Someone on your team had to summarise a twenty-page contract before six o'clock. They opened a tab, pasted the document into their personal AI account, and thirty seconds later they had the summary. They did their job well. And nobody at the company knows that contract left the building.
This has a name: shadow AI. It's the use of artificial intelligence tools inside a company without anyone approving them or knowing they're there. It's the same thing that happened for years with software — the employee who installed a program on their own because the company's one didn't cut it — but now much faster and far more widespread, because the barrier to entry is zero: nothing to install, no budget to request. A browser tab is enough.
It isn't defiance, it's a shortcut that works
It's worth understanding where this comes from, because it shapes the fix. Nobody uses AI on the sly to get around the rules: they use it because it saves them two hours and the official tool either doesn't exist or is worse. Shadow AI doesn't show up where people are careless. It shows up where there's a real need going unmet.
That's why it's usually your most resourceful people who get there first. This isn't a discipline problem. It's a signal.
What it actually exposes you to
That said, a legitimate motive doesn't remove the risk. And there are three worth facing head-on.
The first is data. When a contract, a client list or a medical record gets pasted into a tool the company hasn't vetted, that information leaves your control. You don't know where it's stored, for how long, or whether it's used to train the model. If it includes personal data, you also have a legal obligation over something you don't even know is happening.
The second is traceability. If a quote, a report or a client reply came out of an AI and nobody knows it, then nobody reviewed it with that in mind. The error stops being detectable: it isn't hidden, it's just that nobody is looking for it.
The third is silent dependency. A process that works because someone built an automation in their personal account breaks the day that person leaves. And they didn't document it for anyone, because officially it never existed.
Banning it only makes it invisible
The instinctive reaction is to send an email prohibiting AI use. It's the response that works worst.
It doesn't remove the usage, it hides it. People still have the same workload, the same time pressure and the same tool one click away, so they carry on using it — they just stop mentioning it. You've lost the one thing you had: the chance to find out. And you've put your team in the position of choosing between following the rule and delivering on time.
The alternative that does work is offering an approved route that's better than the shadow one. If the official tool is easier than the unofficial one, the problem solves itself.
Three steps to bring it into the open
First, take inventory without hunting for culprits. Ask openly what tools people are using and what for, making it clear there are no consequences. If anyone senses the answer will cause trouble, you won't get the real map, and everything else gets built on false data.
Second, write one short rule about data. Not a twenty-page manual nobody reads: a single sentence everyone can remember about what never leaves the company. Client personal data, financial information, legal documents that haven't been anonymised. One rule people remember beats ten that get filed away.
Third, cover the two or three needs driving the shortcut. That's where the circle closes: if people are pasting documents into a personal AI to summarise them, what you need isn't a ban, it's an approved summarising tool that's properly set up.
That third step is usually smaller than it looks. It's almost always the same repetitive tasks: summarising, sorting, drafting. We go through them in detail in 5 tasks your small business can automate with AI this week.
Shadow AI isn't a sign your team is going off the rails. It's a sign they found value in AI before you gave them a safe way to use it. That's good news: the hard part, convincing people, is already done. All that's left is bringing it out of the shadows.