Shadow AI Is Already in Your Business. Here's How to Bring It Under Control

Someone in your finance team pastes a supplier contract into a public chatbot. Someone in HR drops a CV pack into a free summariser. Someone in engineering pastes production logs into a coding assistant that trains on the prompt by default. None of this shows up in your AI programme. All of it is already AI in your business.

That is shadow AI: generative tools used outside approved channels, with no inventory, no data classification, and no owner when something goes wrong. Boards keep asking for an AI strategy. The quieter problem is that staff already have one, and it runs on personal accounts.

This piece is about bringing that activity into the light without turning into the team that bans everything and drives people underground again.

What shadow AI looks like on a normal Tuesday

It is rarely a rogue agent fleet. It is ordinary work under pressure:

• A sales lead pastes a client briefing into a consumer model to draft a proposal.
• A claims officer photographs a form and asks a phone app to extract the fields.
• A product manager uploads a roadmap spreadsheet to a meeting summariser so the board pack writes itself.
• A developer pastes a stack trace that still contains a customer ID.

Each act feels harmless. Collectively they create three problems: data leaving the organisation without a record, answers nobody can audit, and a false sense that "we have not started AI yet" while the risk register is already open.

Why bans fail

Blanket blocks feel decisive. They also fail for the same reason USB bans failed. People still need to finish the work. They route around the control with personal devices, browser extensions, and private SaaS trials.

The organisations that get ahead treat shadow AI as a discovery signal. Staff are telling you where the friction is. The response is not "stop using AI". It is "here is an approved path that is faster than the shadow one, with clear rules for what can and cannot leave the building".

A practical control model

You do not need a 40-page policy before you start. You need four things that actually operate:

1. An inventory. What tools are in use, who pays for them, what data classes they see. Start with a short anonymous survey plus SSO and expense line reviews. You will miss some. That is fine. Update monthly.
2. A data line you will not cross. Name the classes that never go to an external model without a contract: health records, payment data, government identifiers, source code with secrets, live customer PII. Put that line in Slack, not only in SharePoint.
3. An approved lane. One or two enterprise tools with SSO, retention controls, and a clear "no training on our prompts" clause. Make them easy. If the approved path needs a three-week access request, shadow AI wins.
4. An escalation path. When someone is unsure, they ask a named channel and get an answer the same day. Ambiguity is what sends people back to the free tier.

If you only do one thing this quarter, make the approved lane faster than the shadow lane. Policy without convenience is theatre.

What good looks like in 90 days

A workable programme for an Australian mid-market or enterprise team usually lands like this:

• Days 1 to 14: inventory and a one-page interim rule (what never leaves, which tools are approved today, who to ask).
• Days 15 to 45: stand up the approved workspace with SSO, logging, and retention. Migrate the highest-volume teams first: knowledge work, support drafting, internal research.
• Days 46 to 90: close the obvious gaps. Block or contract the unmanaged tools that still touch sensitive data. Train managers on how to spot risky pastes without shaming staff. Feed the friction points into your formal AI roadmap.

By day 90 you should be able to answer three board questions without a scramble: which tools are sanctioned, what data they may process, and how you would reconstruct an incident.

Security and privacy, without the scare deck

Shadow AI risk is mostly ordinary data handling risk with a new interface. Treat it that way.

• Contracts and regions. Prefer providers that will sign a proper DPA, state where inference runs, and commit not to train on your prompts. For Australian Privacy Act exposure, residency and subprocessors matter.
• Identity. Personal email accounts for work AI are a red flag. SSO or they do not get the sensitive lane.
• Logging. You do not need to store every prompt forever. You do need enough to investigate a leak: who used which tool, when, and against which data class policy.
• Secrets. Coding assistants and ticket summarisers are where API keys and connection strings slip out. Pair the AI rule with the same secret scanning you already want for git.

If your security team can explain the control in one paragraph to a non-technical manager, it will travel. If it only lives in a threat model, it will not.

Culture: stop treating users as the enemy

People reach for shadow AI because the official process is slow, the templates are stale, or the approved tool cannot see the systems they need. Punishing that impulse teaches them to hide better.

Better signals:

• Publish "safe patterns" with examples from your own teams (draft this, never paste that).
• Celebrate migrations onto the approved lane the same way you celebrate cost savings.
• Give champions in each function a direct line to IT and risk so exceptions are decided quickly.

Shadow AI shrinks when the governed path is the path of least resistance.

How this feeds the real AI programme

Shadow use is free product research. The prompts people invent are often the first draft of a production use case: proposal drafting, exception triage, meeting notes into actions, code explanation against your standards.

Capture those patterns. Rank them. Build the ones with a system of record, an owner, and a write path you already trust. That is how you turn unmanaged GenAI into the thin production slices we argued for in When Your AI Architecture Becomes a Liability, instead of another platform slide.

Governance that only says no will lose. Governance that offers a faster yes, with clear red lines, wins enough of the traffic to make the residual risk manageable.

Frequently asked questions

Should we block all consumer AI tools at the firewall? Block the ones that routinely receive regulated or highly sensitive data if you have no contract and no logging. Do not pretend a hard block is the whole programme. Pair it with an approved alternative the same week, or staff will find another route.

Is an anonymous survey enough to find shadow AI? It is a start, not a finish. Combine it with SSO app inventories, expense reviews, browser extension reports, and manager conversations. Expect to miss tools. Plan for a monthly refresh.

What belongs in the "never paste" list? Anything you would not email to an unknown third party: customer PII, health and government identifiers, payment data, credentials, privileged legal advice, and unpublished financials. Keep the list short enough that people can remember it.

How does this relate to a formal AI governance framework? Shadow AI control is the operational layer that makes governance real. Policies, risk registers, and ethics statements matter. They do not replace an inventory, an approved lane, and a data line staff actually follow.