Shadow AI is the use of AI tools at work without approval, usually with good intentions: someone pastes a contract into a free chatbot to save time. It is the most common AI risk in small and mid-sized firms. A shadow AI policy brings that use into the open instead of driving it underground.
Why banning AI doesn't work
People use AI because it helps. If the official answer is “no”, they use personal accounts on personal phones, and you lose all visibility. The better approach is to approve good tools quickly and make the safe path the easy path.
Shadow AI policy template
1. Amnesty
For the next [30 days], tell [AI owner] about any AI tools you use for work, including free tools, browser extensions and apps on your phone. Nobody will be disciplined for disclosing past use.
2. Approved alternatives
We provide [approved tools] for everyone, with business plans that don't train on our data. Use these instead of personal accounts.
3. Rules going forward
- No company, client or personal data in AI tools that aren't on the approved list.
- No AI tools signed up with your work email without approval.
- New tool requests go through the AI tool approval process, with a decision within [5] working days.
4. Detection
IT may monitor network traffic and browser extensions for unapproved AI services to protect company data.
5. Breaches
Using unapproved AI tools with confidential or personal data after the amnesty may lead to disciplinary action.
How to find shadow AI
- Ask: a short anonymous survey of which AI tools people use and why.
- Check expense claims and card statements for AI subscriptions.
- Review browser extensions and OAuth app connections to your email and drive.
- Look at network logs for traffic to popular AI services.
Frequently asked questions
Is shadow AI a data breach?
It can be. Putting client confidential or personal data into a tool that stores or trains on it may breach client contracts and privacy law, even if nothing is leaked publicly.
Which AI tools are safest to approve?
Start with tools that don't train on your data and offer a DPA. See AI tools that don't train on your data.