What shadow AI means
It includes public AI chat tools on personal accounts, browser extensions, and AI features inside everyday software. Even a paid company tool can become shadow AI when someone enables a new feature or connection that nobody has reviewed.
Shadow AI is a type of shadow IT: technology used outside the business’s agreed process. AI adds two questions: what information goes into it, and who checks the work it produces?
The first step is visibility. You need to know the use, account and access before deciding whether it is suitable.
Why employees use AI without approval
A useful shortcut can become routine before anyone asks about it. Common reasons include:
- No approved option. People choose their own tool to finish a task.
- Unclear rules. Nobody has explained which information may go in.
- A slow request process. Staff cannot find someone who will decide.
- New features in familiar software. An update adds AI without a separate purchase.
- Personal accounts and contractors. Existing habits follow people into client work.
Ask what problem the tool solves. That gives you a better basis for an approved alternative.
Shadow AI risks for a small business
- Confidential information goes somewhere unreviewed. Client emails, bookkeeping exports or private code may be retained or reused, depending on the service, account and settings. Check those details; do not assume every account works alike.
- Connections expose more than a prompt. An AI assistant with mailbox or shared-drive access may read many records. Permission to send messages or change files needs particular attention.
- Unchecked output reaches clients. A wrong figure or invented reference can enter a report unless someone checks it against the source.
- You cannot explain your own process. When a client asks which tools touch their information, an incomplete inventory leaves gaps in your answer.
- Work stays in personal accounts. Drafts and useful records may become unavailable when a person leaves.
Prioritize the information and permissions involved. An unfamiliar tool is a reason to investigate, not proof that harm has occurred.
How to find out what AI tools staff are using (in 30 minutes)
Use this as a first discovery session, not a complete audit. Staff replies and account checks may take days. Before starting, open a blank list and identify who can check your software settings.
Minutes 0–5: Set the tone and a reply date
Send a short message to staff, managers and regular contractors:
“We’re collecting the AI tools and features used for work so we can agree useful options and clear rules. Please include personal accounts and trials. Describe the task and information types, without sending client records or passwords. Reply by [date], even if you use none or are unsure.”
Choose a realistic deadline, such as two working days. Keep the request factual and blame-free; avoid promises about past use you cannot honor.
Minutes 5–10: Ask four questions
- Which AI tools or features do you use for work? Include the account type: company, personal, trial or unknown.
- What task do you use each one for, and who reviews the output?
- What information goes in: public, internal, client or personal details?
- What can it connect to, read or change: email, calendars, files or other systems?
Ask for the tool’s name or website if known. Record “unknown” when it is not; do not quietly leave the field blank.
Minutes 10–20: Check software and spending
With the responsible administrator, review AI settings and connected apps in email, documents, meetings and other software your team uses. Note enabled features, access and account owners. Check company subscriptions and expense records for AI purchases.
These checks cannot reveal every free tool or personal account. If you lack access, record the question and assign it to the administrator.
Minutes 20–25: Check who is missing
List the teams and contractors contacted, replies received and people still to follow up. Ask team leads about recurring workflows, including AI features inside everyday software. “No reply” is different from “no AI use.”
Minutes 25–30: Record uses and pick the first reviews
Use one row per use, with these fields:
Tool or feature · task · user or team · owner · account type · information types · connected access · evidence or unknowns · next action · due date.
Choose up to three uses involving confidential information, broad file access, sending permissions or unchecked client output. Give each an owner and a next action. If sensitive information is currently exposed, address it immediately through your existing support process.
Finish with a dated first inventory and a follow-up list. Missing replies stay open until checked.
For a structured starting point, the free Shadow AI Check asks nine questions in about three minutes. It gives you an action brief with follow-up areas, evidence to gather and owners to assign. No email or account is required; your answers stay in the page.
What to do after you find shadow AI
- Decide on each use. Approve, approve with conditions, restrict or decline. Record the reason, owner and review date. Approval should specify the task, information and account it covers.
- Offer a workable alternative. If a use is unsuitable, explain how the task should be completed instead.
- Review connected access. Confirm permissions with the system owner. Remove unnecessary access and check any actions already taken.
- Write short rules. State approved uses, excluded information and who checks outputs. See how to write an AI acceptable use policy.
- Name a request owner. Give people one place to ask and a clear expected response time.
- Revisit the list. Start with quarterly reviews, plus checks when a tool, feature, connection or task changes.
Shadow AI examples by industry
These examples are illustrative, not reports of actual incidents.
- Agencies. A copywriter pastes an unreleased client brief into a public AI chat tool. Pause that use, establish what was shared, and review the account. Use public or fictional material while deciding on an approved workflow.
- Accounting firms. An accountant uploads a client bookkeeping export for a summary. Review the information and retention settings; a paid account alone does not settle suitability. Offer synthetic data for practice.
- IT services. A technician summarizes support tickets through an unidentified browser extension. Stop entering ticket text, identify the extension and permissions, and involve the security owner if credentials were included.
- Software companies. An engineer connects an AI tool on a personal plan to private code. Review repository access and data handling, then approve a defined scope or remove the connection.
- General businesses. A sales rep gives an AI assistant read-and-send access to a shared mailbox. Have the mailbox owner revoke unreviewed access and check sent messages before deciding whether to adopt it.
Take the first step
Do this now
Start with the free Shadow AI Check
Nine questions, about three minutes, and an action brief with follow-up areas, evidence to gather and owners to assign. Free. No email.
When you need it on record
Shadow AI Risk Kit
Keep the work on record with an eight-question staff survey, AI inventory, risk review, action list with CSV export and leadership report. The kit records disclosures and reviews; it does not scan devices or monitor staff. One-time purchase, with updates included for 12 months and a 14-day money-back guarantee.
Need rules alongside the inventory? The AI Policy & Rollout Kit helps you prepare a policy, approval record, staff edition and rollout materials.
Common questions
What is shadow AI in simple terms?
AI tools or AI features people use for work without the business knowing about or approving that use. This includes personal accounts and unreviewed features in company software.
Is shadow AI the same as shadow IT?
Shadow AI is a type of shadow IT. AI adds questions about the information entered, connected access and whether someone checks the output before using it.
What is the biggest shadow AI risk for a small business?
Start by checking confidential information entered into unreviewed accounts and tools with broad access to email or files. The biggest risk depends on the information, permissions and work involved.
How do I find out what AI tools employees are using?
Ask which tools they use, for what tasks, with what information and connections. Include personal accounts and contractors. Check software settings and spending, then follow up on missing answers.
Do I need a shadow AI tool to detect it?
You can start with staff questions and a review of software settings and subscriptions. This gives a first inventory, not proof that every use has been found. The free Shadow AI Check helps identify follow-up areas.
Should I ban employees using AI without approval?
Set clear limits on unapproved use, especially where confidential information or connected access is involved. Pair those limits with approved options and a simple request process so people can complete their work.
Related guides
Extrasphere Media LLC. Content for general informational purposes, not legal advice and not a substitute for qualified counsel. Independent and not affiliated with ISO, the IEC, NIST, or the European Union.