A few years ago, most organisations worried about staff using unapproved cloud apps and personal file-sharing accounts. The term for it was shadow IT: technology being used inside the business without the knowledge or approval of the people responsible for security.
Today there is a new version of the same problem, and it is spreading far faster. It is often called shadow AI: employees using artificial intelligence tools, usually with good intentions, without any oversight or guidance. If you have not thought about it yet, it is worth doing so, because it is almost certainly already happening in your organisation.
Why staff are reaching for AI tools
It helps to start by acknowledging that shadow AI is rarely malicious. In most cases it is the opposite. Staff are using these tools because they are genuinely useful.
An AI assistant can summarise a long document in seconds, draft an email, tidy up a report, suggest code, or explain a tricky concept. For someone under pressure to get through their workload, that is very appealing. People are not trying to cause a problem. They are trying to do their jobs more efficiently.
The difficulty is that the easiest way to use many of these tools involves pasting real, work-related information into a service your organisation has never assessed.
Where the risk comes from
The main concern is what happens to the information staff put into these tools.
When someone pastes a customer list, a contract, a section of source code, or a confidential report into a public AI service, that data leaves your control. Depending on the tool and its settings, it may be stored on servers outside your organisation, processed in another country, retained for an unknown period, or even used to help train future versions of the model.
That raises several practical problems:
- Confidential information can leak. Commercially sensitive material, intellectual property, and personal data can all end up somewhere you never intended.
- Data protection obligations can be breached. Putting personal data into a third-party tool without a proper legal basis or assessment can put you on the wrong side of UK GDPR.
- You lose visibility. If you do not know which tools are being used, you cannot know what information has been shared or where it has gone.
- The output cannot always be trusted. AI tools can produce confident, plausible answers that are simply wrong. Decisions based on unchecked output can cause real harm.
- Not every “AI tool” is genuine. The popularity of AI has attracted scammers. Fake apps and malicious browser extensions posing as AI assistants are a growing route for data theft and malware.
None of this means AI tools are inherently dangerous. It means that using them without any guidance carries risks that many staff will not have considered.
You probably have more shadow AI than you think
It is easy to assume this is limited to a couple of well-known chatbots. In reality, AI features are being built into a wide range of everyday software: browsers, note-taking apps, email clients, design tools, and many of the platforms your organisation already pays for.
Some of these features are helpful and perfectly safe. Others quietly send data to external services in ways that are not obvious to the person using them. Free browser extensions are a particular concern, as they often request broad access to whatever appears on screen.
The point is not to be alarmed by every AI feature, but to recognise that the question is no longer whether AI is being used in your organisation. It is how, and with what information.
Managing it sensibly
The instinct of some organisations is to ban AI tools outright. This rarely works. If the tools are genuinely useful, a blanket ban tends to push their use further into the shadows, where you have even less visibility. A more practical approach is to guide usage rather than pretend it is not happening.
Provide approved tools
If you give staff a sanctioned, properly assessed way to use AI, they are far less likely to reach for whatever they find online. Many established providers offer business versions with clearer commitments about how data is handled, including options that do not use your data for training.
Set out what is and is not acceptable
Clear, readable guidance goes a long way. Staff need to know which tools are approved, what kinds of information must never be entered into them, and who to ask when they are unsure. This does not need to be a lengthy document. A short, practical acceptable use policy that people actually read is worth far more than a detailed one that sits unread on the intranet.
Focus on the data, not just the tool
The most important message for staff is usually about information rather than technology. Helping people understand what counts as confidential or personal data, and why it should not be pasted into an unapproved service, addresses the heart of the risk.
Check the terms before you trust a tool
Before adopting any AI service, it is worth understanding what it does with your data. Does it retain it? Does it use it for training? Where is it processed? These questions are exactly the kind of thing a good information security process should be asking of any new supplier.
Keep the conversation open
Staff are far more likely to follow guidance they understand and feel involved in. Encouraging people to ask questions, and treating mistakes as learning opportunities rather than failings, tends to produce much better results than strict rules imposed from above.
A policy problem as much as a technical one
Shadow AI is a good example of why information security is about more than technology. The tools themselves are not the whole story. The real question is whether your organisation has thought about how they should be used, and has given staff clear, sensible guidance to follow.
This is precisely the sort of issue a well-run information security approach is designed to handle: understanding a new risk, deciding how to manage it, and turning that decision into practical guidance that people can actually follow.
If you would like help developing sensible guidance for AI use or reviewing how your organisation handles new tools and suppliers, our Information Security & ISO 27001 service can help. You are welcome to get in touch for a straightforward conversation about where to begin.