Shadow AI in LATAM: 73% of Certified Organizations Run AI Without Oversight

A survey of 140 organizations with active ISO 27001 certification across Argentina, Brazil, Colombia, Mexico, and Peru found that 73% have at least one generative AI tool in operational use without formal security function approval. The departments with the highest unauthorized adoption are Marketing (89%), Human Resources (71%), and Finance (54%). The most common tools are ChatGPT (direct use without corporate API), unlicensed Copilot, and language model automations embedded in spreadsheets. 61% of ISO 27001:2022 Annex A controls related to asset management and access control proved insufficient to detect these tools because they do not recognize AI assets as a category. Four primary data leakage vectors were identified: prompts containing confidential client data (42%), uploading internal documents to public AI platforms (38%), using AI to generate code with embedded sensitive data (12%), and automations sending data to external APIs without logging (8%). The remediation model developed classifies Shadow AI into three risk tiers and proposes controls compatible with ISO 27001 and ISO 42001 without restricting productivity.