Shadow AI is any AI tool staff use for work without the organisation approving it, contracting for it or checking where the data goes. In most Australian organisations it is already widespread. The fix is a factual inventory of what is in use, a tool-by-tool decision on what to keep, and a short policy that makes the safe path the easy one.
Ask the executive team which AI tools the organisation uses and you get a short, comfortable list. Ask the people who do the work and the list triples. A paralegal summarises discovery bundles in a free chatbot. A finance officer pastes a draft board pack into a browser tab to tighten the wording. A sales coordinator builds a spreadsheet macro with a coding assistant and has no idea what it does.
Key takeaways
- Banning AI tools pushes the same behaviour onto personal phones, where you have no visibility.
- Build the inventory from four sources: network logs, expense data, an amnesty survey and your Microsoft 365 or Google Workspace admin reports.
- Decide each tool against the data it touches: sanction, migrate or stop.
- The paid tier of a tool is not automatically safe. The contract and configuration provide the protection.
- Heavily used shadow tools point to the processes most worth automating properly.
What is shadow AI, and why is it different from shadow IT?
Shadow AI is the same pattern as shadow IT a decade ago, when personal file-sharing and email moved company files around before anyone noticed. The difference is speed. A staff member can start using a capable AI tool in under a minute, for free, from any device, and the tool may keep a copy of whatever they paste in.
The instinct is to ban it. That rarely works. The better first move is to find out what is in use, decide tool by tool, and write a policy staff can follow without feeling they have to hide.
Why is a quiet chatbot tab a real exposure?
When a staff member pastes a customer record, a contract or an unreleased financial result into a consumer AI tool, personal and commercial information leaves your control. It lands on a third party's servers, often offshore, and may be retained to improve the vendor's models.
Under the Privacy Act 1988, the organisation carries the obligations for personal information. Australian Privacy Principle 6 governs the purposes for which personal information may be used or disclosed, and APP 11 requires reasonable steps to protect it from misuse and unauthorised disclosure. The OAIC's guidance on using commercially available AI products makes the same point: the organisation, not the individual staff member, carries the obligation.
There is a commercial exposure on top. A pricing model, acquisition memo or engineering drawing pasted into a free tool has left the premises. You cannot claw it back, and you often cannot prove it happened.
| Shadow AI (free consumer tool) | Sanctioned AI (business account) | Impact | |
|---|---|---|---|
| Where data lands | Vendor servers, often offshore | Your business account, Australian region where required | Controlled |
| Training on your data | Often enabled by default | Contractually excluded | Excluded |
| Audit trail | None you can see | Logged and reviewable | Visible |
| Who carries the risk | The organisation, unknowingly | The organisation, with controls | Managed |
| Access when staff leave | Personal account, stays with them | Revoked with their login | Revocable |
In most cases staff are trying to do good work faster, and the shadow tool is helping them. That is exactly why a ban fails. The job is to move useful behaviour onto ground you control and stop what cannot be made safe.
How do you build a shadow AI inventory?
You cannot govern what you cannot see. Treat the inventory as discovery, not enforcement. If staff think it is a hunt for someone to blame, they will tell you nothing.
- Pull the signalsNetwork logs, expense claims, browser data
- Ask the peopleAmnesty survey, no blame for honesty
- Map data flowsWhat gets pasted into each tool
- Rank by exposureSensitivity of data times usage
Four sources together give a reliable picture:
- Network and firewall logs show which AI domains staff reach from managed devices.
- Expense and card data surfaces paid subscriptions bought personally and reimbursed, which is where capable tools often hide.
- An anonymous amnesty survey is usually the most useful source, because people disclose honestly when the answer will not be held against them.
- Microsoft 365 or Google Workspace admin reports show sanctioned and some unsanctioned activity inside your environment.
Map each tool to the data that goes into it. A marketing assistant drafting social captions is low exposure. The same chatbot receiving customer complaint emails with names and account numbers is high exposure doing the same mechanical task. Rank by data sensitivity multiplied by frequency, and you get a worklist ordered by real risk.
The output is a single register: tool, owner, department, data category, rough frequency and a first read on exposure. It becomes the backbone of your policy.
