Shadow AI in portfolio companies: uncontrolled leakage vs a deliberate data license

What is the difference between shadow AI and a deliberate data license?

Shadow AI is company data flowing into third-party AI tools that nobody approved, scoped or contracted. A deliberate license is the opposite: the company chooses which records, under which terms, with which redaction rules, and is paid for it. Same raw material, completely different control.

For a PE operating partner, the distinction matters in two places. In diligence and 100-day reviews, uncontrolled exposure is a finding. In the value creation plan, a scoped license is an option the company can pursue on its own terms. This guide separates the two so you can raise the first without confusing it with the second.

How does shadow AI show up in a portfolio company?

It rarely looks like a decision. It looks like a helpful shortcut.

• A support lead pastes a long customer thread into a public chatbot to draft a reply.
• An engineer sends a code block with internal logic to an assistant to debug it.
• A finance analyst uploads a contract or a board deck to summarize it.
• A sales team installs a note-taking bot on customer calls without telling IT.
• A browser extension reads whatever is on screen, in every tab.

None of these requires malice. Each can move customer records, source code or contract terms outside the company's control, under consumer terms of service nobody read.

What should diligence and 100-day reviews ask?

Ask for facts that a CFO or IT lead can answer in a day. The goal is an inventory of exposure, not an accusation.

The FTC has said in staff guidance that a company's promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable commitments, as set out in its post on privacy and confidentiality commitments. That is a reason to read what the company promised its own customers before anyone decides what may go into an AI tool. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Why is a license not the same as leakage?

A license is bounded in ways shadow AI is not. Compare them side by side.

A license is not an amnesty for past leakage. If records already went into a third-party tool, that is a governance issue to fix separately, with counsel. It also does not mean every company should license. The point is narrower: a company that has decided its records have value can capture it deliberately, rather than give it away by accident.

How does the contrast help in a portfolio conversation?

Frame it as one question with two halves. First, do we know where our data is going? Second, if records have value, do we decide who gets them?

The first half is a compliance task and the second is a value creation option, so raising both together keeps the conversation from sounding like a warning. The referral opportunities for private equity operating partners page explains how a sponsor can place the second half into a plan. For software holdings under pricing pressure, the SaaSpocalypse explainer covers adjacent options.

Which portfolio companies should you screen for a license?

Not every company with shadow AI exposure qualifies, and not every qualifying company has exposure. Screen on the baseline.

1. Confirm the company is a US business with 50+ full-time employees at peak (contractors excluded) and several years of documented operations.
2. Ask whether it keeps records across many systems; strong companies often use 10-15+ of them, and long histories and archived systems help.
3. Check rights: did the company create the records, and do customer contracts and employee notices allow licensing?
4. Check that nobody has already licensed the same data for AI training.
5. Confirm an authorized sponsor exists and would consider an exclusive license for AI training for an agreed term.

The company fit checker runs a preliminary, non-binding version of this screen with no contact details required, and the who qualifies page lists the full baseline. For the basics of the market itself, see how to sell data to AI companies.

What do you say to the CEO?

Lead with control, not fear.

If the CEO wants to share a news hook with their board or an owner, the email template for sharing an AI data headline with a client gives a neutral way to do it without promising an outcome.

How do partner rewards work here?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; a lead, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. It is a share of SourceX's fee and is never deducted from what the company receives.

Check your firm's own policies on accepting fees connected to portfolio companies before you register, and read the program terms.

When is a license the wrong answer?

• The records mainly belong to the company's clients and those clients have not agreed.
• The data is mostly consumer personal information or protected health information without a licensing basis, HIPAA authorization or de-identification.
• Archives were deleted, or nobody can export the data.
• A court, trustee or assignee controls the assets and has not been involved.
• The same data has already been licensed for AI training.
• The owner will not consider an exclusive license.

Next step

Run the exposure questions above in your next portfolio review, and screen one company for the license. If it fits, register as a partner and make the introduction, or point the CEO to sourcex.si/apply.