM.

Adoption vs Governance

Kumar’s point captures a tension unique to Indian IT and GCC operators: they don't just carry their own regulatory exposure; they carry it on behalf of global clients who expect airtight data handling. In contrast, while access to AI tools has surged, governance frameworks expected by clients have struggled to keep pace.

Many of these centres operate under strict contractual clauses that predate the generative AI boom, leaving legal teams scrambling to interpret decade-old data processing agreements against today's AI-first workflows. 

The arrival of India's Digital Personal Data Protection Act adds a further layer of complexity, since unauthorised transfer of personal data to public AI platforms could now trigger direct compliance liability alongside contractual breach.

"Boards ask us who owns AI risk, and half the time the honest answer is nobody. Security says it's a business decision, business says it's a security matter, and legal is still reading the fine print on the vendor's terms of service. Until that ownership question is settled, shadow AI will keep growing in the gaps," observes Arwinder Kaur, VP of Marketing, Grazitti Interactive, SearchUnify.

Kaur’s frustration echoes a broader perception gap that WitnessAI also highlighted in its survey. Around 68% of C-suite respondents said they felt confident about their visibility into the AI tools, models, and agents touching company data, yet only 46% of vice-president-level respondents shared that confidence. 

“The organisations with the highest exposure are often the ones most aggressively promoting AI adoption. The very enthusiasm that is meant to result in productivity gains and build competitive advantage—without guardrails—is creating a governance vacuum that employees fill with their own judgement,” she says.

Real-World Risks

A recent IBM report on the cost of data breaches in India found that the average total organisational cost of a data leak reached an all-time high of ₹25.5 crore, out of which shadow AI added ₹1.7 crore—making it one of the top three cost-increasing factors in India.

For India's software product companies, the risk cuts differently, touching intellectual property rather than client data. Industry estimates compiled by Technology Radius suggest that personally identifiable information features in around 65% of shadow AI-related incidents, with intellectual property involved in roughly 40% of cases.

Meanwhile, startups racing to ship features frequently see developers leaning on AI coding assistants that quietly retain snippets of proprietary logic, sometimes without anyone realising.

"Our developers aren't being reckless; they are simply trying to move fast, and the free AI tool is right there in the browser. The fix isn't a lecture on policy; it's giving people a sanctioned, equally fast alternative before they go looking for one themselves," says Midhun K, Founder of Dubai-based Polaris Infotech.

Midhun’s argument points to a growing consensus among Indian technology leaders: banning shadow AI outright rarely works, because it does not address the underlying productivity pressure driving employees towards unsanctioned tools in the first place. 

WitnessAI's chief executive, Rick Caccia, made a related point in comments to trade publication Channel Dive, noting that visibility, not restriction, is the more realistic starting point for enterprises trying to regain control.

More than half of enterprises surveyed by WitnessAI now dedicate between 21–45% of their AI budgets to risk management and governance, a figure that Indian IT services firms and GCCs are likely to match or exceed as client audits intensify. 

Nasscom's own hiring data reinforces this shift. Mid-to-senior AI, cybersecurity, and platform engineering talent rose from 60% of GCC hiring in 2023 to more than 77% in FY26, according to TeamLease Digital, suggesting Indian employers are investing heavily in the very skills needed to bring shadow AI under control.

For an industry that has built its global reputation on reliability and data discipline, shadow AI represents a test of whether India's IT and GCC sector can govern the technology it has been quickest to adopt.