There is a conversation happening in most businesses that never reaches the IT department. Somebody has a long document to summarise, a difficult email to write, or a spreadsheet they cannot make sense of, and there is a free tool one browser tab away that will do it in seconds. So they paste it in.
They are not being reckless. They are being efficient, with a tool nobody told them not to use, because nobody has said anything about it at all. That silence is the actual problem.
What is actually at stake
The risk is not that an AI tool is malicious. It is that your confidential material has left your control and landed somewhere you cannot describe, under terms you have not read.
- You lose the ability to answer a basic question. If a client asks where their data has been processed, “we are not sure” is not an answer that survives a contract review.
- Consumer tiers and business tiers are not the same product. Free and personal plans have historically been far more likely to retain input for model improvement than paid business and enterprise tiers, which typically commit not to train on your content. The difference is in the terms, not in the interface, and most staff never see it.
- There is no log. Nothing in your environment records that a client file went into a chat window, so you cannot scope an incident afterwards.
- Regulated data makes it concrete. Health records, cardholder data, controlled unclassified information and privileged legal material all carry obligations that do not pause because a tool was convenient.
For a professional services firm this lands harder than for most. Pasting a client matter into a consumer chatbot is, at minimum, an uncomfortable conversation about confidentiality — a point we made in more detail in Privilege, Deadlines and Downtime.
Banning it does not work
The instinct is to block the domains and send a stern email. It fails for a reason worth understanding: the tool is genuinely useful, it is available on a personal phone sitting on the desk, and the person using it has a deadline. A block moves the activity onto a device you do not manage and cannot see, which is strictly worse than the situation you started with.
The organisations handling this well are not the ones with the strictest policy. They are the ones who gave people a sanctioned option quickly enough that the unsanctioned one stopped being necessary.
What to do instead
- Provide a tool on business terms. A paid tier bought through your tenant, covered by a data processing agreement, with training on your content switched off. This single step removes most of the risk and most of the motivation to go elsewhere.
- Write a policy people can actually follow. Two sides of a page, with worked examples: here is what you may paste, here is what you may not, here is the approved tool, here is who to ask. A policy that only says no gets ignored.
- Classify by harm, not by blanket rule. Drafting a marketing paragraph is not the same act as summarising a client matter. Treating them identically trains people to disregard the whole thing.
- Say something about accuracy, not only confidentiality. These tools produce confident, fluent text that is sometimes wrong. Anything leaving the business should be checked by the person whose name is on it.
- Review the integrations. AI features are arriving inside tools you already run, and some request broad access to mailboxes and files through OAuth. That consent should be reviewed by somebody, not granted by whoever clicked first.
- Ask, without blame. A short, genuinely non-punitive survey of what people already use will tell you more about your exposure than any technical control.
Shadow AI is not a discipline problem. It is a procurement problem wearing a disguise: people reach for an unapproved tool when the approved one does not exist.
Where this touches your other controls
Two connections are worth making explicitly. The first is identity: an approved AI tool should sit behind the same single sign-on and multi-factor authentication as everything else, so that access leaves when the person does. The same reasoning that makes phishing-resistant authentication worthwhile applies here, and we covered it in The Phishing Trap.
The second is data handling. Deciding what may be pasted into a chat window is the same exercise as deciding what must be encrypted and where it may travel. If you have already sorted your information by sensitivity, as described in Data Safeguards: From Storage to Transit, you have most of the answer and can reuse the categories rather than invent new ones.
Where to start this month
- Find out what is already in use. Ask, do not audit.
- Buy one sanctioned tool on business terms and tell everybody it exists.
- Publish two pages of guidance with real examples from your own work.
- Review OAuth consents and restrict who can grant them.
- Add one line to your client security questionnaire answers describing how you handle it, because you will be asked.
The businesses that get into trouble here will not be the ones whose staff used AI. They will be the ones who never decided how.