Shadow AI: Your Team Is Already Using AI Tools. Now What?
Sources consulted on 24 October 2026.
If you run a small team, someone on it is probably pasting text into an AI tool right now. That's not a scandal. It's a sign they want to work faster, and a reason to put some light structure around it.
How common is it?
Microsoft and LinkedIn's 2024 Work Trend Index found that:
- 75% of people use AI at work.
- 78% of AI users bring their own AI tools to work (BYOAI). At small and medium-sized companies, it's 80%.
- 52% of people who use AI at work are reluctant to admit using it for their most important tasks.
That last number explains the "shadow." People hide what they think might get them in trouble.
These figures are from 2024 survey data. They are the most recent official figures I could verify for this post.
Why it matters
The concern isn't that employees use AI. It's what goes into it:
- Customer personal data: under the GDPR, you remain responsible for personal data you process, wherever it ends up.
- Confidential business information: contracts, prices and plans pasted into tools nobody has reviewed.
- Unchecked output: AI-written text or figures that go to clients without a human check.
There's also a regulatory angle. The EU AI Act includes an AI-literacy duty for organisations that use AI systems (Article 4, applicable since 2 February 2025). The AI Omnibus amended this article in 2026, so check the current text, but knowing what tools your team uses is a sensible first step either way.
A four-step response
1. Ask, without blame
Send a short, anonymous-friendly question: "Which AI tools do you use for work, and for what?" Make it clear the goal is to support people, not punish them. If people fear punishment, the 52% stay silent.
2. Sort what you find by risk
A simple three-colour sort works for most small teams:
- Green: no personal or confidential data, for example rewording a public blog post.
- Amber: internal information, but nothing about customers.
- Red: customer personal data, health or financial data, or anything under a confidentiality agreement.
3. Write one page of rules
Cover: approved tools, what data never goes in, who reviews AI output before it reaches a client, and who to ask when unsure. One page people read beats twenty pages nobody opens.
4. Review every quarter
New tools appear constantly. A quarterly five-minute check keeps your list honest.
A useful framework if you want more
The US National Institute of Standards and Technology (NIST) publishes a voluntary AI Risk Management Framework to help organisations manage AI risks. It's more than a small team needs on day one, but it's a solid reference as you grow.
Go deeper
The Shadow AI Audit Kit walks you through the five places shadow AI hides, how to ask without making people defensive, a risk sort, and a one-page AI usage policy ready to copy.
👉 Find it at bookpilot.org/books
Sources
All consulted on 24 October 2026.