Shadow AI: What Your Staff Are Already Doing With Chatbots

If you have not given your team an official AI tool, some of them have picked their own. They are on a personal ChatGPT, Claude or Gemini account, often on their phone, using it to draft emails, summarise documents and get unstuck. This is shadow AI, and in most small businesses it is already happening.

Why it happens

Nobody is being sneaky. Shadow AI grows from sensible motives.

• The tools are free and instant. There is no procurement, no approval, no install.
• The benefit is personal and immediate. A task that took forty minutes takes ten. People notice.
• There is no official guidance. Silence from management reads as "no one minds".
• People worry about looking lazy. Some staff fear that admitting they use AI will suggest they cannot do their job, so they keep quiet.

The last point matters. If you want an honest picture, your team has to believe that using these tools is acceptable and that telling you will not backfire.

What the actual risks are

Most fear-mongering here is vague. The real risks are specific, and they come down to a few categories.

Data leaving the building. When someone pastes text into a chatbot, that text goes to a third party. Depending on the plan and settings, it may be retained, reviewed for safety, or used to improve the service. Consumer plans and business plans often differ on this. Check current terms for any tool your team uses, because they change.

The sensitive material is the stuff people paste without thinking: client names and contact details, contract clauses, staff matters, financial figures, health information. If your business handles personal information, the Privacy Act and your own contracts may limit where it can go. This is general information, so speak to a lawyer about your obligations.

Wrong answers used as fact. Chatbots produce plausible text that is sometimes false. A staff member who quietly relies on one for a quote, a legal clause or a technical spec may pass the error to a customer.

Inconsistent work. Five people using five tools with five different styles produce uneven results, and nobody can review or improve a process they cannot see.

Lost knowledge. Good prompts and workflows stay in one person's private account. When they leave, so does the know-how.

What not to do

Resist the urge to ban everything. A blanket prohibition mostly pushes the behaviour out of sight. People who found real value will continue on personal devices, and now you cannot ask them what they are doing or help them do it more safely.

Avoid heavy surveillance as well. Monitoring software can damage trust and rarely captures phone use anyway.

What to do instead

A sensible response takes a week or two and costs little.

1. Ask openly. At a team meeting or in a short anonymous form, ask which tools people use and for what. Say clearly that you are asking so you can help, not punish.
2. Look for the useful tasks. The answers tell you where AI helps your business. If three people use it to draft customer replies, that is a real opportunity worth doing properly.
3. Write a one-page policy. Cover which tools are approved, what must never be pasted (customer personal details, passwords, anything under a confidentiality agreement), and what must be checked by a person before it leaves the business. Plain words beat legal language.
4. Provide an approved option. A business plan of ChatGPT, Claude, Gemini or Copilot typically gives better data controls than a free personal account. Check the terms for the plan you choose, and match the tool to your existing stack.
5. Show people how. A policy nobody understands is decoration. Walk through examples of what is fine and what is not.
6. Revisit it. The tools change quickly, so review the policy every few months.

Once you have an approved tool and a clear policy, shadow AI turns into ordinary AI use, which you can improve. This is the same ground covered in buying AI seats is not adopting AI, only approached from the other direction. Instead of too little use, you start with uncontrolled use.

Getting help

If you want someone to run this properly, 21Labs, a Sydney agency serving businesses across Australia, handles it as part of AI adoption: finding out what your team already does, choosing sensible tools, writing guidance that people read, and building habits around the work. Discovery is free and every enquiry gets a reply within 24 hours.