Shadow AI: when your staff use public chatbots at work
By Keith Hamilton · · 4 min read
Shadow AI is the use of AI tools at work without the business knowing or agreeing to it. In most small firms it looks perfectly ordinary: someone uses a free chatbot on their phone to tidy up a customer email, summarise a long contract or draft a job advert. People do it because it helps. The risk is not that staff are using AI chatbots at work, but that nobody knows what information is going where. This guide explains how to find out, how to reduce the risk and what to do if something sensitive has already been shared.
Why does shadow AI happen?
Shadow AI happens because the tools are useful and nobody has offered an approved alternative. Staff rarely set out to break rules. The usual causes are:
- the tools are free, quick and genuinely useful
- there is no approved alternative, so people use what they have
- nobody has said what is allowed, so people assume it is fine
- asking feels like it might lead to a "no"
Seen that way, shadow AI is a sign that your team has found work worth speeding up. That is useful information, not just a problem.
What is the data risk of public AI chatbots?
The data risk of public AI chatbots is that business and personal information leaves your control. For a small business, the main concerns are:
- Personal data leaving your control. Customer or staff details pasted into a personal account are outside your systems, and you do not control how long they are kept or whether they are used to train the supplier's models.
- Confidential information. Pricing, contracts, client documents and anything you have promised to keep confidential end up in the same place.
- Inaccurate output. AI regularly produces confident, wrong answers. Without guidance, people send them to customers unchecked.
- No record. If something goes wrong, the business has no trace of what was shared, by whom or when.
- Leavers. Work held in a personal account goes with the person when they leave.
UK GDPR applies whatever tool is used. If staff put personal data into an AI tool for work, your business is responsible for that processing.
How do you find out which AI tools staff are using?
Find out with an honest, no-blame conversation. Ask the team which AI tools they use, what for, and what kind of information goes in. A short anonymous survey helps if people are wary.
Focus on tasks rather than tools. "I use it to rewrite complaint replies" tells you far more than a product name. It shows where AI is helping and where the data risk sits.
Make it clear that nobody is in trouble for telling you. If people fear a reprimand, they stop mentioning it, and the use carries on out of sight.
Should you ban unapproved AI tools?
No. Banning AI outright is hard to enforce and pushes use further underground. The better approach is to replace unapproved AI tools with a safe route for the tasks people already do:
- Choose one or two approved tools and provide business accounts, so the business controls access, settings and data.
- Check the supplier's terms, including whether your data is used for training and how long it is kept, before rolling it out.
- Switch off settings you do not need, and remove access promptly when someone leaves.
- Show people how to do their common tasks in the approved tool.
When the approved option is easier than the workaround, people use it.
What rules should staff follow?
Staff need three rules: which tools are approved, what information must never go into public AI tools, and how outputs must be checked before use.
Our guide to writing an AI policy covers this in detail, and our UK GDPR and AI checklist explains the supplier checks worth making.
What should you do after an AI data breach in a small business?
If customer data has gone into a public chatbot, handle it methodically: establish the facts, assess the risk, record it and fix the cause. This is general guidance, not legal advice.
- Find out what was shared, which tool and account was used, and when.
- Check the tool's settings and terms to understand whether the data is kept or used for training, and delete the conversation if you can.
- Decide whether it is a personal data breach. Not every incident is reportable. If it is likely to result in a risk to people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it, and if the risk to them is high you must tell the people affected.
- Record the incident and what you did, even if you decide it does not need reporting. UK GDPR expects you to keep a record of all personal data breaches.
- Fix the cause, which usually means an approved tool, clearer rules or training.
The ICO's website explains how to assess and report a breach. If you are unsure, take advice from a data protection specialist.
How do you make it easy for staff to ask about AI?
Name one person people can go to with AI questions, and make asking quick and judgement-free. Encourage staff to suggest new tools or uses rather than quietly trying them.
Many of your best ideas for using AI will come from the people doing the work.
Where Forwardcycle fits
Our safe adoption service helps you bring AI use into the open: an AI usage policy, vendor checks on the tools you approve, a data protection impact assessment and practical staff training. To see where you stand today, take the free AI Readiness Assessment or arrange a free call.