On paper, the organisation wasn’t using AI.

There were no approved tools, no rollout, and no policy beyond a vague “we’re looking into it.” Staff had been emailed and told that until a policy was in place, AI was not to be used. The business had even blocked access to AI tools on work computers while leadership ummed and ahhed about how the technology might fit within the organisation.

That was the official position.

Then Inbal Rodnay, an AI adoption specialist, asked the team:

“Who here has pasted something into ChatGPT this week?”

Hands went up – slowly at first, then almost all at once. The CEO looked around the room, stunned.

“He had told me he had banned the use of AI until I’d completed my training with them,” Rodnay said.

Shadow AI is everywhere

The quiet, unofficial use of AI tools by employees without formal approval or visibility has a name – shadow AI.

As Rodnay points out, shadow AI is very widespread.

“Most businesses – and especially government organisations – already have people using AI, whether they’ve acknowledged it or not, or put policies in place for best-practice use.

“People aren’t waiting for permission,” Rodnay said. “They’re under pressure to deliver, the tools are easy to access, and they work. So people just get on with it.”

But employees are also doing something even more under the radar.

“People are using tools like ChatGPT, Claude, Perplexity or meeting assistants without formal approval, policies or visibility. They’re using their personal accounts, on their personal devices with no understanding of what is safe or not.”

Research from Zluri’s 2025 State of AI in the Workplace revealed enterprises, IT and security teams are unaware of most AI apps in use, with fewer than 20 per cent of AI tools visible to central governance.

Inbal says it’s happening in professional services, government, finance, legal, and advisory.

“Leaders are pretending it isn’t happening and that’s where the real risk begins,” she said.

”Organisations treat this as bad behaviour but it’s really a signal that there’s a gap between how work actually happens and the tools organisations provide. People are expected to move faster, produce more, and juggle complexity, but aren’t being given the practical support to do that.”

Why people go underground

Shadow AI isn’t happening because people are being reckless. With so much hype and media around AI it shows up because people are busy.

“People aren’t trying to break rules,” Inbal says. “They’re trying to get through the day. With so much media around how AI is the future, and government and businesses not providing safe tools or guidance, they’ll find their own way,” Inbal says. “That’s human behaviour.”

Microsoft 2025 research found that 71 per cent of UK employees have used unapproved consumer AI tools at work, with 51 per cent doing so weekly, often without awareness of the risks to privacy or security.

Salesforce’s Generative AI Snapshot Research Series,‘The Promises and Pitfalls of AI at Work’ found 55 per cent of workers used generative AI at work without formal approval from their employer and 40 0per cent were using tools banned by their workplace.

Inbal says in Salesforce’s survey of over 14,000 global workers across 145 countries, over half the respondents said their organisations lacked clearly defined policies.

“This puts businesses at risk of data breaches and leakage, quality and liability risks and the risk of inconsistency as everyone makes up their own rules,” she says.

Ignorance = danger

The most common leadership response is denial. If we don’t officially allow AI, then it’s not our problem. That’s fuzzy logic that’s doomed to fail.

When AI use is invisible, leaders have no idea what data is being shared, where outputs are going, or how decisions are being influenced.

Client information may be copied into public tools. Draft advice may be generated without review. Errors may slip through because no one is checking how the work was done.

A 2023 Cyberhaven report analysing workplace behaviour found that sensitive data was shared with generative AI tools far more often in organisations without clear policies than in those with defined guidelines.

“The report showed that employees didn’t know what was allowed so client data, source code and internal documents were regularly pasted into public tools,” Inbal says. “You can’t manage the risk you refuse to look at. Ignoring AI doesn’t make you safer, it makes you blind.”

When AI use stays hidden, organisations don’t learn where it’s helping, where it’s causing issues, or what could be improved with the right setup.

“Shadow AI means any productivity gains stay with the person secretly using the AI tool instead of the gains becoming systemic to help everyone,” Inbal says.

When policies make it worse

Some organisations swing hard the other way with blanket bans, strict policies, long approval processes, lots of warnings, and very little guidance. It’s no surprise that the approach backfires.

A global KPMG/University of Melbourne study in 2025 found 57 per cent of workers admit to hiding AI use from their bosses and many do not check AI outputs for accuracy

“That creates risk without awareness or oversight. When policies are too restrictive, people don’t stop using AI,” Inbal says. “They stop talking about it.”

“Instead of using approved tools, people turn to personal devices and free accounts. They stop asking questions, and rely on best guesses.

Instead of sharing what they’ve learnt, they keep it to themselves.

“This increases the risk, not decreases,” Inbal says. “Blanket bans never work.”

Over time, this blanket ban creates fragmentation.

“You have two people who solve the same problem in completely different ways – there’s no quality control or insights so when something goes wrong, no one knows where AI was involved or how to fix it,” Inbal notes.

McKinsey’s article on what every CEO should know about generative AI explicitly warns that organisations relying on ad hoc or ungoverned AI use won’t see sustained value.

“When productivity is all over the place and knowledge not embedded into systems, shadow AI stalls progress. If you can’t see it, you can’t govern it and you can’t improve,” it states.

What smart organisations do differently

The organisations handling this well don’t panic or pretend. Inbal says smart organisations acknowledge reality.

“They accept that people are already using AI. They provide approved tools that fit into existing workflows. They teach basic AI skills so people know how to prompt properly, check outputs, and handle sensitive information with care,” she says.

“They make it safe to talk about AI use. If people can say ‘this is how I’m using it’, you can improve it. Once it’s visible, it becomes teachable.”

Shadow AI thrives in silence and is treated like a dirty secret. To get the job done, whether they have permission or not, people are going to use AI. As an organisation, if you put your head in the sand, it will become even more widespread, ungoverned, and invisible until something goes wrong.

“The ones willing to face what’s going on, that simplify systems, and help their people use AI well, out in the open, will actually make a business stronger,” Inbal says.

Ferris Bueller had it right. Things move quickly, and if you’re not paying attention, you can miss what actually matters. AI is moving fast, but that doesn’t mean you need to rush in blindly. You don’t have to be an early adopter chasing every new tool.

You just need to be a smart adopter – the early majority. Pause, watch what’s working, and take action to implement AI in a way that makes sense for your business.

Want more? Get our newsletter delivered straight to your inbox! Follow Business Builders on Facebook, X, Instagram, and LinkedIn.