{"id":"https://openalex.org/W7153802829","doi":"https://doi.org/10.5281/zenodo.19545237","title":"Shadow AI v2: The Invisible Compliance Crisis in Enterprise AI Adoption How Unmonitored Employee AI Usage Creates Hidden Liability, Regulatory Exposure, and Data Sovereignty Failure","display_name":"Shadow AI v2: The Invisible Compliance Crisis in Enterprise AI Adoption How Unmonitored Employee AI Usage Creates Hidden Liability, Regulatory Exposure, and Data Sovereignty Failure","publication_year":2026,"publication_date":"2026-04-12","ids":{"openalex":"https://openalex.org/W7153802829","doi":"https://doi.org/10.5281/zenodo.19545237"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.19545237","doi":"https://doi.org/10.5281/zenodo.19545237","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.19545237","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.19545237","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126717681","display_name":"Ramakrishna Semaladhari","orcid":"https://orcid.org/0000-0002-0875-5075","observed_orcids":["https://orcid.org/0000-0002-0875-5075"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Semaladhari, Ramakrishna","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5126717681"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T13364","display_name":"Digitalization, Law, and Regulation","score":0.9092000126838684,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T13364","display_name":"Digitalization, Law, and Regulation","score":0.9092000126838684,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.05350000038743019,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11572","display_name":"Information Technology Governance and Strategy","score":0.005900000222027302,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/shadow-ai","display_name":"shadow AI","score":0.9399999976158142},{"id":"https://openalex.org/keywords/generative-ai","display_name":"generative AI","score":0.6769999861717224},{"id":"https://openalex.org/keywords/ai-governance","display_name":"AI governance","score":0.8050000071525574},{"id":"https://openalex.org/keywords/data-exfiltration","display_name":"data exfiltration","score":0.7760000228881836},{"id":"https://openalex.org/keywords/data-sovereignty","display_name":"data sovereignty","score":0.6129999756813049},{"id":"https://openalex.org/keywords/regulatory-compliance","display_name":"regulatory compliance","score":0.7710000276565552},{"id":"https://openalex.org/keywords/data-protection-law","display_name":"data protection law","score":0.7139999866485596},{"id":"https://openalex.org/keywords/ai-containment","display_name":"AI containment","score":0.5320000052452087},{"id":"https://openalex.org/keywords/digital-personal-data-protection-act-2023","display_name":"Digital Personal Data Protection Act 2023","score":0.8569999933242798}],"concepts":[{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.6746000051498413},{"id":"https://openalex.org/C117797892","wikidata":"https://www.wikidata.org/wiki/Q286363","display_name":"Shadow (psychology)","level":2,"score":0.6338000297546387},{"id":"https://openalex.org/C196879817","wikidata":"https://www.wikidata.org/wiki/Q872685","display_name":"Data governance","level":4,"score":0.5382000207901001},{"id":"https://openalex.org/C2776007630","wikidata":"https://www.wikidata.org/wiki/Q2798912","display_name":"Accountability","level":2,"score":0.5378999710083008},{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.49900001287460327},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.48890000581741333},{"id":"https://openalex.org/C2778221768","wikidata":"https://www.wikidata.org/wiki/Q8964474","display_name":"Risk governance","level":3,"score":0.4325999915599823},{"id":"https://openalex.org/C199776023","wikidata":"https://www.wikidata.org/wiki/Q202875","display_name":"Negotiation","level":2,"score":0.39719998836517334},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.37470000982284546},{"id":"https://openalex.org/C189922023","wikidata":"https://www.wikidata.org/wiki/Q17056348","display_name":"Information governance","level":4,"score":0.3695000112056732},{"id":"https://openalex.org/C39549134","wikidata":"https://www.wikidata.org/wiki/Q133080","display_name":"Public relations","level":1,"score":0.35839998722076416},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.3411000072956085},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3111000061035156},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3046000003814697},{"id":"https://openalex.org/C34974158","wikidata":"https://www.wikidata.org/wiki/Q131257","display_name":"Intellectual property","level":2,"score":0.30309998989105225},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.302700012922287},{"id":"https://openalex.org/C186229450","wikidata":"https://www.wikidata.org/wiki/Q42008","display_name":"Sovereignty","level":3,"score":0.2994999885559082},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.28769999742507935},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.28200000524520874},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28110000491142273},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.2799000144004822},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.2759999930858612},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2727999985218048},{"id":"https://openalex.org/C190253527","wikidata":"https://www.wikidata.org/wiki/Q295354","display_name":"Law