October 22, 2026·9 min read· AI· Finance

Shadow AI in finance: the new risk beyond Excel

By Michel Escoda — Independent Architect & SAP FICO Consultant

Summary

Finance teams already run AI the organisation cannot see: unsanctioned assistants shaping reconciliations, variance commentary and board packs with no inventory and no audit trail. It is the spreadsheet era returning, except the logic is now invisible rather than merely buried in a formula. Banning fails because the tools are embedded in the software finance already owns; the workable answer is to name what is in use, trace what touches financial data, and govern the output rather than police the tool.

The finance department has been running an ungoverned AI experiment for two years now, and the industry response is to give it a scary name and hope it goes away. Shadow AI. The phrase makes it sound like a problem of discipline, a few rogue analysts pasting numbers into ChatGPT. It is not. Shadow AI is the Excel problem coming back with the one property that made Excel tolerable removed: visibility.

Let me start with the number that should bother you. Research on spreadsheet errors has been consistent for decades: around 88% of spreadsheets contain errors, with a formula error rate above 1%. Finance has absorbed that for thirty years. JP Morgan lost six billion dollars on a spreadsheet-driven VaR model. Fannie Mae restated 1.2 billion on spreadsheet errors. The system absorbed it, because spreadsheet errors are visible. A bad formula shows up as a red cell, a #REF, a number that does not tie. You can audit an Excel model line by line, and the error is findable.

AI output does not look like that. It looks authoritative. A polished variance commentary, a clean narrative, a confident number, all of it generated by something that can be wrong in ways no one is trained to see. The error class changes from "visible formula bug" to "invisible hallucination," and the scrutiny goes down exactly when the stakes go up.

The workbench reality nobody puts in the deck

Here is what I see when I look at real finance departments, and it is the thing the governance decks skip. The ERP is the system of record, and the work happens outside it. S/4HANA holds the books; the analysis happens in Excel workbooks fed by ERP extracts, in whatever BI tool the controller prefers, in the analyst's personal model that everyone knows exists. The Association for Financial Professionals reports that 96% of FP&A teams use spreadsheets for planning and 93% for reporting. Excel is not going away, and the AI is being layered on top of it.

Shadow AI did not create the bypass. It automated it. The agents sitting on those extracts, whether they are sanctioned Copilot in Excel or an unsanctioned ChatGPT session with pasted extracts, inherit a spreadsheet layer that was never under governance. That is the uncomfortable sentence: your shadow AI risk is your Excel risk, with the error rate of the spreadsheet layer baked in and the visibility removed.

The adoption numbers show which way the current flows. Only 40% of companies have purchased official LLM subscriptions, while employees in more than 90% of companies regularly use personal AI tools for work. The sanctioned initiatives sit in pilots; the unsanctioned usage compounds. Fifty-eight percent of finance professionals use AI at work; only 37% of companies have an official implementation plan. That 21-point gap is the shadow, and it is growing. The reasons people give are human and familiar: "I use my own device, so I thought it was fine," "I was not aware approval was needed," "the approval process is too slow." The last one is the one to take seriously, because it is a verdict on the sanctioned path, and it is the reason a ban without a better alternative fails before it starts.

Why the controls you have do not reach it

The control environment in a serious SAP shop is built for the ERP. Segregation of duties, change documents, approval workflows, audit trails on every posting. An auditor can trace a journal entry in FI to the user, the time, the reason code. None of those controls extend to the AI tool that produced the variance narrative the controller signed. The chain of custody breaks at the exact point where the analysis becomes a number in a board pack.

Hidden complexity — the visible monitored tools above the waterline, the ungoverned majority below

Reco's audits of financial institutions found ungoverned AI tools outnumbering monitored ones by about four to one, and the unsanctioned tools are not doing low-stakes work. They are drafting SAR narratives, structuring AML case notes, generating risk assessments. These are decision-adjacent workflows where the draft is the decision under review pressure. The "humans review everything" assumption fails precisely there.

The regulatory world has noticed, and the framing matters. The Federal Reserve's revised SR 26-2 guidance treats AI that shapes human judgment in regulated workflows as model risk, even when it is not a full model. Apply that logic to a finance department and every unsanctioned AI tool touching financial data is an unvalidated model feeding material decisions. The question becomes who owns it, and most finance teams cannot answer even the inventory question: nobody has a complete list of which tools touch their data. You cannot govern what you cannot name.

The European path is slower but points the same way. The EU AI Act's high-risk financial AI obligations, originally due in August 2026, are proposed for delay to December 2027 through the Digital Omnibus, and the second trilogue ended without agreement in April 2026. The Financial Stability Board flagged the concerns back in November 2024: third-party concentration, cyber risk, model risk, and weak governance across the financial system. The regulation is coming; the only open question is which jurisdiction bites first and how a finance department evidences compliance for a set of tools it cannot inventory. And the breach data says the exposure is already here, not coming: one in five organizations has already suffered a breach caused by employees using AI tools no one approved, per IBM's 2025 cost of a data breach report.

