Quick answer: Shadow AI is the use of unapproved consumer AI tools, like personal ChatGPT or Gemini accounts, by employees at work, without the business’s knowledge or any rules around what data can be shared. Microsoft’s UK research found that 71% of UK employees have used unapproved AI tools at work, and 51% do so weekly. The fix is not a ban. It’s an approved AI tool, a simple data-handling policy, and a 30-minute staff briefing.
If someone on your team used AI today, would you know which tool they used or which company data they pasted into it?
For most SME owners, the honest answer is no. This is the problem we call Shadow AI.
Shadow AI is when employees use consumer AI tools at work that the business hasn’t approved, secured, or even noticed. It’s the AI equivalent of staff signing up for random free software with their personal email, except this time, the “software” is something they might be pasting customer lists, contracts, or financial figures into.
Microsoft’s UK research on workplace AI use puts numbers on it:
That last figure is the sleeper risk. AI helping to draft an email is one thing. AI being handed customer financial details is another.
Not because they’re reckless. The research found two main reasons:
In other words, Shadow AI is usually a leadership gap, not a staff problem. Your team is trying to work faster than the business has allowed for. That’s actually a positive signal; employees using AI report saving an average of 7.75 hours per week on admin tasks. The goal is to capture that upside safely, not switch it off.
The core risks are:
Banning AI just drives it further into the shadows; people will use it on their phones instead. A sensible response has three parts:
For most SMEs on Microsoft 365, that’s Copilot Chat (included with Business Premium licensing) or Microsoft 365 Copilot. It sits inside your existing Microsoft security boundary, and your data isn’t used to train public models.
We recommend a three-tier traffic light system that staff can actually remember:
Give people a channel to ask, “Is this OK?” without getting told off. Culture beats policy documents every time.
If you want a practical starting point this week:
You’ll reduce risk while keeping the productivity upside.
AI is already in your business. You either provide a policy and guardrails, or you unthinkingly carry the risk. A simple policy and sensible platform choices are far cheaper than a data breach or a conversation with the ICO.
Bruce is running a free webinar on AI for SMEs on 25 June. Register here to join live.
A one-page policy you can adapt for your business in under 15 minutes. No jargon, no fluff.
Shadow AI is when staff use AI tools at work that the business hasn’t approved or secured, typically personal ChatGPT, Gemini, or similar accounts, often pasting in company information without realising the risk.
No, it’s not illegal in itself. But if employees enter personal data (customer or staff details) into a consumer AI tool, your business could breach UK GDPR. The legal risk sits with the business, not the employee.
Generally no. Ban AI on work machines and staff simply switch to their personal phones, which then become an unmonitored conduit between your company data and consumer AI tools, with zero visibility for you. It’s more effective to provide an approved tool, set clear data rules, and train staff on what can and can’t be shared.
For businesses already on Microsoft 365, Copilot Chat or Microsoft 365 Copilot is usually the safest starting point, because it operates within your existing Microsoft security and compliance boundaries, and your prompts aren’t used to train public models. Businesses that want their teams to use multiple AI models (Claude, Gemini, ChatGPT) safely are increasingly looking at AI gateways, a single controlled, logged route through which all AI traffic passes.
Keep it to one page: name the approved tools, set out what data is Green, Amber, and Red to share, explain that AI output must be checked by a human before use, and tell staff where to ask questions. A policy nobody reads is no policy at all.
Very. Microsoft’s UK research found 71% of employees have used unapproved AI tools at work, and analysts at Gartner predict that 40% of enterprises will experience Shadow AI-related security incidents by 2030.
Bruce Skinner is CEO of Alto, a proactive IT and cybersecurity partner for UK SMEs. If you’d like help choosing an approved AI platform or writing an AI usage policy your team will actually follow, get in touch.
