Shadow AI: finding the tools your team already uses

Shadow AI is the name for AI tools used at work without anyone in charge knowing. It is rarely a rebellion. Someone had a deadline, a free tool was one search away, and it worked. Then a colleague saw it and started using it too. Six months later a third of the team relies on a service nobody has read the terms of.

Banning it does not work well. People who find a tool useful keep using it, only more quietly. The better approach is to find out what is in use, make quick decisions, and give people an approved route that is as easy as the unapproved one.

Why it happens

• The approved tool does not exist, or nobody told people about it.
• The approved tool exists but needs a request form, a manager's sign-off and a two-week wait.
• People do not know there are rules, or think the rules are about something else.
• A personal account is already open on their phone and the work is urgent.

Each of these has a fix that is cheaper than enforcement. Keep that in mind while you look, because what you find will be more useful if people are not afraid to tell you.

There are five places to look, starting with the friendliest and ending with the most technical.

1. Ask, and say why

Send a short message to every team: we want to approve the AI tools you find useful, so tell us which ones you use and what for. Promise that nobody will be in trouble for answering. Then keep that promise. This single step usually finds most of the tools.

2. Check expense claims and card statements

Paid AI subscriptions often arrive as small monthly charges on a company card or in expense claims. Search for the past twelve months. Each result is a tool someone valued enough to pay for.

3. Look at connected apps

Most company email, calendar and file storage services let an administrator see which third-party apps people have connected to their accounts. Meeting note takers and writing assistants often appear here, along with what they were allowed to read. A tool with access to every calendar and mailbox deserves an early look.

4. Look at browser extensions

If you manage company laptops, your device management tool may be able to list installed browser extensions. AI writing and summary extensions can read the pages a person visits, which is a much wider view than a chat window.

5. Watch the questions people ask

The help desk, the team chat and onboarding questions all reveal tools. When someone asks whether they can use a particular product for a client report, note the product, even if the answer is no.

Turning the list into decisions

At Pinewood Logistics, an operations company of 120, the first sweep found eleven AI tools. The team sorted them into three groups in an hour.

• Widely used and worth paying for properly: the chat assistant used by most office staff. They moved everyone to a business plan with clearer data terms and marked it approved for internal information.
• Useful for a few people, with limits: a translation tool used by the customs team. Restricted to shipping documents with personal details removed.
• Tried once or duplicating something approved: the other nine. Marked not approved, with a note pointing to the approved alternative.

Every one of those decisions went into a register, so the next person who asked got an answer in seconds. If you do not have one yet, start with the register post.

Keep the door open

Shadow AI comes back whenever asking is slower than doing. Name one person who decides on new tools, promise an answer within a few days, and let people use the tool for public information while the review runs. Record each request as under review so you can see how long decisions take.

Finally, put shadow AI on your risk register as a standing item, with an owner and a date to repeat the sweep. Twice a year is enough for most small companies.

In Openn Shield

Openn Shield does not watch browsers or networks, and it has no browser extension. It gives you the place to record what you find: each tool in the register with its status, owner and allowed data, and the shadow AI risk in the risk register with an owner, a due date and an alert when it is overdue. See who Shield is for.