Somebody at your company pasted a client contract into a chatbot this week. Possibly a payroll file, a patient record, or a chunk of proprietary source code. They were not being reckless — they were trying to finish something faster, using a tool that was free, instant, and required nobody’s permission.
That is shadow AI: employees using AI tools that IT never approved, never inventoried, and usually cannot see. It is the most widespread AI risk in business today, and unlike most security problems it is caused entirely by people trying to do their jobs well.
The scale of it
The research here comes from several vendors and consultancies with different methods, so treat the exact figures as indicative rather than precise. The direction they all point in is not ambiguous.
| Finding | Figure | Source |
|---|---|---|
| AI users who bring unapproved tools to work | 78% | Microsoft Work Trend Index, 2025 |
| Workforce using unsanctioned AI tools | 45% | Cloud Security Alliance, 2026 |
| Employees who have submitted confidential company data to public AI tools | 27% | Salesforce, 2024 |
| Share of data pasted into ChatGPT that contains sensitive information | 11% | Cyberhaven, 2024 |
| Organizations with no formal policy on external AI tool use | 52% | KPMG, 2025 |
| Security teams lacking visibility into employee AI usage | 60% | Cisco, 2024 |
| Organizations with a formal shadow AI detection program | 34% | Gartner, 2025 |
Read the last two rows together and the shape of the problem appears. Around half of companies have no policy, and roughly two thirds cannot see the behaviour even if they had one. The gap between what is happening and what anyone knows about is the entire risk.
Why the data does not come back
The instinctive worry is that a chatbot will “learn” your secrets and recite them to a competitor. That is the least likely failure mode. The realistic ones are duller and worse.
- It is retained on somebody else’s servers. Consumer AI accounts generally retain conversations, and retention policies are set by the vendor, not by you. Once it is in, you have no deletion right you can exercise on demand and no way to prove it is gone.
- It breaks contractual commitments you have already made. If you have signed confidentiality terms with a client, pasting their material into a third-party service is a disclosure. Nobody had to breach anything for you to be in breach.
- It creates regulated-data exposure. Patient information, card data, and personal data carry statutory obligations that follow the data wherever it goes. A HIPAA-covered practice does not stop being covered because the disclosure was convenient.
- It cannot be investigated afterwards. With no logs and no account you control, you cannot answer the only question that matters after an incident — what exactly left, and when.
One detail worth dwelling on: analysis of sensitive-data events involving AI tools found source code was about 35% of them. For any company with proprietary software, the leak is not hypothetical marketing copy. It is the product.
Why banning it makes the problem worse
The common response is to block the domains and issue a policy forbidding AI tools. This reliably fails, for a reason worth understanding rather than dismissing.
The tools deliver real, immediate productivity. An employee facing a deadline and a blocked website does not stop — they use their phone, or a personal laptop, or a personal account on a corporate device. Roughly one in three employees already does exactly that. You have not removed the behaviour. You have removed your ability to see it, and you have made it something people conceal.
A ban converts a visible risk you could manage into an invisible one you cannot.
The central failure of prohibition-based AI policy
It also has a second-order cost. Once staff learn that asking about AI produces a refusal, they stop asking — including about the uses you would have happily approved, and including when something has gone wrong.
What actually works: a sanctioned path
The organizations handling this well have stopped trying to suppress demand and started routing it. The principle is simple — make the approved way the easy way — and it is mostly organisational rather than technical.
- Provide a real tool, properly licensed. Business tiers of the major AI services offer contractual terms on data retention and training that consumer accounts do not. This one step converts the majority of shadow usage into governed usage, because people would rather use the sanctioned tool if it exists and works.
- Write the rule in nouns, not adjectives. “Use good judgement with sensitive data” means nothing at 5pm on a deadline. “Never paste client files, patient data, card numbers, credentials or source code” is a rule someone can actually follow.
- Say clearly what is encouraged. Most policies list only prohibitions, which reads as disapproval of the whole category. Name the uses you want — drafting, summarising, brainstorming, code review on non-proprietary code — so the boundary is a line rather than a fog.
- Find what is already in use before you write anything. Check expense reports for individual subscriptions and, if you can, network logs for AI domains. Policies written without knowing current behaviour tend to ban things people depend on, which guarantees they are ignored.
- Make disclosure safe. Someone who realises they pasted something sensitive must be able to say so immediately without fearing discipline. You cannot contain an exposure you only learn about at the exit interview.
- Revisit it quarterly. The tools change every few weeks. A policy naming specific products is out of date by the time it is circulated — write it around categories of data and use, not brand names.
If you are in a regulated industry
For healthcare practices, financial firms, and anyone holding card data, the analysis is shorter. Regulated data must not go into a consumer AI account, and the control that makes this workable is a business agreement with the vendor covering data handling — including a business associate agreement where HIPAA applies.
This connects directly to your compliance obligations. Auditors and insurers have started asking how AI tool use is governed, and “we told everyone not to” is not an answer that survives follow-up questions. It is also worth noting how this differs from the machine-side problem we covered in AI agent security: that concerns credentials your systems hold, this concerns judgement your people exercise. Both need owners; they are not the same owner.
Frequently asked questions
How do we find out what AI tools our staff are using?
Three places, in order of ease. Expense reports and corporate cards will show individual subscriptions. Network or DNS logs will show traffic to AI domains from company devices. And an anonymous survey will usually surface more than either — people answer honestly when the question is framed as “what helps you” rather than “what have you been doing.”
Is the paid tier actually safer, or is that marketing?
It is a contractual difference, which is the kind that matters. Business and enterprise tiers typically commit in writing to not training on your inputs and to defined retention, and they offer administrative controls and audit logs. Consumer tiers generally do not. Read the specific terms rather than assuming — they vary by vendor and change — but the distinction is real.
We are ten people. Do we need a written AI policy?
Yes, and it can be one page. At ten people you can write it in an afternoon and explain it in a meeting, which is a genuine advantage over a company that needs six months and a committee. The list of data types that must never be pasted anywhere is the part that matters; the rest is guidance.
Someone already pasted client data into ChatGPT. What now?
Establish precisely what was disclosed and when, check the account’s retention and deletion settings, and delete the conversation if you can. Then assess whether it triggers a notification obligation — under contract with the client, or under regulation if the data was regulated. Document the review either way. The instinct to keep it quiet is the thing that turns an incident into a much larger problem later.
Getting ahead of it
Delana Technologies helps companies replace shadow AI with governed AI — discovering what is actually in use, putting sanctioned tooling and workable policy in place, and building AI systems on infrastructure you control. If you do not currently know what your team is pasting where, call 239.414.5126 or contact us.
Sources and dates: Microsoft Work Trend Index (2025); Cloud Security Alliance non-human identity and agentic AI governance research (2026); Salesforce workforce surveys (2024); Cyberhaven data-flow analysis (2024); KPMG (2025); Cisco (2024); Gartner (2025). Figures are drawn from separate studies with differing methodologies and populations, and are presented as indicative of scale rather than directly comparable.