Shadow IT in the Newsroom: What it is, why it's happening, and how to get ahead of it

Let's start with an uncomfortable question: do you actually know every AI tool being used in your newsroom right now?

Not the ones on the approved list. Not the ones in the training deck from six months ago. The actual tools; the browser extension someone installed to summarise wire copy, the transcription app the video team switched to because it's faster, the chatbot a reporter uses to untangle a court filing at 11pm because asking a colleague felt like admitting they were behind.

If you hesitated, you're not alone. And there's a name for what you're describing: shadow IT. It's not new. IT departments have been fighting it since the first employee smuggled a personal Dropbox account past a firewall. What's new is how fast it's spreading through newsrooms, and how much higher the stakes are when the tool in question can read a leaked document, paraphrase a source's words, or quietly shape a headline.

It's not rebellion. It's a signal.

Here's the thing that gets missed most often: shadow IT isn't really a discipline problem. Almost nobody adopting an unsanctioned tool thinks they're doing anything wrong. They're just trying to hit a deadline, and the approved toolkit didn't get them there fast enough.

That's actually useful information, if you're willing to hear it. Every unofficial tool in your newsroom is a little piece of feedback - a gap between what your team is being asked to do and what they've been given to do it with. Shut down the tool without addressing the gap, and you haven't solved anything. You've just pushed the workaround further underground, where it's harder to see and harder to manage.

We touched on this in our piece on AI governance for newsrooms - the observation that tool approval processes tend to collapse under deadline pressure. Shadow IT is what that collapse looks like in practice. It's the visible symptom of an invisible policy failure.

Why it's accelerating specifically now

Shadow IT has always existed. But three things have converged to make this a genuinely different moment for newsrooms.

First, the tools got good and got personal. Nobody needs procurement's help to sign up for a chatbot. It's a browser tab away, often free, and often better than whatever clunky enterprise system was rolled out eighteen months ago.

Second, newsroom budgets didn't grow to match the pace of AI adoption. Teams are being asked to do more, faster, with the same headcount and AI tools are the obvious pressure valve, sanctioned or not.

Third, and this is the one leaders underestimate, trust in top-down tech rollouts is low. Journalists have sat through enough newsroom “transformation” initiatives that quietly died to be sceptical that this one will be different, or that raising a hand about a useful tool will get anything other than a slow no. So, they stop asking.

The real risk isn't the tool. It's not knowing.

It's tempting to focus on the worst-case headline: sensitive source material pasted into a public chatbot, a plagiarism risk buried in an AI-drafted paragraph, a factual error that slipped through because nobody knew AI was involved in the first place. Those risks are real, and they matter.

But the deeper risk is structural. If you don't know what's being used, you can't know where your actual exposure is. You end up governing the newsroom you think you have, not the one that exists, which means your policy, your training, your entire AI governance conversation is aimed at the wrong target.

This is exactly the layer beneath the governance conversation we've been having on The Signal and in our writing: it's one thing to design oversight structures and approval processes on paper. It's another to build them around what your newsroom is actually doing, which requires first being honest about what that is.

Getting ahead of it doesn't start with a crackdown

The instinct, understandably, is to respond to shadow IT by auditing everything, blocking what's unapproved, and tightening the rules. In our experience, that's usually the fastest way to make the problem less visible and no less real.

The newsrooms that get ahead of this do something almost counterintuitive: they make it safe to surface what people are already using. Not as an amnesty with a wink and a nod, but as a genuine first step, because you cannot build sensible oversight around tools you don't know exist. Once you can see the real picture, the conversation changes entirely. It stops being “how do we stop this” and starts being “which of these are actually worth sanctioning properly, and which ones tell us where our approved toolkit is falling short.”

That's a different kind of project to a policy document. It's closer to an audit, a listening exercise and a redesign, all at once and it's the part most AI governance advice skips entirely, because it's harder to template than a risk framework.

Where this leaves you

If shadow IT is showing up in your newsroom and in almost every newsroom we work with, it already is, that's not a sign your team is being careless. It's a sign they're solving problems faster than your systems can keep up. The newsrooms that recognise this as valuable insight, rather than a disciplinary issue, are the ones that build governance that actually works.

This is a natural companion to our piece on AI Governance for Newsrooms and to the conversations we're having on The Signal. If you're not sure what's really happening across your desks, get in touch - mapping that picture accurately is where we always start.