Shadow AI: your staff are already using it — here's the policy that works

Shadow AI has a simple definition: AI tools your people use for work that the business never approved, doesn't pay for, and can't see. It is not a story about disobedient employees. In Microsoft and LinkedIn's 2024 Work Trend Index — 31,000 knowledge workers surveyed — 75% said they use AI at work, and 78% of those users bring their own tools rather than waiting for the company to provide them. At small and medium-sized companies the figure was 80%. The tools are mostly ordinary: a chatbot in a personal browser tab, a meeting transcriber someone signed up for with a work email, the AI button inside a free app. The problem is not that staff use AI. It's that the business has no say in where its information goes when they do.

Quick answer

• Assume it's already happening. Survey evidence says most AI use at work is self-supplied. Start from "what are people using?" not "is anyone using anything?"

• The real risks are three: confidential and personal data pasted into consumer tools on consumer terms; work product created with no record of how; and decisions influenced by tools nobody chose, checked or can switch off.

• Banning AI doesn't fix it — it moves use to personal phones, where you have no visibility at all. More than half of AI users already hesitate to admit using it on important work; a ban increases the hiding, not the safety.

• The response that works: an amnesty-style inventory, a short approved list running on business accounts with business data terms, three plain data rules, and enforcement that starts only after a sanctioned alternative exists.

• Then write it down and keep it current — the inventory and the rules are the same artifacts a governance program and a certification review ask for anyway.

What actually goes wrong

Data leaves on consumer terms

The exposure is rarely exotic. It's a client contract pasted in for summarising, a spreadsheet of customer details uploaded for cleaning, source code, a disciplinary letter drafted with names left in. Where those words land depends on the tier of account used. Business and API tiers from the major providers generally state that customer data is not used to train models by default. Consumer tiers — the free personal accounts shadow AI runs on — carry different terms, under which inputs may be retained and used to improve the service. The employee can't tell you which terms applied, because they never saw them. Neither can you.

IBM's Cost of a Data Breach Report 2025, produced with the Ponemon Institute, put numbers on the consequence: 20% of the organizations studied had suffered a breach involving shadow AI, and organizations with high levels of it paid on average $670,000 more per breach than those with low or none. The same research found 63% of breached organizations had no AI governance policies at all. Shadow AI is expensive in the cases where it goes wrong precisely because nobody can answer the first questions an incident raises: which tool, whose account, what data, since when?

Decisions happen invisibly

A summarised contract clause, a screened résumé, a drafted response to a complaint — if the tool was never recorded, the business can't show who was responsible for the output, what was checked, or correct the record later. This is the quieter risk, and for most small businesses it's the more common one: not a breach, but work that can't be explained to the client who asks how it was produced.

You can't switch off what you don't know about

No inventory means no off switch. When a tool changes its terms, has its own incident, or turns out to be the wrong choice, an approved tool can be retired in a day. An unknown one keeps running until someone mentions it.

Why the usual responses fail

The total ban. It reads well in a policy document and fails in the building. The productivity gains are why people adopted the tools — Microsoft's respondents said AI saves them time and helps them focus — and a ban without an alternative routes the same behaviour to personal devices and personal accounts, outside even the visibility a work laptop gives you. You end up with the risk and less information about it.

The approved list nobody uses. A list built by procurement criteria alone — price, brand, an enterprise contract — often omits the tool people actually need, or approves a version so restricted it can't do the job. Staff route around it, and you're back to shadow use with better paperwork.

Detection first. Discovery and monitoring tools have a place, on business systems, in proportion. But leading with surveillance teaches the same lesson as the ban: don't get caught. The information you most need — what people use and why — is information only they can give you, and they give it when disclosure is safe.

A policy response that works

Step 1: Run an amnesty inventory

Ask, team by team, with an explicit no-blame framing: "Tell us every AI tool you use for work, including free ones and AI features inside other software. Nothing on this list gets anyone in trouble; it's how we decide what to approve." Ask people before you inspect systems — informal use is exactly what system logs miss. Record each tool in a simple register: tool, what it's used for, who uses it, what data goes in. That register is the foundation artifact — our guide to building an AI inventory covers the full method, including the expense and single-sign-on sweep for the tools nobody mentions.

