Shadow AI is already in your business. Here's what to do about it.

Here's a small experiment. Ask five people on your team, casually, whether they've used ChatGPT, Copilot, Gemini or Claude for work in the last month. Ask them what they pasted in.

We can save you the trouble. The answer is "yes, more than they'll admit, and often with data they shouldn't have."

That's shadow AI. Employees using AI tools on their own, outside any company policy or oversight. 49% of workers who use AI tools at work have done so without any

formal approval or guidance from their employer, and nearly a third admitted they've entered confidential work data into public AI tools

That's not a shocking fact. That's normal 2026.

Why this is a problem

Data pasted into a public AI tool — client lists, financial reports, draft contracts, employee records, product specs, pricing — can be used to train the underlying model. It can surface in responses to other users. Many free-tier tools say so explicitly in their terms.

You wouldn't email that data to a stranger. But pasted into a bot, it might as well be.

The mistake owners make when they realise

They ban it. Which drives the behaviour underground where it's harder to see and impossible to govern.

What we recommend instead

Discover first. Ban last.

Our shadow AI discovery pass

• We look at your identity and SaaS logs to see which AI-related sign-ins are happening.
• We ask your team, non-punitively, what they use and why.
• We map data flows — what's being pasted where.
• We rank the risk — some tools are broadly fine with the right settings; some aren't.
• We produce a short report — approved, restricted, or blocked, with reasons.

Then we build the policy

Not before. Because a policy written without knowing what's actually happening is a policy that doesn't survive contact with reality.

We help you draft an AI Acceptable Use Policy — plain-English, one page, with a red/amber/green data classification. See the next article for the details.

What we won't do

• We won't shame your team.
• We won't rip tools out that people rely on without offering an approved alternative.
• We won't pretend the risk is zero if you just tick a box.