Forrester warns of shadow AI surge in Asia Pacific

Forrester has published its 2027 Asia Pacific predictions report, forecasting that one in three large enterprises in the region will uncover at least 10 employee-built shadow AI agents for every officially sanctioned agent.

The report highlights a governance challenge for companies as artificial intelligence tools spread across business units, software products and employee workflows. It says the mix of employee-built agents, embedded software features, business-funded experiments and locally selected platforms will outpace institutional controls.

Forrester argues this will create a new form of AI-driven technical debt, including unmanaged risk, weaker governance, duplicated tools and undocumented dependencies. For executives, the central issue is shifting the focus from the speed of AI deployment to control, governance and accountability.

Shadow AI

The forecast points to growing concern over AI use beyond formal procurement and oversight processes. In practice, internal teams may build or adopt AI agents without approval from central technology, risk or compliance functions.

Forrester says this pattern will be particularly difficult to manage in Asia Pacific, where markets have different regulatory systems, varying levels of AI maturity and distinct approaches to data and technology sovereignty. Those differences could leave multinationals trying to apply a single governance model across markets that require different controls.

Among the report's specific forecasts is that one in five large, regulated enterprises will approve Chinese open-weight models. Forrester links this to a broader shift in sovereignty concerns beyond data residency towards greater control over models and inference.

The report says some organisations may decide that a self-hosted Chinese model meets their operational sovereignty requirements because they can inspect and manage model weights more directly. At the same time, it notes that such decisions could still raise wider geopolitical concerns around provenance.

Consumer tools

Another forecast centres on employees' use of personal AI tools. Forrester predicts that an employee's personal AI agent will trigger an incident at a Fortune 500 company as consumer adoption spills into the workplace.

As the report describes it, personal agents may gain access to corporate devices, credentials and data while performing work-related tasks. Existing security controls often verify identity and access rights rather than the intent behind an action, leaving room for an agent carrying out a benign task to misuse access or expose sensitive information.

This reflects a broader tension for employers trying to benefit from staff familiarity with consumer AI tools while limiting risks tied to unauthorised software, weak audit trails and unclear accountability. It also suggests that security policies built around human users may not translate neatly to software agents acting on their behalf.

Human oversight

The report also predicts that 10 of Asia Pacific's largest consumer-facing brands will seek to stand out through human assurance. In sectors involving financial risk, emotional vulnerability or complex decisions, Forrester expects companies to keep human oversight visible rather than relying on AI-only interactions.

This approach is likely to be most relevant in industries such as financial services and healthcare, where trust, regulation and the consequences of mistakes can directly affect customers. In those sectors, brands will continue to pair AI-led services with access to human experts and licensed advisers.

Frederic Giron, vice president and senior research director at Forrester, said the region's diversity would shape how organisations respond. "In 2027, the challenge for Asia Pacific organizations will be to establish AI governance protocols in a region with distinctly diverse markets, regulatory requirements, and levels of AI readiness," Giron said.

He added that governance would need to reflect local conditions as well as customer expectations. "Organisations that adapt their governance to local sovereignty requirements while investing in building long-term trust and resilience with their customers will be better positioned to capture AI's value," he said.