Your employees may already be using AI at work, whether you’ve approved it or not.
Someone might use ChatGPT to help write an email. Another employee might upload a customer document to an AI tool for a quick summary. Maybe your team has started using AI meeting assistants without considering where those recordings and transcripts are stored.
These tools can make everyday work easier, and employees aren’t necessarily doing anything with bad intentions. They’re simply finding ways to get their jobs done.
But there’s a question business owners need to be asking: Do you know what information your employees are sharing with AI?
David Wolf, VP at Just Solutions and a cybersecurity professional holding CISSP, CEH, and CCISO credentials, believes businesses need to approach AI differently. Rather than trying to stop employees from using it, organizations should focus on understanding how it’s being used and establishing appropriate safeguards.
Here’s what that looks like in practice.
What Is Shadow AI?
Shadow AI refers to employees using artificial intelligence tools for work without their organization’s knowledge, approval, or oversight.
The term comes from Shadow IT, which describes employees adopting software or technology outside their company’s established IT processes.
Today, AI is becoming increasingly difficult to separate from everyday business applications.
It’s built into search engines, browsers, meeting platforms, and software employees already use. Some tools require little more than opening a website or creating a free account.
That accessibility is part of what makes AI useful, but it also introduces new risks.
An employee might upload a customer proposal to get help rewriting it without realizing the document contains confidential pricing. Another might connect an AI assistant to their work email without understanding how much information the application can access.
The concern isn’t necessarily the tool itself. It’s the lack of visibility into how it’s being used.
As Wolf explained:
“The problem is not the tool. It really is the lack of visibility of who’s using it, which accounts they use, and what data they’re sharing with it.”
Why Banning AI at Work Isn’t the Answer
Some businesses respond to AI-related concerns by prohibiting employees from using it altogether.
While that might seem like the safest option, it can create a different problem.
Employees who find AI helpful may continue using it through personal accounts or on their own devices. The business loses visibility into how those tools are being used, making it even harder to protect company information.
Wolf encourages organizations to look at the situation from the employee’s perspective.
If someone is using AI to finish a task faster, the better question might be whether the business can provide an approved tool that accomplishes the same thing more securely.
AI can support productivity without giving employees unrestricted access to company information.
The challenge is finding that balance.
Personal vs. Company-Managed AI Accounts: Why It Matters
One of the first steps in managing Shadow AI is establishing a clear distinction between personal and company-managed AI accounts.
Think about how your organization handles email.
Employees have personal email addresses, but you probably wouldn’t want them using those accounts to exchange confidential customer information or manage sensitive business communications.
AI should be approached with similar boundaries.
When employees use personal AI accounts for company work, the organization may have limited control over how information is stored, retained, or shared.
Company-managed AI environments can provide additional administrative controls, depending on the provider, subscription, and configuration.
Wolf recommends keeping personal and business AI activity separate, just as organizations already do with other workplace technology.
A paid AI subscription doesn’t automatically mean an account is appropriate for business use. Organizations should evaluate the specific plan, data-handling practices, and security settings before approving it.
Employees should understand which tools they can use and what information is permitted within those environments.
Do You Know Where Your Company’s Data Lives?
Before a business can effectively manage AI, it needs to understand its existing information environment.
Wolf raises an important question:
“Where is your data? Then the next question is, who has access to it?”
Company information is often spread across shared drives, cloud storage, email systems, and business applications.
Over time, permissions change. Documents are shared between departments, employees leave, and vendors gain access to systems.
Now AI is being introduced into those environments.
If a business hasn’t established clear controls around its information, connecting AI tools to those systems can introduce additional exposure.
Start With Data Classification
Not all business information requires the same level of protection.
A publicly available brochure doesn’t need the same safeguards as an employee’s personnel file or a confidential customer contract.
Businesses should identify sensitive information and establish appropriate access controls.
One approach is to classify information into categories such as:
- Public: Information approved for external distribution.
- Internal: Information intended for employees and authorized business users.
- Confidential: Sensitive customer or company information requiring restricted access.
- Restricted: Highly sensitive information requiring additional protections.
