# Shadow AI Sector Policy Statistics

Version 1.0.0. Snapshot of 26 September 2026.

How strictly should an organisation treat AI tools? The answer depends on the sector. This dataset gives the recommended share of AI tools to block, control or allow in 15 sectors, all applied to the same 11,959 AI tools. It also includes the AI tool taxonomy and data-use policy statistics that give those numbers context.

It is published by Shadow AI Tools, a service for [shadow AI detection and audit](https://www.shadowaitools.com/) in existing network logs.

The release contains **no domains and no per-tool verdicts**. Every file holds category names, counts or shares.

## Sector verdicts at a glance

| Sector | Block | Controls | Allow |
|---|---:|---:|---:|
| Defense & critical infrastructure | 81.6% | 18.3% | 0.1% |
| K-12 schools | 73.9% | 25.9% | 0.2% |
| Government & public sector | 49.6% | 50.0% | 0.4% |
| Banks & financial services | 48.1% | 50.6% | 1.3% |
| General business | 13.1% | 62.4% | 24.5% |
| Software & technology companies | 11.3% | 43.4% | 45.3% |
| Marketing, media & creative agencies | 8.5% | 41.6% | 49.9% |

All 15 sectors are in `sector-verdicts.csv`.

- **Block.** The tool should not be reachable from the organisation's network.
- **Controls.** Allowed only with conditions, such as a business account, single sign-on, data-loss inspection or logging.
- **Allow.** No special handling needed.

## Findings worth noting

- **The same tools, very different answers.** Marketing agencies block 8.5% of AI tools; defense organisations block 81.6%.
- **"Controls" is the most common verdict in 11 of 15 sectors.** Most organisations do not need to choose between banning AI and allowing everything.
- **Most AI tools state no training policy.** Of 8,811 tools with a known policy, 73% state nothing about training on customer data.

## Files

| File | Content |
|---|---|
| `sector-verdicts.csv` | 15 rows: block, controls and allow counts and shares per sector |
| `ai-tools-taxonomy.csv` | 165 rows: AI tool category, subcategory and number of tools labelled with it |
| `category-summary.csv` | 18 rows: tools per category and the AI-native / AI-enabled split |
| `training-default-by-category.csv` | 18 rows: whether tools train on customer inputs by default, per category |
| `data-use-policy-by-category.csv` | Four data-use policy fields by category, long format |
| `data-use-policy-summary.csv` | The four data-use policy fields across all tools with a known policy |
| `DATA_DICTIONARY.md` | Every column and value explained |
| `CITATION.txt`, `LICENSE.txt`, `CHANGELOG.md` | Citation, licence and version history |
| `manifest.json`, `SHA256SUMS` | File sizes and checksums |

## Who this is for

- **Policy researchers** comparing how sectors approach generative AI.
- **CISOs and compliance teams** benchmarking their own AI policy against a sector norm.
- **Educators and auditors** looking for concrete numbers on [sanctioned AI tools by sector](https://www.shadowaitools.com/ai-policy-profiles.php).

## Related datasets and services

- **The AI tools themselves.** Tools and categories come from the register behind an [AI chat block list](https://www.aitoolsblocklist.com/) and its 18-category taxonomy.
- **Schools.** K-12 is the second strictest sector here. For everything beyond AI, [k12 web filtering](https://www.webfilteringdatabase.com/categories-web-filtering.php) categories cover the rest of the web.
- **Topic labels.** A [site categorization API](https://www.websitecategorizationapi.com/api-docs.php) returns IAB content topics for domains that are not AI tools.
- **Offline data.** Research on [classifying websites](https://www.urlcategorizationdatabase.com/) at scale can use downloadable URL category files.
- **Agents.** Policies for autonomous agents follow the same logic at page level; see the [zero trust AI agent](https://www.aiagentallowlist.com/) approach of AI Agent Allow List.

## Limitations

- Sector verdicts are recommended defaults, not measurements of what organisations actually do.
- All sectors are applied to the same 11,959 active tools on the snapshot date. The register changes daily.
- Data-use values describe stated policies, not observed behaviour.
- Counts only: the dataset does not say which tool received which verdict.

## Citation

Alpha Quantum (2026). *Shadow AI Sector Policy Statistics* (Version 1.0.0). Shadow AI Tools. Figshare.

Include the DOI shown on the Figshare record.

## Licence

Creative Commons Attribution 4.0 International (CC BY 4.0). See `LICENSE.txt`.