Shadow AI use

What it is

Capable AI tools are free or cheap, need no installation and are useful at once. Staff adopt them to do their work, through personal accounts, browser extensions or features inside other software. None of it passes assessment. The risk is partly what goes into these tools, which may be confidential or personal, and partly what comes out, which enters work products and decisions with no check on quality or origin.

How it happens

• No approved tool meets a real need, or the approved tool is worse.
• The approval process is slow or unknown.
• Policy prohibits use and provides no alternative.
• AI features appear inside applications staff already use.

Why it matters

Data disclosed to an unapproved provider may be retained, used for training or exposed, with no contract governing it. Outputs relied on in advice, code or analysis carry errors nobody is positioned to catch. The organisation is accountable for both and has sight of neither.

Warning signs

• Network traffic to AI providers with which there is no contract.
• Expense claims for AI subscriptions.
• Work products with the marks of generated text.
• Staff surveys report use well above approved figures.

Who owns it

The owner of the AI policy is accountable for a workable position on permitted use. Security monitors for unapproved tools. Line managers are accountable for their teams' practice.

In practice

A paralegal pastes a draft settlement agreement into a public chatbot to tidy the wording. The firm's duty of confidentiality, its insurer and its data protection officer are all brought into play by an act that took thirty seconds and left no record. The same pattern generalises to any workplace where a useful tool is easier to reach than permission to use it.