If you have never approved an AI tool for your business, your staff are almost certainly using some anyway. A free chatbot account to clean up an email. A browser extension that summarizes web pages. A meeting note-taker that joins client calls and sends everyone a transcript. None of it was rolled out by IT, none of it was reviewed, and much of it sees business data every day.
That is shadow AI. It is not a sign that your people are careless. It is a sign that AI is genuinely useful and very easy to start using. The goal of this guide is to help you see what is actually in use, understand the risk, and bring it under sensible control without taking useful tools away from people who rely on them.
What counts as shadow AI
Shadow AI is any AI tool used for work without the knowledge or approval of whoever is responsible for technology and risk in your business. It usually falls into a few categories.
Standalone chatbots and assistants
General-purpose AI chat tools are the most common entry point. Staff use them to draft emails, rewrite proposals, summarize documents, write formulas, and answer questions. The risk comes from what gets pasted in: customer lists, contract language, financial figures, internal plans, and sometimes source code.
Browser extensions
AI extensions for writing, summarizing, translating, and grammar checking often request broad permissions, such as the ability to read every page you visit. That can include web-based email, your CRM, your accounting system, and patient or client portals.
Meeting note-takers
AI note-takers join video calls, record audio, and produce transcripts and summaries. They are convenient, but they can capture confidential client discussions, and they sometimes join meetings automatically from a single user’s calendar, including meetings with outside parties who never agreed to be recorded.
AI features inside tools you already pay for
Many familiar apps have added AI features, sometimes turned on by default. These are not always shadow AI in the strict sense, because the vendor is already approved, but they still change what happens to your data and deserve a review.
Why shadow AI is a business risk
The concern is not that AI is bad. It is that unmanaged AI creates exposure you cannot see or measure.
- Data leakage. Information typed into public AI tools may be stored, reviewed by the provider, or used to improve its models, depending on the service and the account type. Free and personal accounts often come with different terms from business plans.
- Compliance exposure. If health, financial, or other personal data is processed by an unapproved tool, you may be out of step with obligations such as HIPAA, the FTC Safeguards Rule, or state privacy laws, depending on your industry and what data is involved.
- Insurance questions you cannot answer. Cyber insurance applications and renewals increasingly ask about AI use. If you do not know what is in use, you cannot answer accurately, and an inaccurate answer can cause problems later.
- No audit trail. Personal accounts leave no business record. When an employee leaves, their AI history leaves with them, and you have no way to know what was shared.
- Inconsistent quality. AI output can be wrong in confident-sounding ways. Without review rules, inaccurate content can reach customers under your name.
How to find the AI tools already in use
Discovery works best when you combine a technical review with honest conversation. Neither alone gives you the full picture.
Look at the technical evidence
Start with the sources you already have:
- Sign-in and identity records. If staff use work email to sign in to outside services, your identity platform may show which third-party apps they have connected or granted access to.
- Browser extensions. Managed browsers can report installed extensions across company devices. Look for AI writing, summarizing, and meeting tools.
- Network and DNS activity. Traffic to well-known AI services shows which ones are being reached from your network and how often.
- Expense reports and card statements. Small monthly subscriptions to AI tools often show up here first.
- Calendar and meeting platforms. Note-taker bots usually appear as meeting participants or connected apps.
Ask people directly
Then ask. A short, non-judgmental survey or a few team conversations will surface tools the technical review misses, such as AI on personal phones. Be explicit that the goal is safer adoption, not discipline. People will tell you what they use, and why, if they believe the answer will lead to better tools rather than punishment. The “why” is valuable: it tells you which jobs your team needs AI for.
How to assess what you find
Once you have a list, assess each tool against a few simple questions:
- What data does it touch? Public information, internal business data, or regulated and confidential data such as health, financial, or client records.
- What type of account is it? A business plan with an agreement you have reviewed is very different from a free personal account.
- What does the provider do with the data? Check whether inputs are retained, for how long, and whether they are used for training.
- Who uses it, and for what? One person experimenting is different from a whole department relying on it daily.
- Does output reach customers or affect decisions? That raises the bar for review.
From there, sort each tool into one of three groups: approve, approve with conditions (such as a business account, specific settings, or limits on the data allowed), or block and replace.
How to govern it without killing productivity
Banning AI outright rarely works. It pushes use onto personal devices, where you have even less visibility, and it gives up real productivity gains. A better approach gives people a safe path.
Approve good tools
If staff are using AI to draft and summarize, give them an approved tool for it, on a business plan with terms you have reviewed. The fastest way to reduce risky shadow AI is to offer a sanctioned alternative.
Write a short, clear policy
An AI acceptable use policy does not need to be long. It should cover which tools are approved, what data must never go into AI tools, when a person must review AI output, how to request a new tool, and who to ask with questions. Have staff read and acknowledge it.
Set a few technical controls
Depending on your environment, that can include restricting browser extensions to an approved list, blocking specific high-risk services, limiting which third-party apps can connect to company accounts, and adjusting meeting settings so note-takers cannot join without permission.
Keep watching
New AI tools appear constantly, and existing apps keep adding AI features. Shadow AI discovery is not a one-time cleanup. Build it into a regular review, so your inventory stays current and your policy keeps up with how people actually work.
A quick shadow AI checklist
- We have a list of the AI tools in use across the business
- We know what kinds of data each tool touches
- Approved tools run on business accounts with reviewed terms
- We have a written AI use policy that staff have acknowledged
- Browser extensions and connected apps are restricted or reviewed
- Meeting note-takers follow clear rules about recording and consent
- Someone owns AI risk and reviews the inventory regularly
- We can answer our insurer’s AI questions accurately
How we can help
Our Shadow AI Assessment follows four steps: discover the AI apps, extensions, and accounts in use; assess what data each one touches and rank the risk; help you govern by approving safe tools, blocking risky ones, and rolling out a clear policy; and report in plain language you can share with leadership, auditors, and your insurer. From there, we can build a full AI governance program and keep monitoring as new tools appear, backed by GDS Technology’s managed IT and cybersecurity experience since 2005.