Microsoft environments, for example, may support sensitivity labeling and data protection through tools such as Microsoft Purview, depending on licensing and configuration.
The important point is that businesses should know what they’re protecting before allowing AI applications to interact with it.
AI Security Risks Extend Beyond Your Employees
Even when employees follow company policies, business information may still be processed by outside vendors.
More software providers are introducing AI features into their existing applications.
Accounting platforms, document management systems, and customer relationship management tools may all offer AI-powered capabilities.
Before enabling those features, businesses should understand what happens to their information.
Does the application send data to another provider? How long is that information retained? Can it be used for model training? Who has access to it?
These are questions worth asking before adopting a new AI capability.
Wolf emphasizes that protecting company information also means understanding the vendors and applications that interact with it.
An application your business has used for years may introduce new AI features that require a separate security review.
AI Can Be Confidently Wrong
Data security isn’t the only concern businesses need to address.
AI-generated information can sound convincing while being inaccurate, incomplete, or misleading.
This is commonly referred to as an AI hallucination.
Wolf shared an example from his own experience researching internet service reliability. His initial AI results relied heavily on marketing information published by a service provider rather than independent research.
When he asked for more reliable, third-party sources, he received more useful information.
The lesson is that AI can be helpful for gathering and organizing information, but its output still needs to be evaluated.
This is particularly important when AI supports decisions involving legal matters, finances, or other consequential business activities.
Wolf describes the importance of combining Artificial Intelligence with what he calls Real Intelligence.
“AI can be wrong, confidently wrong.”
Employees should know when to question AI-generated information, verify its sources, and involve a qualified person before relying on it.
What Should an Employee AI Usage Policy Include?
A written AI policy helps employees understand what is acceptable and where the boundaries are.
It doesn’t need to discourage AI adoption. Instead, it should provide clear expectations for using the technology responsibly.
Wolf compares AI acceptable use policies to the existing guidelines businesses establish for email, internet browsing, and other workplace technology.
A practical policy should address:
- Approved tools and accounts: Which AI applications employees can use for business purposes.
- Data protection: What information employees can enter, upload, or share.
- Human oversight: When AI-generated work must be reviewed or verified.
- Reporting concerns: What employees should do if they accidentally share sensitive information or notice suspicious activity.
Policies should also address AI features embedded in existing applications, including meeting transcription tools and connected assistants.
The goal is to make expectations clear without creating unnecessary barriers to productivity.
Need a starting point? Just Solutions offers a Sample AI Usage Policy that businesses can customize and review with their legal and IT teams.
Explore the AI Policy and Other Resources
How Can Businesses Manage Shadow AI?
Wolf recommends a practical framework for approaching AI governance: See, Secure, and Steer.
See: Understand How AI Is Being Used
Start by identifying which AI applications employees are already using.
This includes standalone chatbots, browser extensions, meeting assistants, and AI features built into existing software.
An AI readiness assessment can help businesses understand their current usage and identify areas that need attention.
The goal isn’t to monitor employees unnecessarily. It’s to understand how company information is being accessed and used.
Secure: Protect Your Company Information
Once you understand which tools are being used, evaluate their access to company information.
Review existing permissions, identify sensitive data, and determine whether approved AI applications have appropriate safeguards.
This may involve implementing data classification, adjusting application permissions, or reviewing vendor security practices.
Steer: Give Employees a Safer Way to Work
Finally, provide clear guidance and approved alternatives.
Different employees may need different AI tools depending on their responsibilities.
For example, a software developer may benefit from an approved coding assistant, while an administrative employee may need an AI tool for drafting communications.
The objective is to support useful applications of AI while maintaining appropriate oversight.
How to Get Started With AI Governance
Businesses don’t need to have every AI-related decision figured out before taking action.
A practical first step is to understand what’s already happening.
Begin by identifying the AI applications your employees use and the business purposes they serve. From there, review the tools and decide which should be approved.
Next, establish basic guidelines for handling company information and make sure employees understand them.
It’s also worth reviewing existing data permissions before connecting AI applications to additional systems.
Finally, make employee education an ongoing process.
