Here’s a quick way to measure shadow AI in your business. At your next team meeting, ask how many people have used ChatGPT, Claude or Gemini for work in the last month. Then ask how many of them used their own personal account to do it.
Those personal accounts are a good place to start looking for shadow AI. In most small businesses the problem is bigger than the owner thinks, and the risks attached to it are real but very fixable. This article covers why it happens, what it can cost you, and a simple register you can set up this week.
What is shadow AI?
Shadow AI is any AI tool used for work without the business knowing about it, approving it or setting rules for it. It’s the AI version of shadow IT, the Dropbox account or WhatsApp group that ends up holding company files because it was easier than the official system.
Typical examples:
- A sales manager pasting a client’s tender documents into a free chatbot to draft a response.
- An administrator uploading a spreadsheet of customer details to get help with a formula.
- A new hire using an AI meeting assistant that joins every Teams call and keeps the recordings on someone else’s servers.
- An accountant running supplier invoices through a browser extension they found last Tuesday.
Nobody in those examples is acting in bad faith. Each of them is trying to do their job faster. That’s exactly why banning AI rarely works.
Why it is already happening in your business
Because the tools are free, useful and a browser tab away. Microsoft and LinkedIn’s 2024 Work Trend Index, which surveyed 31,000 people in 31 countries, found that 78% of people using AI at work were bringing their own tools. At small and medium-sized companies the figure was 80%. The same research found that 52% of people using AI at work were reluctant to admit using it for their most important tasks.
So people are using it, and a good share of them are keeping quiet about it.
The Irish picture explains why. The AI Economy Ireland 2026 report from Trinity College Dublin and Microsoft Ireland found that fewer than half of organisations (44%) have a formal AI policy, and that SMEs are more than twice as likely as large firms to have no formal AI training at all (15% against 6%). When there’s no policy, no approved tool and no training, staff fill the gap themselves. You’d probably do the same.
The real risks of unregulated AI use
These are ordinary business risks with a new delivery mechanism.
Your data goes somewhere you didn’t choose
Consumer AI accounts often let the provider use conversations to improve its models unless someone has switched that setting off. Business plans generally don’t use your data for training by default, and they come with proper terms. When an employee pastes client data into a personal account, you’ve no idea which settings apply, how long the data is kept or who can access it.
Personal data and GDPR
If that pasted spreadsheet contains names, emails or anything about health or finances, it’s personal data, and GDPR applies in full. You’re responsible for where it went, whether there was a lawful basis for sending it there, and whether you could answer a subject access request about it. “A staff member used their own ChatGPT” is not an answer the Data Protection Commission tends to warm to.
Confidentiality and client trust
Many client contracts include confidentiality clauses written long before anyone thought about chatbots. Putting a client’s documents into an unapproved third-party tool can breach them, even if nothing ever leaks.
Wrong answers with your name on them
AI tools produce confident, fluent text that’s sometimes wrong. When nobody knows AI was involved, nobody knows to check. The error reaches the client with your letterhead on it.
A compliance gap under the EU AI Act
Every business that uses AI has a duty under the EU AI Act to take measures supporting AI literacy among its staff. It’s hard to show you’ve done that for tools you don’t know exist. Our guide to EU AI Act compliance in 2026 covers what that duty means in practice.
How to bring shadow AI into the light
The instinct is to send a stern email banning AI. Resist it. A ban drives the behaviour further underground and throws away the productivity your people have found. Here’s what works better.
Ask, and promise not to punish. Run a short, anonymous survey or simply ask in a team meeting: which tools are you using, for what, and on which accounts? Make it clear this is an amnesty. You want the truth more than you want to be right.
Give people an approved option. If everyone’s using ChatGPT on personal accounts, the fix is usually a business plan for the tool they already like, or turning on the AI that’s already in your Microsoft 365 or Google Workspace subscription. People switch quickly when the official route is as easy as the unofficial one.
Write a one-page policy. Keep it to a single page that answers the questions staff actually have: which tools are approved, what data must never go into an AI tool, when a human has to check the output, and who to ask when unsure. Our Trust Stack oversight layer explains how a policy fits with the rest of your AI governance.
Train people on the tools you’ve approved. An hour of practical training on the right tool does more for your risk position than any policy. People who understand how the tool handles data make better decisions about what to put in it.
Review it every quarter. New tools arrive every month. A 15-minute review each quarter keeps the list honest.
A simple AI tool register
The register is the backbone of all of this. It doesn’t need software. A shared spreadsheet is fine. Here are the columns I recommend:
| Column | What to record |
|---|---|
| Tool | The product name, for example ChatGPT, Copilot, Otter, Grammarly |
| Account type | Personal, free business, or paid business plan |
| Used by | Names or teams |
| Used for | Plain description, for example “drafting proposals” or “meeting notes” |
| Data it touches | None, internal only, client confidential, or personal data |
| Training setting | Whether the provider can use your data to train its models, and whether that’s been switched off |
| Approved? | Yes, no, or under review |
| Owner | The person responsible for this tool |
| Next review | A date, usually 3 months out |
Fill it in from your amnesty survey, then go through it line by line. Anything touching client or personal data on a personal account moves to an approved alternative first. That single step removes most of your exposure.
This sounds simple because it is simple. The hard part is starting.
If you’d like help building the register and the policy that sits around it, that’s the first thing we do in our AI readiness and planning work. Or request the free AI Readiness Scorecard for a review across all five layers of the Trust Stack.