Shadow AI is the use of artificial intelligence tools, accounts or features without the organisation’s knowledge, approval or agreed controls. For an SME, that might mean someone uploading a customer spreadsheet to a personal chatbot or enabling an AI meeting assistant without checking where recordings go.
The problem is not necessarily the employee’s intention. They may be trying to finish useful work faster. The risk is that business information, decisions and system access move outside the controls you rely on. Managing this requires clear boundaries and workable alternatives, not just a blanket ban.
Where unapproved AI use starts
An AI service does not have to be completely unknown to count as unapproved use. A business might permit a particular tool but only through company-managed accounts, with specific settings and restrictions on the information it can process.
Someone using a personal account for the same service may bypass those safeguards. Equally, an approved application can introduce an AI feature that has never been assessed.
Common examples include:
- Pasting customer emails, employee records or contracts into a public chatbot.
- Installing a browser extension that can read website content or documents.
- Connecting a personal AI assistant to a company mailbox or shared drive.
- Enabling transcription, summarisation or content generation inside existing software.
- Giving an AI agent permission to update records, send messages or run code.
Approval needs to cover the use case, account, data and permissions, not simply the product name. Shadow AI can therefore exist inside software your business already pays for and trusts.
How it differs from shadow IT
Shadow IT covers technology used outside approved IT processes, such as an unauthorised file-sharing account or an unmanaged application. Unapproved AI use is a related problem, but it introduces additional questions.
A chatbot can receive confidential information through an ordinary browser without any software being installed. An AI feature can also generate inaccurate material that looks convincing or act on information retrieved from connected systems.
That means a software inventory alone is insufficient. Businesses also need to understand what information enters a service, how outputs are used and whether the tool can take actions. An approved application does not automatically make every feature or integration suitable for business use.
The main risks for smaller businesses
Confidential information can leave your control
Prompts and attachments may contain personal data, pricing, source code or commercially sensitive plans. What happens next depends on the provider’s terms, account type, settings and technical design.
Do not assume that every provider uses submitted information for model training. Equally, switching training off does not necessarily eliminate retention, support access or other processing.
With shadow AI, the business may not know which terms apply or whether it can retrieve records and request deletion. Removing a conversation from the visible history may not remove every retained copy.
Incorrect outputs can become business decisions
AI-generated answers can contain invented facts, misleading summaries or insecure code. A polished response is not evidence that its contents are correct.
For an SME, this could mean sending inaccurate advice to a client, relying on a mistaken contract summary or publishing material that exposes confidential information. Human review needs to match the consequences of an error.
Anything affecting employment, legal rights, finances or safety needs appropriate professional judgement. Staff should also check whether customer contracts permit AI processing of the material involved.
Connected tools can expand the damage
An assistant with mailbox or document access presents a different risk from a chatbot used with fictional text. An agent that can send messages or alter business records has greater potential to cause harm.
Malicious instructions embedded in a webpage, email or document can attempt to influence connected AI systems. This is commonly called prompt injection.
Limit what connected tools can read and change, and require human approval for consequential actions. Treat external content as untrusted rather than assuming an agent will reliably distinguish information from instructions.
Why employees turn to unapproved tools
People often adopt AI because an existing task is slow, repetitive or poorly supported. Drafting proposals, summarising meetings and analysing spreadsheets are obvious opportunities to save time.
A vague prohibition does not resolve those needs. If approval takes weeks or staff cannot identify an acceptable alternative, personal accounts become an attractive shortcut.
Reducing shadow AI starts with understanding the task people are trying to complete. Ask what they use, what information they submit and which approved tools would help. Make it safe to disclose existing use without turning the initial discovery exercise into a disciplinary exercise. Deliberate misconduct can still be addressed separately.
How to find shadow AI in your business
Start with a short, non-judgemental conversation across departments. Finance, sales, HR and operations may use AI differently, so speaking only to IT will leave gaps.
Combine those conversations with checks of systems you already manage:
- Approved applications: Review AI features, meeting bots, integrations and settings that have changed since the original purchase.
- Accounts and subscriptions: Check expense claims, software renewals and whether work is happening through personal rather than company-managed accounts.
- Browsers and devices: Review installed extensions and applications on managed equipment, including the permissions they request.
- Connected services: Examine mailbox access, third-party application consents, API keys and connections to shared storage.
- Available security logs: Use relevant identity, endpoint and web-access records to identify services that need further investigation.
No single method provides complete visibility. Visiting an AI website does not prove that sensitive information was submitted, while network records may not reveal prompt contents at all.
Document the tool, business purpose, owner, account type, data involved and permissions granted. This turns shadow AI discovery into a manageable risk register rather than an unstructured list of websites.
Explain monitoring to staff, assess its necessity and proportionality, and respect boundaries around personal devices and accounts. Avoid collecting sensitive prompts merely to demonstrate that they exist.
Separate safe experimentation from higher-risk use
Not every experiment needs a lengthy review. A simple classification helps employees recognise when they can proceed and when they need permission.
| Proposed use | Starting position | Appropriate control |
|---|---|---|
| Drafting a generic agenda using fictional details | Lower risk | Use a permitted tool and review the output |
| Summarising non-public business information | Review required | Confirm the approved account, provider terms and permitted data |
| Processing customer or employee personal data | Higher scrutiny | Assess data protection, security and contractual requirements before use |
| Uploading passwords, API keys or restricted client material | Stop | Use an authorised process and investigate any disclosure |
| Connecting an agent to email, files or business systems | Separate approval | Limit permissions, record access and approve consequential actions |
These are starting points, not universal legal classifications. Context matters: a seemingly ordinary document may contain sensitive details in comments or attachments.
