# Shadow AI Sector Policy Statistics

Version 1.2.1. Snapshot of 26 September 2026.

How strictly should an organisation treat AI tools? The answer depends on the sector. This dataset gives the sector data behind the working paper *Same Tools, Different Rules: Generative AI Acceptable-Use Policies Across Fifteen Sectors, with a Complete Policy Matrix for K-12 Schools* (https://www.shadowaitools.com/papers/sector-ai-policy-profiles-2026.pdf): fifteen sector acceptable-use profiles, from K-12 schools to defense, applied to the same 11,890 AI tools, with the complete K-12 rule set.

It is published by Shadow AI Tools, a service for [shadow AI detection and audit](https://www.shadowaitools.com/) in existing network logs. The AI tool taxonomy and the vendor training-policy statistics that the profiles build on are a separate dataset: AI Tools Taxonomy and Training-Policy Statistics, https://doi.org/10.21227/hrxe-fa21.

The release contains **no domains and no per-tool verdicts**. Every file holds rules, category names, counts or shares.

## Sector verdicts at a glance

| Sector | Block | Controls | Allow |
|---|---:|---:|---:|
| Defense & critical infrastructure | 81.6% | 18.2% | 0.2% |
| K-12 schools | 71.5% | 28.3% | 0.2% |
| Government & public sector | 49.3% | 50.1% | 0.7% |
| Banks & financial services | 46.5% | 52.2% | 1.2% |
| Insurers & brokers | 45.6% | 53.2% | 1.2% |
| Healthcare | 45.5% | 53.4% | 1.2% |
| Pharma & life sciences | 44.4% | 54.8% | 0.8% |
| Law firms | 43.0% | 52.9% | 4.1% |
| Accounting & tax firms | 39.2% | 55.9% | 5.0% |
| MSP default (managed clients) | 34.3% | 58.1% | 7.6% |
| Manufacturing & engineering | 31.3% | 42.0% | 26.7% |
| General business | 14.7% | 59.0% | 26.3% |
| Higher education | 13.1% | 41.9% | 45.0% |
| Software & technology companies | 12.9% | 40.3% | 46.9% |
| Marketing, media & creative agencies | 10.0% | 35.5% | 54.5% |

- **Block.** The tool should not be reachable from the organisation's network.
- **Controls.** Allowed only with conditions, such as a business account, single sign-on, data-loss inspection or logging.
- **Allow.** No special handling needed.

## Findings worth noting

- The share of tools blocked ranges from 10.0% (Marketing, media & creative agencies) to 81.6% (Defense & critical infrastructure).
- "Allow with controls" is the most common verdict in 10 of 15 sectors.
- Two sectors picked at random disagree on 41.3% of tools on average; only 13.4% of tools receive the same verdict in all fifteen.
- Under the K-12 profile, 35.4% of verdicts are set by a subcategory rule rather than a category default.

## Files

| File | Content |
|---|---|
| `sector-verdicts.csv` | 15 rows: block, controls and allow counts and shares per sector, with a strictness level |
| `sector-category-defaults.csv` | The baseline verdict of every sector for each of the 18 categories (15 x 18 rules) |
| `sector-category-verdicts.csv` | Final verdict counts per sector and category, after subcategory rules and tool attributes |
| `sector-pairwise-disagreement.csv` | 105 rows: for every pair of sectors, how many tools get a different verdict |
| `verdict-agreement-across-sectors.csv` | How many tools get 1, 2 or 3 distinct verdicts across the 15 sectors |
| `k12-category-rules.csv` | The K-12 default and final verdict counts for each of the 18 categories, with the rationale |
| `k12-subcategory-rules.csv` | The K-12 rule for all 165 subcategories: whether it departs from the category default, how many tools carry the label, the final verdicts and the rationale |
| `k12-decision-layers.csv` | Which layer decides the K-12 verdict (hard block, subcategory rule, category default) |
| `DATA_DICTIONARY.md` | Every column explained |
| `CITATION.txt`, `LICENSE.txt`, `CHANGELOG.md` | Citation, licence and version history |
| `manifest.json`, `SHA256SUMS` | File sizes and checksums |

## Method in brief

Each sector profile is a set of layered rules over a functional taxonomy of AI tools (18 categories, 165 subcategories): hard blocks that apply everywhere (for example tools built for abusive purposes), sector subcategory rules, cross-sector subcategory rules and a category default, adjusted by tool attributes such as AI-native or AI-enabled, risk level, data-sovereignty exposure and the vendor's stated training policy. The full method is in the working paper.

## Limitations

- The profiles are normative: they encode one reading of sector guidance and are not a survey of what organisations actually do.
- All sectors are applied to the same 11,890 active tools on the snapshot date. The register changes daily.
- Counts only: the dataset does not say which tool received which verdict.

## Citation

Alpha Quantum (2026). *Shadow AI Sector Policy Statistics* (Version 1.2.1). Shadow AI Tools. https://www.shadowaitools.com/shadow-ai-sector-policy-dataset.php

## Licence

Creative Commons Attribution 4.0 International (CC BY 4.0). See `LICENSE.txt`.