and economics","level":1,"score":0.2720000147819519},{"id":"https://openalex.org/C33676613","wikidata":"https://www.wikidata.org/wiki/Q13415176","display_name":"Dimension (graph theory)","level":2,"score":0.271699994802475},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.2669999897480011},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.2522999942302704}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.19545237","doi":"https://doi.org/10.5281/zenodo.19545237","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.19545237","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},{"id":"doi:10.5281/zenodo.19545238","doi":"https://doi.org/10.5281/zenodo.19545238","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.19545238","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"}],"best_oa_location":{"id":"doi:10.5281/zenodo.19545237","doi":"https://doi.org/10.5281/zenodo.19545237","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.19545237","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article-journal"},"sustainable_development_goals":[{"display_name":"Peace, justice, and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.9200000166893005}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7150001652","https://openalex.org/W7212111346","https://openalex.org/W7161601464","https://openalex.org/W7172211860","https://openalex.org/W7125185278","https://openalex.org/W4411610361","https://openalex.org/W7127161588","https://openalex.org/W7163350822","https://openalex.org/W7166656888","https://openalex.org/W7166358583"],"abstract_inverted_index":{"Shadow":[0,53,83,175,196],"AI":[1,16,35,54,66,73,84,102,162,176,197,215,237],"has":[2],"emerged":[3],"as":[4],"one":[5],"of":[6,52,78,144,214],"the":[7,50,123,126,129,142,145,154,211,230],"most":[8],"significant":[9],"yet":[10],"under-recognised":[11],"governance":[12,89,156,168,204,216],"risks":[13,90],"in":[14],"enterprise":[15],"adoption.":[17,238],"While":[18],"organisations":[19,226],"increasingly":[20],"deploy":[21],"artificial":[22],"intelligence":[23],"systems":[24],"for":[25,170,225],"productivity":[26],"and":[27,71,88,104,110,135,153,173,181,201,217],"decision":[28],"support,":[29],"employees":[30],"simultaneously":[31],"integrate":[32],"external":[33],"generative":[34,65],"tools":[36],"into":[37],"everyday":[38],"workflows":[39],"without":[40],"formal":[41],"approval,":[42],"monitoring,":[43],"or":[44],"contractual":[45],"governance.":[46],"This":[47,207],"paper":[48,165],"analyses":[49],"phenomenon":[51],"Version":[55],"2,":[56],"a":[57,167,190,195,202,222],"new":[58],"phase":[59],"characterised":[60],"by":[61,235],"prompt-driven":[62,191],"data":[63,95,192],"exfiltration,":[64],"workflow":[67],"embedding,":[68],"agentic":[69],"automation,":[70],"cross-platform":[72],"integration.":[74],"Unlike":[75],"earlier":[76],"forms":[77],"unsanctioned":[79],"technology":[80],"use,":[81],"modern":[82],"introduces":[85,186],"complex":[86],"legal":[87],"including":[91,121,189],"regulatory":[92,116],"exposure":[93],"under":[94],"protection":[96],"laws,":[97],"intellectual":[98],"property":[99],"leakage":[100],"through":[101,177],"prompts,":[103],"accountability":[105],"gaps":[106],"between":[107],"organisational":[108,182],"security":[109],"privacy":[111],"functions.":[112],"The":[113,164],"research":[114,208],"examines":[115],"responses":[117],"across":[118],"multiple":[119],"jurisdictions":[120],"India,":[122],"European":[124],"Union,":[125],"United":[127,130],"Kingdom,":[128],"States,":[131],"Singapore,":[132],"Australia,":[133],"Canada,":[134],"Japan.":[136],"Particular":[137],"attention":[138],"is":[139],"given":[140],"to":[141,160,210,228],"implications":[143],"Digital":[146],"Personal":[147],"Data":[148],"Protection":[149],"Act":[150],"2023":[151],"(India)":[152],"emerging":[155,212],"blind":[157],"spot":[158],"related":[159],"employee-driven":[161],"usage.":[163],"proposes":[166],"architecture":[169],"detecting,":[171],"assessing,":[172],"containing":[174],"integrated":[178],"security,":[179],"privacy,":[180],"oversight":[183],"mechanisms.":[184],"It":[185],"practical":[187],"frameworks":[188],"exfiltration":[193],"model,":[194],"containment":[198],"programme":[199],"roadmap,":[200],"CISO\u2013DPO":[203],"convergence":[205],"model.":[206],"contributes":[209],"field":[213],"institutional":[218],"risk":[219],"management,":[220],"providing":[221],"structured":[223],"framework":[224],"seeking":[227],"manage":[229],"invisible":[231],"compliance":[232],"crisis":[233],"created":[234],"unmonitored":[236]},"counts_by_year":[],"updated_date":"2026-10-28T10:33:24.094632","created_date":"2026-04-13T00:00:00"}