Shadow AI is the same pattern as shadow IT a decade ago. People adopt a tool that makes their work easier, the organisation finds out later, and the response is a policy that pushes the behaviour out of sight rather than stopping it.
What actually gets pasted
- Draft proposals and pricing, to improve the wording.
- Client emails, to soften a difficult reply.
- Spreadsheets of figures, to explain a trend.
- HR material — performance notes, disciplinary drafts — which is often the most sensitive of all.
Why the ban fails
A ban removes the tool from the corporate laptop. It does not remove the deadline. The work moves to a personal phone, where you have no logging, no retention control, and no idea what left the building.
The replacement has to be better, not just permitted
Staff switch when the sanctioned tool is genuinely more useful for their work. A tool that already has the company's own documents indexed beats a general chatbot for internal questions, because it answers from your handbook and your contracts rather than from the open internet.
- Role-based access, so people see only the folders they should.
- An audit log of uploads, logins, and deletions.
- Answers with citations, so nobody has to take the output on trust.
- Deletion that genuinely removes content from search and answers.
A policy people can follow
- Name the approved tool and what it may be used for.
- State plainly what must never go into any external service.
- Give one route for exceptions, with a named owner.
- Review the audit log monthly for the first quarter, then quarterly.