The AI tools your staff already use (and what to do about it)
Key takeaways
- Assume your staff already use AI tools, and ask what they use without making anyone feel they’re in trouble.
- Approve one or two good tools and move the work onto business accounts you control, so it doesn’t leave when people do.
- Write down what may go in and who owns what comes out: a person checks before anything reaches a customer.
Short version: there’s a good chance your staff already use AI tools at work, on personal accounts you can’t see. Don’t ban them. Ask what they use and what for, approve the few that earn their keep, move that work onto business accounts you control, and write down what may and may not go into them.
What is shadow AI?
Shadow AI is the name for AI tools people use at work without the business knowing or agreeing. It’s rarely sinister. Someone finds a chatbot that writes a decent product description in ten seconds, and they keep using it, on their own login, from their own phone.
The work gets done faster, which is the good news. The bad news is that you don’t know what’s been pasted into it, who owns the account, or what happens to that work when they leave.
Employees using unapproved AI tools: why a ban fails
The first instinct is a rule: no AI at work. It rarely sticks. The tools are free, they’re on everyone’s phone, and they genuinely save time on dull jobs. A ban just moves the use somewhere you’re even less likely to see it, and teaches people not to mention it.
A better starting point is to assume it’s happening, and make it safe to say so.
Find out what people already use
Ask. Not as an investigation, but as a short, friendly question at a team meeting or in a message: which AI tools do you use, what for, and on whose account? Make it clear nobody is in trouble.
Say you sell garden planters online with a small team. The answers might look like this:
- One person drafts product descriptions with a free chatbot on a personal login.
- Another pastes awkward customer emails into it to get a calmer reply.
- Someone in the warehouse uses a phone app to translate a supplier’s instructions.
- Nobody uses anything for the accounts, as far as they know.
The second line is the one to look at first. Customer emails carry names, addresses and order details, and they’re now sitting in someone’s personal account.
Shadow AI risks worth worrying about
Not every risk is equal. Three matter most to a small business:
- What goes in. Customer details, supplier prices, staff matters and anything you’d not want read out in public. Once it’s pasted into a personal account, it’s out of your hands.
- Who owns the account. If the work lives in an employee’s personal login, it leaves when they do. So do any saved instructions or templates they’ve built up.
- What comes out. AI writes confident text that is sometimes wrong. If it goes to a customer unchecked, the mistake is yours, not the tool’s.
Everything else, such as which tool writes the nicest prose, is a matter of taste.
How to manage shadow AI without losing the useful bits
- Approve the good ones. Pick one or two general tools that cover most of what people already do. Fewer tools means fewer places for your data to end up.
- Move the work onto business accounts. Set up accounts in the business’s name, with work email addresses, so you can see who has access and switch it off when someone leaves. Check whether the tool uses what you type to train itself, and turn that off where you can.
- Say what may go in. A short list beats a long document. Product facts and public information are fine. Customer details only in the approved tool, with names stripped where you can. Passwords, card details and staff matters never.
- Say who owns what comes out. Whoever sends it owns it. AI drafts; a person checks and sends.
- Retire the rest. Ask people to stop using the unapproved tools for work, and to delete any customer details they pasted in, where the tool lets them.
All of that fits on one page. There’s more on writing it in A one-page AI policy your staff will actually read.
Keep asking
New tools turn up all the time, and the assistant built into your email or spreadsheet software may switch itself on after an update. Ask the same question every few months. When someone finds a new tool that saves time, treat it as a suggestion to look at, not a breach to punish.
The aim isn’t zero AI. It’s AI you know about, on accounts you control, doing jobs you’re happy with.
Want to know which jobs are worth handing to AI properly? Grafto’s AI Tools Report works it out from a short questionnaire.
Frequently asked questions
What is shadow AI?
AI tools that people use for work without the business knowing or agreeing, usually free chatbots on personal accounts. It’s rarely malicious, but it means you can’t see what has gone in, or keep the work when someone leaves.
How do you manage shadow AI?
Ask staff what they use, approve one or two tools that cover most of it, move that work onto business accounts in the business’s name, and write a short list of what may and may not be pasted in. Then ask again every few months.
What should employees avoid when using AI tools?
Pasting customer details into anything other than the approved tool, typing in passwords, card details or staff matters, and sending anything an AI wrote to a customer without reading it first. Whoever sends it is responsible for it.
Questions, or want a tool we don't have yet? Email hello@grafto.co.uk — a real person replies.