Shadow AI: The Risk Already Inside SMEs

How should an SME manage employees using unapproved AI tools? Do not begin with a blanket ban. Establish a short interim rule for sensitive data and prohibited actions, discover real usage through a non-punitive survey plus identity and spend records, classify each use by data and authority, provide approved alternatives, and monitor the riskiest actions rather than every prompt.

Shadow AI is an operating-model problem

Shadow AI is any AI tool, embedded feature or model-backed workflow used for company work without the organisation understanding or approving the use. It includes an employee pasting a proposal into a public assistant, a department buying a meeting recorder, a browser extension reading customer pages, or a no-code agent connected to email and CRM.

The danger is not merely that “someone used ChatGPT.” The real questions are what data moved, which account and retention terms applied, what output influenced a decision, and whether the tool could act in a business system. A drafting tool used on public marketing copy is different from an agent that can email customers or update payroll.

Discover use without teaching people to hide it

Employees usually adopt unsanctioned tools because the approved route is slow, unclear or absent. Announcing an amnesty-style discovery period produces better evidence than opening with discipline. Explain that the goal is to keep useful practices and remove unsafe ones. Protect anonymous survey responses; follow up on workflows, not individuals.

Download the anonymous shadow-AI discovery survey. It asks about tasks, data, integrations and failure experiences without asking employees to confess wrongdoing.

Classify the workflow, not the brand name

Create a register entry for each distinct use. Record purpose, users, data categories, vendor/account type, retention settings, connected systems, allowed actions, human review and owner. The same product may contain a low-risk writing assistant and a high-risk workflow that reads contracts and sends decisions.

• Low: public or synthetic data, draft-only output and mandatory human review.
• Moderate: internal data, customer communication drafts or recommendations that affect work allocation.
• High: sensitive data, system writes, financial or employment impact, external sending, identity impersonation or difficult-to-reverse actions.
• Stop: activity violates law, contract, confidentiality, intellectual-property duties or company policy.

Publish a usable approved-tool catalogue

A catalogue should say more than “approved.” Name the allowed business purposes, account type, permitted data, prohibited data, retention configuration, integrations, required review and support owner. Give staff a fast path to request a missing tool or use case. If every request takes a month, the unofficial market will reopen.

Use technical controls proportionately: managed accounts, SSO, app-consent review, browser policy and data-loss controls for sensitive information. Do not claim that network blocking solves the problem. People can switch devices, and AI capabilities now appear inside ordinary software. Governance must work at the task and data level.

Train around moments of risk

Generic AI awareness is not enough. Practise four decisions: what may be entered, what must be verified, what action requires approval, and how to report a mistake. Show examples from sales, HR, finance and operations. Make the safe alternative easier: a managed assistant, an approved knowledge source, a redaction step, or a human-reviewed workflow.

Teach employees to report accidental uploads quickly. Early reporting can support access revocation, deletion requests, incident assessment and customer protection. Punishing honest reports creates longer exposure and worse evidence.

What the interim acceptable-use rule should say

A useful interim rule can fit on one page. It should tell people which managed accounts and tools are currently approved; which information may never enter an unapproved service; which uses require manager, privacy, security or legal review; and how to request a new tool. It should also distinguish assistance from authority. An employee may use an approved assistant to prepare a draft, but the normal accountable person still checks and sends it.

Name specific red lines: passwords and authentication codes, payment-card data, private employee or health records, confidential client files, unreleased financial results, source code covered by contractual restrictions, and any instruction that asks a tool to impersonate a person or bypass an approval. The exact list must reflect the company's obligations. Add a reporting address and promise a prompt response; otherwise staff will make their own decisions under deadline pressure.

Turn discoveries into four decisions

Every discovered use should reach one of four documented decisions. Approve when the purpose, account, data and review are acceptable. Constrain when the value is real but data, retention or actions need tighter limits. Replace when an approved service can meet the need more safely. Stop when the use is unlawful, contractually prohibited or outside the organisation's risk tolerance.

Record the reason and the practical alternative. “Stop using it” is not a complete control if the underlying task remains urgent. For example, replace a public transcription tool with a managed service configured for the required region and retention, or provide a redaction step and approved document assistant for proposal work.

Monitor actions and data flows proportionately

Monitoring should answer whether sensitive information is leaving approved boundaries and whether AI is gaining unreviewed authority. Start with managed identity, app consent, integrations, service accounts, SaaS spend and outbound automated actions. Combine technical evidence with periodic team conversations because many AI features sit inside already-approved products.

Set purpose and retention for monitoring data, restrict access and tell staff what is observed. Avoid collecting every prompt by default. That can create a new store of sensitive material and damage trust. High-risk workflows may justify detailed action logs; low-risk drafting can often be governed through account controls, training and sampled review.

Respond to an accidental sensitive-data upload

1. Preserve the minimum facts: tool, account, time, data category, affected people, prompt or file reference and any sharing.
2. Stop further use and revoke connected access where necessary.
3. Check the provider's deletion, retention and training controls; request deletion through the approved channel.
4. Notify the company's incident, privacy, security and legal owners according to policy.
5. Assess contractual, regulatory and customer-notification duties rather than assuming an upload is automatically a reportable breach.
6. Correct the workflow: approved alternative, redaction, permissions, training or a blocked action.

The response should learn without normalising unsafe behaviour. Update the register and test whether the same route exists elsewhere. A single upload may reveal a widespread process gap.

Govern embedded AI as well as standalone tools

Shadow AI increasingly appears as a button inside office suites, CRMs, design tools, meeting platforms and browsers. Review feature enablement, default data settings, tenant controls and connected applications when renewing ordinary software. Ask vendors whether administrators can restrict models, data sources, retention, external actions and user groups. Update the register when an existing product gains materially different capability.

NIST's generative-AI profile highlights risks such as confabulation, privacy, information security, harmful bias, intellectual property and human over-reliance. Not every feature creates all of these risks, but the profile is a useful prompt for asking what changed when AI was added to a familiar product.

A proportionate 30-day response

1. Days 1–3: appoint an owner and publish interim rules for sensitive data, credentials, automated sending and consequential decisions.
2. Days 4–10: run the survey and review approved identity, subscription and integration records.
3. Days 11–17: create register entries, map data flows and rank uses by consequence and authority.
4. Days 18–24: approve, constrain, replace or stop each material use; give teams a request route.
5. Days 25–30: train by role, test incident reporting and schedule quarterly discovery.

NIST's AI RMF emphasises inventory, roles, policies, third-party risk and continuous risk management across the lifecycle. Use that structure to turn invisible experiments into owned systems—not to turn a small company into a paperwork department.

Questions for the monthly review

• Which new AI features, subscriptions or integrations appeared?
• Did any approved use expand to new data, people or actions?
• Which corrections, incidents or near-misses reveal a weak control?
• Are approved alternatives meeting the operational need?
• Can unused access, retained data or duplicate tools be removed?
• Which policy or training example needs to change?

Keep the review connected to real work. A short monthly evidence review plus a deeper quarterly assessment is more useful than an annual policy acknowledgement that ignores product change.

Primary sources

• NIST — AI Risk Management Framework
• NIST AI Resource Center — AI RMF Core
• NIST — Generative AI Profile
• UK NCSC — Guidelines for secure AI system development

Continue the implementation path

• The minimum viable AI governance pack
• AI agent security checklist
• AI agent permission design