How should you decide which shadow AI tools to keep?
A blanket decision is the wrong shape. Some tools should be adopted properly, some replaced with a governed equivalent and some stopped.
What does this tool actually touch?
- No customer or confidential data, clear productivity gainSanction it: procure a business tier with a data agreement
- Sensitive data, but a governed equivalent existsMigrate users to the approved tool, then block the consumer one
- Sensitive data, no safe version possibleStop it, and give staff a supported way to do the job
- Unknown data handling, vendor will not discloseTreat as stop until proven otherwise
The common mistake is buying the paid tier and assuming it is safe. A business or enterprise agreement should exclude training on your content, keep data in an Australian region where that matters, and give you an audit trail. Personal tiers of the same product usually do none of this.
Where sensitive data is involved and no consumer tool can be made safe, build the capability inside systems you control. That is the reasoning behind private AI infrastructure: the AI runs on your infrastructure in Australia, your cloud or your own servers, and staff get a supported tool instead of a forbidden one.
How do you write a shadow AI policy people will follow?
A policy that only says no gets routed around. A usable AI usage policy does three things:
- Names what is allowed, by role and data type, so people do not have to guess.
- Offers a fast way to request a new tool, so the honest path is quicker than the shadow one.
- States plainly what must never be pasted into any external tool, in language a busy person reads once and remembers.
Keep the banned list short and concrete: customer personal information, anything under contractual confidentiality, unreleased financial results, credentials and security details, and employee records. Then list approved tools for everyday drafting and analysis so the policy grants permission as well as prohibition.
| Policy people route around | Policy people follow | Impact | |
|---|---|---|---|
| Tone | Blanket ban on 'AI tools' | Allowed uses named by role | Clearer |
| Requesting a new tool | No process, so nobody asks | One form, answered in days | Faster path |
| The banned list | Vague 'confidential data' | Five named data categories | Concrete |
| Enforcement | Discovered after an incident | Register reviewed quarterly | Ongoing |
| Staff response | Hide usage on personal phones | Use the approved path | Visible |
Anchor the policy to a recognised reference so it holds up to a board or a customer's due diligence. The Department of Industry, Science and Resources publishes voluntary AI guidance for Australian organisations covering accountability, record keeping and human oversight, which maps well onto an internal policy. Organisations wanting a certifiable management system can align to ISO/IEC 42001, the international standard for AI management systems. See our guide to ISO 42001 in Australia.
How do you keep the inventory current?
Shadow AI is not a project you finish. New tools appear every month, staff change roles, and a vendor can switch on a feature that changes the data story overnight.
- Weeks 1-3InventoryRun the amnesty survey and pull the logs
- Weeks 4-6DecideSanction, migrate or stop, tool by tool
- Weeks 7-10PublishPolicy, approved tools, request process
- QuarterlyReviewRefresh the register, retire and add tools
The quarterly review is short: re-pull the network and expense signals, compare against the register, and resolve anything new with the same decision. The organisation is never again surprised by what its own people use.
There is a second benefit. Every shadow tool in heavy use signals a slow or painful task that staff fixed themselves. Those are the first processes worth doing properly, which is the natural handover into process automation on tools you control.
- Exposure found before an incidentKnown, not guessed
- Tools consolidated onto governed tiersFewer, safer
- Processes surfaced for proper automationRanked by real use
- Position for a board or customer auditDefensible
Where does shadow AI governance fit in a wider AI plan?
Once you know what staff use and why, the question becomes which of those tasks deserves a measured build inside your own systems, and in what order. That is the work of an AI strategy engagement: start from the processes the inventory surfaced, baseline them, and prove a safe version alongside your team before it touches a customer.
Professional services firms feel this first, because their work is text and their raw material is confidential, as covered in our guide to AI for accounting firms across Xero and MYOB. If you are also weighing up Microsoft's assistant, read our Copilot readiness and permissions audit, because Copilot surfaces everything a user can already open.
How Solve8 can help
Our consultants run shadow AI inventories, draft usage policies and shortlist the processes worth building properly on your own infrastructure. Start with our AI strategy service or talk to us and bring your list of tools, however incomplete.
