Your team is already using AI. Do you know which?

Someone in sales pastes a client's contract into a free chatbot to summarise it. An accountant uploads a spreadsheet to an AI tool to find errors. A manager connects an AI note-taker to their work calendar and email. None of them asked IT, and none of them meant any harm. They were just trying to get through the day faster.

That is shadow AI: AI tools used at work without the organisation knowing or approving. It is the newest form of "shadow IT", and it is spreading quickly because the tools are free, useful and a browser tab away.

The tools themselves are not the problem. The problem is what goes into them and where it ends up.

• Data you cannot get back. Free consumer plans may keep what you paste, and some use it to improve their models unless you opt out.
• Connected apps with wide access. An AI add-on given access to email or a shared drive can read far more than the one task it was installed for.
• No record of what happened. If something leaks, nobody knows which tool, which data or which account was involved.
• Legal duties. Personal data about customers and staff comes with obligations under data protection laws, wherever it is processed.

This is not theoretical. In IBM's 2025 Cost of a Data Breach research, one in five organisations reported a breach due to shadow AI. Organisations with high levels of shadow AI paid on average about $670,000 more per breach, and 63% of the breached organisations either had no AI governance policy or were still writing one.

The instinct is to block AI tools on the company network. In practice people switch to their phone or personal laptop, and you lose the little visibility you had. Meanwhile, competitors who use AI well get faster.

The organisations that handle this best treat AI like any other useful tool: they give people a good, approved option, explain the rules in plain words, and make it easier to do the right thing than the wrong one.

• Ask, without blameRun a quick anonymous survey: which AI tools do you use, for what, and with what kind of data? You will learn more in a day than an audit finds in a month.
• Approve one or two good toolsChoose business plans that do not train on your data, support single sign-on and let you manage accounts. Then tell everyone they exist.
• Check connected appsReview which AI apps have been given access to company email, calendars and drives, and remove anything unknown or unused. Require approval for new connections.
• Set simple data rulesUse a traffic-light system (below) so nobody has to read a long policy to know what is allowed.
• Create a fast request pathIf someone needs a new tool, they should get an answer in days, not months, or they will find a way around you.

Adapt this to your organisation. Short and clear beats long and ignored.

Green: fine with approved tools

Public information, your own drafts, general research, writing help that contains no customer, staff or confidential details.

Amber: approved business tools only

Internal documents, financial figures, strategy, code and anything marked confidential. Only in tools the company has approved for this, using your work account.

Red: never, unless specifically approved

Customer or employee personal data, passwords and keys, health or financial details of individuals, and anything covered by a contract or law that limits sharing.

Always

• Check AI output before you use it. You are responsible for the final work.
• Do not connect AI apps to company email, calendars or drives without approval.
• If you shared something by mistake, tell us straight away. Reporting quickly matters more than blame.

Handling customer data in India? Read how the new data protection law applies to AI tools in Your customers' data now comes with rules.