Shadow AI Is Already in Your Business

The tools are already in the building

Ask the executive team which AI tools the business uses and you will get a short, comfortable list. Ask the people who do the work and the list triples. A paralegal is summarising discovery bundles in a free chatbot. A finance officer is pasting a draft board pack into a browser tab to tighten the wording. A sales coordinator built a spreadsheet macro by describing it to a coding assistant and has no idea what the macro actually does.

This is shadow AI: the AI tools staff adopt on their own, without IT approval, without a contract, and without anyone checking where the data goes. It is the same pattern as shadow IT a decade ago, when Dropbox and personal Gmail moved company files around before anyone noticed. The difference is speed. A staff member can start using a capable AI tool in under a minute, for free, from any device, and the tool keeps a copy of whatever they paste in.

The instinct is to ban it. That rarely works and usually makes things worse, because a ban pushes the same behaviour onto personal phones where you have no visibility at all. The better first move is to find out what is actually in use, decide tool by tool what to keep, and write a policy that staff can follow without feeling they have to hide. That sequence is the subject of this post.

Why a quiet chatbot tab is a real exposure

The risk is not that AI is dangerous in the abstract. The risk is specific and it has a name under Australian law. When a staff member pastes a customer record, a contract, or an unreleased financial result into a consumer AI tool, personal and commercial information leaves your control and lands on a third party's servers, often offshore, often retained to improve the vendor's models.

Under the Privacy Act 1988, an organisation that holds personal information has obligations for how it is used and secured. Australian Privacy Principle 6 governs the purpose for which personal information may be used or disclosed, and Australian Privacy Principle 11 requires reasonable steps to protect it from misuse and unauthorised disclosure. Pasting a client's details into an unvetted tool with unknown data handling is hard to square with either. The Office of the Australian Information Commissioner has published guidance on using commercially available AI products that makes the same point: the business, not the staff member, carries the obligation.

There is a commercial exposure on top of the legal one. A pricing model, an acquisition memo, or an engineering drawing pasted into a free tool is a trade secret that has left the premises. You cannot claw it back, and you often cannot even prove it happened.

The point of the table is not that staff are reckless. In most cases they are trying to do good work faster, and the shadow tool is genuinely helping them. That is exactly why a ban fails. The job is to move the useful behaviour onto ground you control and shut down the behaviour that cannot be made safe.

Step one: inventory what is actually in use

You cannot govern what you cannot see. The first pass is a factual inventory of which AI tools touch the business, who uses them, and what data goes in. Treat this as discovery, not enforcement. If staff think the exercise is a hunt for someone to blame, they will tell you nothing and the shadow estate will go deeper underground.

Four sources together give a reliable picture. Network and firewall logs show which AI domains staff reach from managed devices. Expense and card data surfaces the paid subscriptions bought on personal cards and reimbursed, which is where the capable tools usually hide. A short anonymous survey, run as an amnesty, is the single most useful source, because people will tell you what they use and why when they are sure the answer will not be held against them. If the business runs Microsoft 365 or Google Workspace, the admin console and data governance reports show sanctioned and some unsanctioned activity inside the tenant.

Map each tool to the data that goes into it. A marketing assistant drafting social captions in a chatbot is a low exposure. The same chatbot receiving customer complaint emails with names, addresses and account numbers is a high exposure doing the same mechanical task. Rank the inventory by the sensitivity of the data multiplied by how often it is used, and you have a worklist ordered by real risk rather than by which tool has the scariest reputation.

The output of step one is a single register: tool, owner, department, data category, rough frequency, and a first read on exposure. Keep it to one page per tool. The register is a living document, and it becomes the backbone of the policy you write next.

Step two: decide tool by tool, not all at once

A blanket decision is the wrong shape. Some shadow tools should be adopted properly, some replaced with a business equivalent, and some stopped. Decide against the data each tool touches and whether a governed version exists.

The common mistake is to sanction a tool by buying the paid tier and assuming the paid tier is safe. It often is not. The protection you need comes from the contract and the configuration, not the price. A business or enterprise agreement should exclude training on your content, keep data in an Australian region where that matters, and give you an audit trail. The free and personal tiers of the same product usually do none of this, and the gap between them is where most of the exposure sits.

Where sensitive data is involved and no consumer tool can be made safe, the honest answer is to build the capability inside systems you control. That is the argument for running capable AI in your own environment rather than pasting into someone else's, and it is the same reasoning behind a private AI infrastructure approach: the data never leaves your tenant, and staff get a supported tool instead of a forbidden one. The deciding factor is who holds the data and who carries the risk when something goes wrong, which is a procurement and architecture question far more than a question of model quality.

Step three: write a policy people will actually follow

A policy that only says no is a policy staff route around. A usable AI policy does three things. It names what is allowed, by role and by data type, so people do not have to guess. It gives a fast, low-friction way to request a new tool, so the honest path is quicker than the shadow one. And it states plainly what must never be pasted into any external tool, in language a busy person reads once and remembers.