AI tools and capabilities are changing quickly. A policy created today may need to be revisited as new applications and features become available.
For businesses looking for a more structured starting point, Just Solutions provides an AI Risk and Readiness Checklist and Secure AI Adoption Playbook.
Access the AI Readiness Resources
The Future of AI at Work Requires Human Oversight
AI is moving beyond writing content and answering questions.
AI agents can now interact with applications, retrieve information, and perform tasks across business systems.
That creates opportunities for businesses to automate repetitive work, but it also raises new questions about permissions and accountability.
Consider an AI agent that helps process incoming invoices.
It might retrieve an invoice, compare it with a purchase order, and flag discrepancies for review.
But should that same agent be allowed to approve and pay an invoice without human involvement?
Wolf argues that businesses need to establish checks and balances before giving AI the ability to take consequential actions.
The more access an AI tool has, the more important it becomes to understand what it can do and when a person should remain involved.
Responsible AI Adoption Starts With Visibility
AI is already becoming part of how businesses operate.
The question isn’t whether employees will find ways to use it. It’s whether organizations will provide the guidance and safeguards needed to use it responsibly.
As Wolf emphasized in his discussion of Shadow AI, businesses should bring that activity into the open rather than leave it unmanaged.
That means understanding which tools employees use, protecting sensitive information, and giving people clear expectations.
With the right approach, businesses can take advantage of AI’s capabilities without losing control over their information.
Frequently Asked Questions About Shadow AI
What Is an Example of Shadow AI in the Workplace?
Shadow AI occurs when employees use artificial intelligence tools for work without their organization’s knowledge or approval.
For example, an employee might upload a customer contract to a personal ChatGPT account for a quick summary or enable an AI meeting assistant without checking whether the application is approved. Even when the intention is to save time, these activities can create data privacy and security concerns.
Is Shadow AI a Cybersecurity Risk?
Yes. Shadow AI can introduce cybersecurity risks when employees share sensitive company information with unapproved applications or give AI tools access to business systems without appropriate oversight.
Potential concerns include data leakage, unauthorized access, and inadequate control over how information is stored or processed. The level of risk depends on the application, the information involved, and the safeguards in place.
Should Businesses Ban Employees From Using AI?
Not necessarily. Banning AI may encourage employees to use personal accounts or unapproved tools, making their activity harder to manage.
David Wolf, VP at Just Solutions, recommends focusing on visibility, data protection, and employee guidance instead. Providing approved AI applications and establishing clear expectations can help businesses benefit from the technology while reducing unnecessary risks.
Can Employers Monitor AI Use in the Workplace?
Yes. Businesses can use security and monitoring tools to identify AI applications being accessed within company-managed environments. Depending on the technology, organizations may also be able to monitor application activity, data uploads, and potential policy violations.
Monitoring should be implemented transparently, with appropriate privacy protections and consideration of applicable laws. The goal should be to protect company information and identify risks, not unnecessarily monitor employees’ personal activity.
How Can Small Businesses Create an AI Usage Policy?
Start by identifying which AI tools employees are using and determining which applications should be approved for business purposes.
An AI usage policy should explain what information employees can share, when human review is required, and how to report potential security concerns. It should also distinguish between personal and company-managed AI accounts.
Businesses can use the Just Solutions AI resources as a starting point for developing their own guidelines.
What Is the First Step in Managing Shadow AI?
The first step is gaining visibility into how AI is already being used within your organization.
Identify the applications employees use, what information those tools can access, and whether appropriate security controls are in place. An AI readiness assessment can help uncover potential risks and establish priorities for responsible AI adoption.
Take the Next Step Toward Secure AI Adoption
Just Solutions helps businesses in Rochester, Western New York, and beyond evaluate their technology environments and prepare for responsible AI adoption.
Whether your organization is just beginning to explore AI or already has employees using multiple tools, an AI readiness assessment can help identify where you stand and what to address next.
Explore the Just Solutions Resource Library for practical tools, including the AI Risk and Readiness Checklist, Sample AI Usage Policy, and Secure AI Adoption Playbook.
To discuss AI governance, security, or readiness for your business, contact [email protected].