Shadow AI: What Your Staff Are Already Putting Into ChatGPT

Shadow AI is any AI tool your team uses for work without the business knowing or approving it. In most small businesses it is already happening, usually with good intentions. The risk is not the tool. It is where the data goes.

Why shadow AI happens

Staff reach for AI because it saves them time on writing, summarising and research. If the business has not provided an approved tool, they use whatever is free and familiar, often on a personal account and sometimes on a personal phone. With more than half of UK SMEs now using AI according to the British Chambers of Commerce, the question for most owners is not whether staff are using AI, but which accounts they are using.

The risks for a small business

• Client or personal data leaves systems the business controls, which matters under UK GDPR and client confidentiality terms.
• Free and personal accounts have different data settings from business plans, and the business cannot see or change them.
• There is no record of what was shared, so an incident is hard to assess or report.
• AI output reaches clients without anyone checking it for errors.
• When someone leaves, their chat history and any uploaded documents leave with their personal account.

How to find out what is being used

You do not need specialist monitoring software to get a clear picture. Start with the simple methods.

1. 1.Ask. Run a short, no-blame survey asking which AI tools people use, for what, and on which account. Promise that the answers shape an approved setup, not disciplinary action.
2. 2.Check third-party app permissions in Microsoft 365 or Google Workspace. Staff often sign in to AI tools with their work account, which leaves a record of the app and the data it can access.
3. 3.Review browser extensions on company devices. AI writing and meeting assistants are common and can read page content.
4. 4.Look at expenses and card statements for small AI subscriptions paid personally and claimed back.
5. 5.Check meeting invitations for AI note-taking bots joining calls.

How to fix it without banning useful tools

• Choose one or two approved tools on business accounts with admin controls. Our comparison of Copilot, ChatGPT and Claude covers the main options.
• Write a short policy that names the approved tools and the information that must never be entered. Our AI policy guide includes a template.
• Restrict which third-party apps can connect to company accounts, so new tools go through a quick approval.
• Train staff on the approved tools using their real tasks, so the official route is also the easiest one.
• Repeat the survey in six months to check the approved tools are meeting people's needs.

Where shadow AI meets cyber security

AI tools connected to work accounts are cloud services that store or process your data. That puts them in scope for Cyber Essentials, which requires multi-factor authentication on every cloud service. An unknown AI tool is also an unknown gap in your certification.