Keep the banned list short and concrete. Customer personal information, anything covered by confidentiality in a contract, unreleased financial results, credentials and security details, and employee records are the categories that belong there for almost every business. Spell out the approved tools for everyday drafting and analysis so the policy gives permission, not only prohibition. A policy that grants a clear yes is followed far more often than one that only lists the noes.

Anchor the policy to a recognised standard so it holds up to a board or a customer's due diligence. The Australian Government's Voluntary AI Safety Standard, published by the Department of Industry, Science and Resources, sets out guardrails around accountability, record keeping and human oversight that map well onto an internal policy. For businesses that want a certifiable management system, ISO/IEC 42001 is the international standard for AI management systems and gives the same structure a formal name. You do not need either to start, but writing the policy so it lines up with one of them saves rework later and reads as competence to anyone who asks.

Step four: keep it current, because the estate keeps moving

Shadow AI is not a project you finish. New tools appear every month, staff change roles, and a vendor can switch on a feature that changes the data story overnight. Treat the inventory and policy as a standing process with a light quarterly rhythm rather than a one-off clean-up.

The quarterly review is short. Re-pull the network and expense signals, compare against the register, and resolve anything new with the same tool-by-tool decision. Most quarters this takes an afternoon. The value is that the business is never again surprised by what its own people are using, and the policy stays close enough to reality that people keep following it.

A good shadow AI programme produces a second benefit that is easy to miss. The inventory is the clearest map you will ever get of where AI is genuinely helping. Every shadow tool in heavy use is a signal that a real task is slow or painful, and that staff found their own fix. Those are the first processes worth doing properly, which is the natural handover from governance into a process automation programme built on tools you control.

Where this sits in a wider AI plan

Finding and governing shadow AI is the groundwork for everything that follows. Once you know what staff use and why, the question becomes which of those tasks deserves a proper, measured build inside your own systems, and in what order. That is the work of an AI strategy engagement: start from the processes the inventory surfaced, baseline them, and prove a safe version in shadow mode before it touches a customer.

Professional services firms feel this first, because their work is text and their raw material is confidential. The same discipline applies in accounting and bookkeeping firms rolling out AI across Xero and MYOB, where client financials are exactly the data that must never land in an unvetted tool. If your organisation is also weighing up Microsoft's own assistant, the related exposure is covered in detail in our walkthrough of the Copilot permissions audit to run before you buy the licences, because Copilot surfaces everything a user can already open and inherits every oversharing problem underneath it.

Shadow AI is a sign of demand, not disobedience. Your people have told you, by their behaviour, that AI helps them do the work. The task is to meet that demand on ground you control. If you want help turning a messy shadow estate into an inventory, a workable policy and a shortlist of processes worth building properly, that is the kind of scoping an Australian AI consultancy does first, and it is a short conversation to start. Have a look at how we work through that with you and bring your own list of tools, however incomplete.

Common Questions

What is shadow AI?

Shadow AI is any AI tool that staff use for work without the organisation approving it, procuring it, or checking how it handles data. It is the AI version of shadow IT. Typical examples are free chatbots used to summarise documents, browser extensions that rewrite text, and coding assistants that staff adopt on personal accounts. The defining feature is that nobody in the business has verified where the data goes or who can read it afterwards.

Should we just ban AI tools at work?

A blanket ban rarely works and usually makes the exposure worse, because staff move the same behaviour onto personal phones where the business has no visibility. The approach that holds is to inventory what is in use, decide tool by tool whether to sanction, migrate or stop each one, and give staff an approved way to do the task so the safe path is also the easy one. A policy that only says no gets routed around.

What are the legal risks of staff using consumer AI tools?

Under the Privacy Act 1988, the organisation holds the obligation for personal information, not the individual who pasted it in. Australian Privacy Principle 6 covers the purpose of use and disclosure, and Australian Privacy Principle 11 requires reasonable steps to secure the information. Putting customer or employee data into a tool with unknown, often offshore data handling is difficult to reconcile with either. There is also a commercial risk, because confidential business information pasted into a free tool has effectively left the building.

How do we find out which AI tools staff are actually using?

Combine four sources. Network and firewall logs show which AI services managed devices reach. Expense and card data surfaces paid subscriptions bought personally and reimbursed. An anonymous amnesty survey is the most useful single source, because people disclose honestly when the answer will not be used against them. If you run Microsoft 365 or Google Workspace, the admin and data governance reports add tenant-side activity. Together these give a register you can rank by data sensitivity and frequency.

Which AI standard should an Australian business align its policy to?

For most businesses the Australian Government's Voluntary AI Safety Standard, from the Department of Industry, Science and Resources, is the right reference point, because it sets out practical guardrails around accountability, record keeping and human oversight. Organisations that want a certifiable management system can align to ISO/IEC 42001, the international standard for AI management systems. You can write a workable policy before adopting either, but lining it up with one saves rework and reads as competence in an audit.

Related Reading

• The Microsoft 365 Copilot permissions audit to run before you buy
• An AI governance framework for Australian organisations
• Privacy Act compliance for AI in Australia
• ISO/IEC 42001: the AI management system standard in Australia
• What Australian boards should ask before approving AI
• AI for accounting firms across Xero and MYOB