Shadow AI: one in three use AI outside the firm's control

The 2026 figures from the Thomson Reuters Institute are being read one way in the trade press: AI adoption is rising fast. That is true. But the most interesting line in the material is not how many people use AI – it is where they do it.

Usage has outrun governance

In a global survey of 1,800 professionals, one in three lawyers, accountants and compliance professionals report using AI tools their organisation has not approved. That creates a risk exposure the organisation has no way of monitoring, because it does not know the usage exists (Thomson Reuters Institute, June 2026).

Place that next to the adoption numbers: 40 per cent of organisations now use generative AI, close to a doubling year over year (2026 AI in Professional Services Report). In tax and accounting specifically the share is around a third, while 63 per cent are considering or planning to integrate the technology (Thomson Reuters).

That leaves two numbers at roughly the same height: the share of organisations that have adopted AI inside their own frameworks, and the share of professionals using AI outside them. Adoption is happening on two tracks at once – one governed, one not. The second track is as large as the first.

Shadow AI is not disobedience, it is a vacuum

It is tempting to read unsanctioned AI use as a discipline problem. That is almost always the wrong diagnosis.

An accountant who has to explain a variance, build a budget basis or summarise a client's development has a concrete need right now. If there is no approved route from the question to the answer, the work finds an unofficial one. Shadow AI arises in the distance between a real need and a missing standard.

Which also means bans have limited effect. A ban does not remove the need; it moves the usage further out of the firm's line of sight. And "more pilots" does not solve it either – pilots produce experience, not standards.

Regulatory, not technological

For an accounting firm this is a stricter problem than for most other industries, for one reason: the firm does not own the data it processes. It manages it on behalf of the client, under confidentiality obligations, engagement agreements and traceability requirements.

A firm cannot document what happened to client data in a tool it does not know is in use. It cannot answer which model saw which numbers, who asked for it, or what was stored where. That missing documentation is the risk itself – not the AI.

This is why shadow AI in the accounting profession is first and foremost a question of standardisation. It comes down to whether the firm has defined one workflow that is approved, traceable and identical across clients and employees.

The expensive number points to the same gap

The same research links a failure to implement AI to up to 143 billion US dollars of client revenue at risk in the United States alone, and to employees considering leaving (Thomson Reuters Institute).

Note the direction: the risk comes from not implementing, not from implementing. A firm without an approved workflow therefore carries double exposure. It loses the revenue that comes from delivering faster and broader advisory work, and it carries the risk from the usage that happens anyway, uncontrolled.

Agentic AI makes the gap more expensive

The split between generative and agentic AI is where the cost of missing structure becomes visible. Only 15 per cent of organisations have adopted agentic AI, against 40 per cent for generative – while more than 90 per cent of those already using generative AI expect it to become central to their workflow within five years (2026 AI in Professional Services Report). In tax and accounting environments, agentic adoption sits at 14 per cent (Thomson Reuters).

The difference is not accidental. Generative AI tolerates copy-and-paste: a human chooses what gets pasted in and what gets used. Agents do not. They need defined data sources, defined permissions and a defined process in order to act on their own.

A firm that has built its AI usage on unstructured snippets from different systems therefore cannot lift it to agent level. Without structure, an agent is not an assistant – it is an unmonitored process running on client data.

Same cause, same solution

This is where two conversations that accounting firms usually hold separately converge: AI risk on one table, missing advisory revenue on the other.

They share a cause. Advisory work that can be priced and repeated requires the firm to hold client numbers in structured, comparable form – across the client portfolio, not just inside the individual case. Shadow AI arises precisely where those numbers are not available in an approved interface, forcing individuals to improvise their way to them.

It is the same shortfall, seen from two sides. Which makes it the same solution: the firm's own client data, structured, with one workflow approved for AI use.

That is the premise Capassa is built on. Not that AI is new, but that AI on client data has to be standardised to be both profitable and defensible – and that it is the firm, not the individual tool, that must own the structure.

What actually separates firms now

In 2026, "do you use AI?" is no longer a differentiating question. With a third of tax and accounting environments already underway and 63 per cent on the way (Thomson Reuters), the answer will soon be yes everywhere.

The differentiating question is a different one: can the firm show where AI use happens, on which data, in which approved flow – and sell the result as a service?

Firms that can answer that have turned shadow AI into a non-issue and advisory into a product line in the same move. Firms that cannot still hold both problems – and pay for them separately.