The aim is to manage shadow AI proportionately. Let people test useful ideas with fictional or genuinely anonymised information while keeping restricted data and powerful integrations behind a clear approval process. Replacing names alone does not necessarily anonymise a dataset.
Put practical controls behind the policy
Assess tools against the intended task
Before approving a service, check its business terms, data handling, retention, deletion options, security controls and use of subprocessors. Establish whether information is used for training and which settings or contractual commitments govern that use.
Check where data is processed and whether any international transfer requirements apply. Confirm whether the business can manage accounts, remove access and investigate incidents using the chosen subscription.
A paid account is not automatically suitable for confidential work. Approval should specify which tasks and data categories are allowed, who owns the service and when the assessment will be reviewed. Repeat the assessment when a new connector, agent capability or material change to terms is introduced.
Control accounts, permissions and integrations
Use company-managed identities and multifactor authentication where supported. Remove unused connections and restrict who can grant third-party applications access to business information.
For agents, begin with the minimum permissions needed. Read-only access is preferable where it meets the task, but even read-only access can expose sensitive information. Keep human approval for actions such as payments, external messages and changes to important records.
Review the underlying file permissions too. An assistant connected to a shared drive may make existing oversharing easier to exploit. CIS’s guidance on managing cloud security provides useful context for reviewing these wider access and configuration issues.
Give staff rules they can actually follow
Keep the acceptable-use policy short enough to consult during normal work. It should identify approved tools, prohibited information, required output checks and the route for requesting a new use case.
Include examples from your own business, such as whether client meeting transcripts can be processed or whether generated code needs review before deployment.
Training should explain how to report mistakes promptly. Shadow AI is harder to control when employees believe that admitting an accidental upload will inevitably lead to punishment. Assign a named owner who can answer questions and update guidance as tools change.
Apply UK data protection and sector requirements
When AI processes personal data, UK data protection obligations still apply. Identify your purpose and lawful basis, assess transparency requirements and establish the relevant controller and processor responsibilities. Check contracts and international transfers where applicable.
A data protection impact assessment is required where processing is likely to result in a high risk to individuals’ rights and freedoms. Not every AI experiment requires one, but sensitive data, significant decisions and extensive monitoring deserve careful assessment. The ICO’s guidance on artificial intelligence and data protection is a useful starting point.
Shadow AI can also conflict with professional confidentiality, client commitments or sector-specific requirements even when no personal data is involved. Do not treat a general supplier security statement as proof that your intended use is acceptable.
SMEs with French operations can also consult this French-language overview of ANSSI cybersecurity frameworks for SMEs for approaches to risk assessment and cloud supplier checks. These frameworks can inform security controls but do not replace UK legal duties.
What to do if sensitive information has already been shared
Treat the disclosure as a potential incident rather than waiting for evidence of misuse. Follow your incident process and involve the person responsible for security and data protection.
Contain further exposure. Stop the affected workflow, revoke unnecessary connections and secure compromised accounts. If passwords, tokens or API keys were submitted, revoke or rotate them promptly. Deleting the chat alone does not secure an exposed credential.
Establish the facts. Record the service, account, time, information involved and recipients or systems potentially affected. Preserve relevant evidence securely without circulating extra copies of the sensitive material.
Check the provider’s options. Review retention terms and contact the provider about deletion or access restrictions where appropriate. Do not promise that information has been removed unless this has been established.
Assess notification duties. A personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness unless it is unlikely to result in a risk to individuals’ rights and freedoms. High-risk breaches also require notification to affected individuals without undue delay. Consult the ICO’s personal data breach guidance and document the assessment and decision.
Finally, address the cause. A shadow AI incident may reveal missing guidance, excessive access or an unmet business need. Check contractual notification requirements too, and update controls rather than treating the employee’s action as the only failure.
A manageable first month
In the first week, appoint an accountable owner and ask teams to disclose their current tools and use cases. Publish an immediate rule against submitting credentials or restricted information to unapproved services.
During the second week, review the highest-risk uses first: personal data, confidential client work and connected agents. Remove unnecessary permissions and agree safe alternatives with the teams affected.
Use the remaining weeks to approve a small set of useful workflows, publish guidance and practise the incident response process. CIS’s overview of security testing and recovery exercises can help place this work within a broader testing programme.
Measure progress through approved workflows, resolved risks and timely reporting, not simply the number of tools blocked.
Frequently asked questions
Should an SME ban all AI tools? A temporary restriction may be appropriate for a particular high-risk activity, but a blanket ban alone leaves business needs unresolved. Clear permitted uses, accessible alternatives and proportionate controls are more workable.
Is shadow AI always a personal data breach? No. Unapproved use may involve no personal data, although confidentiality or security risks can still arise. Where personal data is involved, assess whether a breach occurred and whether notification is required.
Does an enterprise subscription solve the problem? Not by itself. Suitable contractual protections and administration features can help, but configuration, permissions, staff behaviour and the intended use still need review.
Get support with the controls around AI
Managing unapproved AI use depends on familiar foundations: secure identities, sensible permissions, managed devices and a clear response when something goes wrong.
CIS provides managed IT support, cybersecurity, Microsoft 365 and cloud services for UK organisations. To review those foundations and plan practical improvements, speak to CIS about your business IT requirements.
