Shadow AI at work: the tools your staff are already using
Ask your team whether they use AI at work and you may get a polite “no”. Ask them what they do when they need to summarise a long document or draft a tricky email, and the answer changes. This is shadow AI: AI tools used without the business knowing or approving them.
Why it happens
Nobody is trying to cause harm. The tools are free or cheap, they work in a browser, and they save real time. If the business has not given people an approved option, people find their own.
Banning AI outright rarely works. It drives the habit out of sight, which is worse.
What can go wrong
Data leaves the building. When someone pastes a client contract, a spreadsheet of customer details or source code into a public AI tool, that information goes to a third party. Depending on the service and the settings, it might be stored, reviewed by people or used to improve the product.
UK GDPR. If the text includes personal data, you are responsible for how it is used. You need a lawful reason, you need to know where it goes, and you may need a contract with the provider. The Information Commissioner’s Office (ICO) has published guidance on AI and data protection that is worth reading.
Wrong answers. AI tools can sound confident and still be wrong. A made-up figure in a quote or a misread contract clause can cost you.
Unapproved apps and browser extensions. Some “AI assistants” are plug-ins that read everything on a page, including your email or customer system. These can be used to harvest data.
Copyright and confidentiality. Putting someone else’s confidential material into a tool may breach an agreement you have with them.
Four steps that work
1. Find out what is already happening
Ask, without blame. A short, anonymous survey tells you which tools people use and what for. Your IT provider can also check web traffic and the apps connected to your Microsoft 365 or Google accounts to see which AI services are in use.
2. Offer an approved option
Pick one or two tools and make them easy to use. If you are on Microsoft 365, Copilot works inside your existing permissions and, with the right licence, keeps your prompts and data within your Microsoft 365 service boundary. Check the current terms for your plan. Before you roll it out, tidy your file permissions, which we cover in SharePoint permissions and Copilot.
3. Write a one-page policy
Keep it short enough that people read it. Cover:
- Which tools are approved, and for what
- What must never be pasted in: customer or staff personal data, passwords, contracts, unreleased financials, source code
- That a person is always responsible for checking AI output before it is used
- Who to ask if you are not sure
4. Put technical guardrails in place
- Block or restrict risky tools and browser extensions where it makes sense
- Use data loss prevention (DLP) rules to warn people when they try to share sensitive data
- Make sure staff use work accounts, not personal ones, so you can manage and remove access
- Review which third-party apps are allowed to connect to your accounts
Your managed IT provider can set most of this up. Our managed IT service includes this kind of ongoing configuration and review.
Make it a conversation, not a crackdown
The best results come when people understand why. Explain the risks with real examples, and make clear that the aim is to use AI safely, not to stop using it. People who feel trusted are more likely to ask before they paste.
Where it fits in your security plan
Shadow AI is one more place where data can leak, alongside email mistakes and lost devices. It belongs in your wider approach to protection, which we describe in our cyber security hub. If you are also thinking about how staff sign in to these tools, our piece on passkeys is a good next read.
Want help putting an AI policy and controls in place? Talk to us about cyber security.
