Somewhere in your company this week, someone pasted a customer email into a public AI tool to get a reply drafted faster. Someone else uploaded a spreadsheet of sales figures to summarize it. A third person connected a free note-taking tool to their calendar. None of them thought they were doing anything wrong, and none of them asked.
This is shadow AI: people using AI tools with company data outside any rule the company has set. It is not a fringe habit. It is the default behavior of capable people with a deadline and a tool that works. The question for a company of fifty to five hundred people is not how to stop it. It is how to make the sanctioned route the easy one.
The first response is usually a ban or a policy: no AI tools without approval, signed by everyone. It feels decisive. The result is predictable.
People who found a tool useful keep using it, now quietly, on personal devices and personal accounts, where you cannot see it and cannot help them use it well. The company has swapped visible risk for invisible risk, and lost the one signal it had, which was that people were asking for help.
A prohibition also fails on its own terms. It offers nothing in return. The person with a deadline has to choose between the rule and the work, and the work is what they are measured on.
The second response is to buy tooling that finds shadow use: scanners on the network, reports of which sites staff visit. Detection has a place. It tells you where the demand is. As the main control it fails for two reasons. It sees only what crosses your network, and not the personal laptop on a home connection. And it turns the conversation into one about who was caught.
Both responses treat the behavior as the problem. The behavior is a symptom. The problem is that the company has not offered a way to do what people are trying to do.
A sanctioned path is a route for using AI on company work that is at least as easy as the workaround. It has four parts.
An approved list, with what each tool may be used for. Not a yes or no per tool, but a statement per data class: this tool is fine for public information and drafts, that one is approved for internal documents, and customer personal data or credentials go into neither. Three or four classes are enough.
A request path with a short clock. When someone wants a tool that is not on the list, they know who to ask and that they will have an answer within a week. A request path that takes a month is a ban with extra steps.
A short, plain guide to what not to paste. Customer personal data, credentials and keys, unreleased financial results, contracts under negotiation and anything covered by a client agreement. One page, with examples from the company's own work.
Logging and sampling on the approved tools. The approved tools should record what they are used for, and someone should read a sample each month. This is the same attention that governs agents, applied earlier.
The path is not a restriction. It is a service. People use it because it is the quickest way to do the thing they were going to do anyway, with less risk to them.
Measure the share of AI use that happens on sanctioned tools. You will not have an exact figure, and you do not need one. A short survey twice a year, with a promise that it is not a hunt, asks which tools people use and for what. The answer shows how much of the use is inside the path.
If the share is low, the path is harder or slower than the workaround, and the fix is the path. If it rises over two quarters, the policy is working, and you will have learned what people actually do.
The first survey will show tools you did not expect and uses you did not think of. Resist the instinct to reprimand. Sort what you find into three piles. Uses that are safe and valuable become part of the approved list. Uses that are valuable and risky get a safer route, such as an approved tool with a data agreement or a version that runs inside your own systems. Uses that are risky and not valuable stop, with an explanation.
Treat the people who used the tools early as a resource. They know what works, and they will be the first to tell you whether the sanctioned path is any good.
Imagine a company of 120 people. An anonymous survey finds that about sixty use an outside AI tool weekly, most of them with a free personal account. Roughly a third have pasted something that includes customer names or figures.
The company's first plan is a ban. Instead, it spends a month on the path. It approves one tool with a business agreement for internal documents and drafts. It writes the one-page guide of what not to paste. It names a person who answers requests within five working days. It tells staff that the aim is help, not catching anyone.
Six months later, a second survey finds that about fifty of the sixty regular users are on the approved tool. Ten still use a personal account, mostly for tasks the company then examined and added to the list. Pasting of customer data has dropped to a handful of cases, each of which led to a conversation.
Shadow AI is the stage before agents, and the habits carry across. A company that has learned to offer a sanctioned path for people using chat tools is better prepared to govern agents that act on its systems. The questions repeat: what can the tool reach, who decided, what is logged, and where does a person approve. We cover the agent side in what yours can reach and who decided and in why the threat is your own permission model.
Run a five-question anonymous survey this month: which AI tools do you use, how often, for what kinds of work, with what kinds of data, and what would make you use an approved one instead. Do not ask who. The answers are the first draft of your approved list and your guide, and they tell you which gaps in the sanctioned offering to close first.
We start with a no-risk discovery: we run the survey with you, sort what it finds into the three piles and draft the approved list, the request path and the one-page guide, and you pay for the discovery only if you go on. A build comes with a guaranteed estimate, so if we estimate low, we absorb the difference. After go-live, Managed Technical Operations reads the usage samples each month and keeps the list current.
Offer a path people want to take, and the policy has something to protect.
In a no-risk discovery we look at your CRM, finance and operations systems and who owns each part, and show what a connected system would do differently. You pay only if you proceed. Or see how we approach it.
More on the same problem:
"Something isn't working." "We're outgrowing our tools." "We're afraid to make the wrong move." No-Risk Discovery is a short, practical conversation that gets you clarity before you commit to anything big. We'll tell you if we're a fit. If we're not, we'll tell you that too.
Say who you are and ask. A person replies within one business day.