Step 2: Approve a short list, on business terms

For each real use the inventory surfaced, pick the tool the business will stand behind and put it on a business account: company-managed sign-in, a data-processing agreement where available, and terms under which your data is not used for training. Short is fine — one drafting assistant, one meeting tool, one research tool covers most small businesses. The approved list replaces shadow tools; it doesn't just prohibit them. People give up a tool that works when the replacement works too.

Step 3: Set three data rules

State what may go into an approved tool in three classes, in language a new hire understands:

• Fine: public material and routine internal work with no one's personal or confidential information in it.

• Restricted: business information that may go only into approved tools, only for the purpose they were approved for.

• Never: confidential client information, personal information beyond the immediate purpose, credentials, and anything you would not paste into a stranger's email — into any AI tool, approved or not, without the named owner's say-so.

The "never" class does most of the work. It is also the rule that survives new tools arriving, because it attaches to the data, not the app.

Step 4: Keep a human responsible, and say where AI is used

Two habits close the loop. First, name the person responsible for important decisions — AI output that affects a customer, an employee or a candidate gets reviewed by someone who can change it before it takes effect. Second, disclose AI use where it matters: the chatbot notice, the statement on AI-assisted client work where your terms promise one. Shadow AI thrives in the gap between "we don't really use AI" and the truth; a business that is open about its approved use has far less to hide internally too.

Step 5: Review, don't just enforce

Fold the register into a quarterly review: new tools staff ask to approve (make asking easy, and answer fast — a slow approval process is a shadow-AI generator), tools to retire, incidents to learn from. Our minimum viable governance program sets out that rhythm in full. Enforcement still exists — using a never-class tool with client data is a real disciplinary matter — but it lands on a rule people were given a workable alternative to, which is what makes it stick.

Where certification fits

None of this requires certification. But notice what the five steps produce: an inventory of AI use, an approved-tools rule, data-handling rules, a named human responsible for important decisions, and disclosure habits. That is the same ground the Ethicality AI Use Standard (EAUS) assesses — 15 plain-language requirements built on disclosing meaningful AI use, keeping a person responsible for important decisions, and protecting confidential information. The self-assessment is a free way to check your shadow-AI response against that standard before you commit to anything, and certification turns the result into something a client can verify. Our templates include acceptable-use policy language you can start from.

Frequently asked questions

Is shadow AI really a problem if staff only use free chatbots?

The tool being free is the problem, not the protection. Free consumer accounts are where the weakest data terms sit, and the information staff paste in — client details, internal documents, personal data — doesn't become low-risk because the app is popular. The question is never which chatbot; it's what went into it and under what terms.

Can't we just block AI sites on the company network?

You can block known domains on managed devices, and for the "never" data classes that's a reasonable backstop. It does nothing about personal phones, home laptops or the AI features embedded in software you've already approved — and it tells you nothing about what people were using or why. Blocking is a supplement to the inventory-and-approve approach, not a substitute for it.

How do we find shadow AI without spying on staff?

Ask first, with amnesty — in practice this surfaces most of it, because most shadow use isn't malicious, it's unassisted. Then check the impersonal sources: expense claims and card statements for subscriptions, your identity provider's app list, and the AI features your existing software vendors have switched on. Keep any technical monitoring on business systems, proportionate, and disclosed to staff; covert monitoring creates legal and trust problems of its own.

What's the difference between shadow AI and shadow IT?

Shadow IT is any unsanctioned software; shadow AI is the AI-specific case, and it differs in one way that matters: a storage app holds your data, but an AI tool processes it — potentially retaining it, learning from it under consumer terms, and generating output your business is responsible for. The data exposure and the accountability question arrive together.

Our team is tiny. Do we still need this?

The steps shrink but don't disappear. A five-person firm's inventory might be a twenty-minute conversation and a six-row register; the three data rules fit in a paragraph. The exposure doesn't shrink with headcount — the same client file can be pasted into the same free tool in a firm of five as in a firm of five thousand.

How does this relate to our existing acceptable-use policy?

It usually becomes a section of it: the approved list, the three data classes, the disclosure expectations and the route for getting a new tool approved. Our templates page carries starting language for exactly that section.

Start with what's already in the building

Shadow AI is not a discipline problem to be caught; it's an adoption fact to be governed. Inventory it without blame, approve the tools people actually need on terms the business can stand behind, set data rules in plain language, and keep a human responsible for what the tools produce. Do that, and the shadow mostly disappears — because there's no longer anything to hide in it.