In plain English
The name comes from “shadow IT”, the long-standing problem of staff using apps the business doesn’t know about. Shadow AI is the same thing with higher stakes, because the whole point of an AI tool is that you hand it your information.
People rarely do it to cause trouble. They’ve found something that saves them time, and nobody has told them what’s allowed. The risk is in the detail. Depending on the service and its settings, what’s typed into a free consumer tool may be kept, reviewed or used to train future models, and there’s no data processing agreement covering it. For a firm holding client data, that’s a UK GDPR problem as well as a confidentiality one.
Banning AI outright tends to push it further out of sight. What works is a clear policy, plus approved tools good enough that people don’t need to look elsewhere.
An example from a small business
Picture a hypothetical 15-person accountancy practice. A capable junior has been pasting client correspondence into a free chatbot on their phone to draft replies faster. Nobody knew until a partner noticed the emails sounded different. The practice doesn’t ban AI. It writes a one-page policy on what can and can’t go into AI tools, and makes sure everyone uses Copilot Chat signed in with their work account, which comes with their Microsoft 365 plan and includes Microsoft’s enterprise data protection. Then it sets up a proper drafting tool for client replies.
What to watch out for
- Personal and work accounts look alike. Microsoft’s Copilot app accepts a personal Microsoft account or a work account, and only the work account gets enterprise data protection. Your IT provider can restrict personal sign-ins.
- It’s not just chatbots. AI browser add-ons and meeting note-takers can see far more than a chat window. Cover them in your policy too.
- Policies go stale. New AI tools appear constantly, so review the approved list regularly rather than writing it once.
Related terms
- Data processing agreement (DPA): what an approved tool should have.
- Large language model (LLM): the AI behind the tools staff are using.
- Microsoft 365 Copilot: an approved option many firms already have.
Where AlphaOps can help
Every client on our Monthly AI Support plans gets an AI safe-use policy at set-up, as part of the standard pack, along with approved tools that do the jobs people were reaching for. We also keep track of new AI tools and, with your OK, set up the ones worth having. Start with AI consultancy or a free automation audit.