Banning is the wrong tool, and the data says so

The instinctive response, block ChatGPT, block the sites, send the memo, fails on the evidence. 78% of employees use AI tools IT has not approved, and 46% say they would continue even if explicitly prohibited. Sixty-nine percent of the C-suite finds unsanctioned use acceptable, which tells you the tone from the top is not what the memo says. Block the corporate network and the usage moves to phones and personal accounts. You cannot ban your way out of this; you can only push it further into the dark, where you cannot see it at all. The governance numbers make the point sharper: only 15% of organizations have AI governance policies in place, and 38% of employees share confidential data with external AI platforms. Gartner's prediction, that by 2027 around 40% of companies will experience security incidents related to shadow AI, is the bill coming due for that combination.

Tech-world latency — the adoption clock running ahead of the governance clock

The "it is just shadow IT, we survived that" argument deserves a fair hearing, because it is the strongest objection. Shadow IT was infrastructure: unpatched software, missing backups, a rogue Dropbox. The risk profile was containment. Shadow AI is decision-making and data exfiltration, and a rogue Dropbox never hallucinated a variance analysis that landed in a board pack. The class of harm is different, and the tolerance finance built for spreadsheets does not transfer.

The honest counterargument, and why it fails

The most honest objection is the one finance people raise quietly: we have lived with an 88% spreadsheet error rate for decades and the company survived, so why panic about AI errors that are no worse? Because of velocity and invisibility, and this is the whole argument in two words. An agent can replicate a bad assumption across two hundred rows in seconds, and the output does not look wrong. The per-cell error rate is not the exposure; the systemic propagation is. One flawed prompt applied to a full dataset produces a coherent, wrong, board-ready number, and nothing about the output signals that it deserves suspicion. The exposure is systemic in a way spreadsheet error never was.

What the vendors are telling you by their moves

Watch what the vendors are racing to build, because it is an admission. Microsoft's "Frontier Finance" push puts Copilot in Excel with finance skills, DCF, close the books, monthly reporting, variance analysis, connectors to LSEG, Moody's, FactSet, and explicit traceability with a "plan before action" step. Workday Adaptive Planning promises scenario models in minutes without spreadsheet wrangling, and its general manager said the honest thing: people have said many times we are going to move people out of Excel, and that never happens.

Read that correctly. The vendors are building the sanctioned AI-Excel layer precisely because the unsanctioned layer exists and is winning. They are competing to govern the workbench, not to replace it. The traceability features are an acknowledgment that the core problem is provenance: where did this number come from, and can we walk it back to the source?

The limits of the vendor answer are worth naming too. A governed AI tool running on the same spreadsheet layer inherits the same base error rate; governance of the tool does not fix the model risk of the layer underneath it. The connector ecosystem also recreates the sprawl with better branding: governed tools, ungoverned analysis chains, assembled ad hoc outside any model validation framework. The tooling is a necessary condition, not a sufficient one.

The three questions that matter

If you are a CFO or a controller and you want to do something that is not a memo, start with three questions, and do not start any AI pilot until you can answer them.

First, do we have an inventory of which AI tools touch financial data today? Not the sanctioned ones, all of them. The Reco finding is that nobody has a complete inventory, and that is the diagnosis. Second, can we trace the lineage of a number from an agent's output back to the ERP extract it came from? If the answer is no, then a material number in the next board pack may be untraceable, and you will discover that at the worst possible moment. Third, what is the approval and fallback path when an agent produces a materially wrong figure? Not if; when. The question is whether the failure is contained or amplified.

The implication that should keep you up

Here is where the contrarian case lands. The spreadsheet era survived because its errors were visible and local. The AI era inherits the same base rate of error and removes the visibility. Finance teams are running this experiment inside their own departments, with their own data, outside any governance, and the output looks more authoritative than the human version ever did. The first restatement traced to an unsanctioned agent will not be a technology story; it will be a control failure story, and the CFO will be asked why the department was running unvalidated models on material data.

The window to fix this is now, and the fix is not a ban. It is inventory, lineage, and a sanctioned alternative good enough that the sanctioned path is also the convenient path. Build the list of what is touching your data. Trace the numbers back. Give the finance team a governed AI-Excel layer with real traceability, and watch the shadow shrink toward what it can always have been: a pilot with permission, instead of an experiment without one.

Sources

Need this in your organisation?

I work with a small number of clients each quarter on ERP strategy and IT-department automation. If the questions raised above are live in your team, get in touch.

Start a conversation →