Shadow AI: find the tools people already use
Your staff already use AI tools you never approved. Banning them doesn’t work. Find them, then offer a safe option.
Ask any team whether they use AI at work and most will say a little. Look at the browser extensions, the sign-ins with company email and the expense claims, and you’ll find a lot more: chat assistants, meeting recorders, writing tools, image generators.
The risk isn’t that people use AI. It’s that client documents and internal numbers are being pasted into free accounts with unknown terms.
What works better than a ban:
- Find out what’s in use. Your identity provider shows “Sign in with Google/Microsoft” apps. A short anonymous survey shows the rest.
- Pick one or two tools with business terms that don’t train on your data, and pay for them.
- Write down what must never go into any AI tool: passwords, ID numbers, client data unless the contract allows it.
- Block the riskiest extensions, especially the ones that can read every page.
People choose the easy tool. Make the safe one the easy one.