Employees are adopting AI faster than most organisations can govern it. While tools like ChatGPT, Microsoft Copilot and other AI assistants are transforming productivity, many employees are using consumer AI applications without approval or oversight. This growing trend, known as Shadow AI, creates new risks around data security, compliance and governance.
According to Microsoft UK, 71% of UK employees have used unapproved consumer AI tools at work, while 51% continue to use them every week. At the same time, many employees admit they have little concern about the security or privacy implications of entering company data into these tools.
For business leaders, the challenge isn’t whether employees are using AI—it’s whether your organisation is using it safely.
What Is Shadow AI?
Shadow AI refers to employees using artificial intelligence tools that haven’t been approved, managed or monitored by their organisation.
These tools may include:
- Public AI chatbots
- AI writing assistants
- AI image generators
- AI coding tools
- Browser-based AI extensions
- Personal AI accounts used for work tasks
In many cases, employees are simply trying to work more efficiently. However, when business information is entered into unapproved AI tools, organisations may lose visibility and control over how that data is handled.
Why Is Shadow AI Increasing?
Artificial intelligence has quickly become part of everyday work.
Microsoft’s research found that employees are using AI to:
- Draft emails and workplace communications (49%)
- Create reports and presentations (40%)
- Complete finance-related tasks (22%)
The productivity benefits are significant. Workplace users of generative AI reported saving an average of 7.75 hours per week, which Microsoft estimates equates to more than 12 billion hours saved annually across the UK economy.
So why are employees choosing unapproved AI tools?
Microsoft identified several common reasons:
- Employees are already familiar with consumer AI in their personal lives (41%)
- Their organisation doesn’t provide an approved AI solution (28%)
If approved tools are unavailable or difficult to use, employees often find their own alternatives.
Why Should Business Leaders Be Concerned?
Shadow AI isn’t simply an IT issue. It’s a business governance issue that affects security, compliance and reputation.
Potential risks include:
- Sensitive company information being uploaded to external AI platforms
- Customer data being shared without approval
- Intellectual property leaving the organisation
- Regulatory compliance issues
- Loss of visibility over business data
- Increased cyber security risk
The concern isn’t that employees are using AI—it’s that organisations may not know what information is being shared, where it’s going or how it’s being protected.
The Data Shows a Growing Awareness Gap
One of the most concerning findings from Microsoft’s research wasn’t how many people use Shadow AI, but how few recognise the associated risks.
According to the research:
- Only 32% of employees were concerned about the privacy of company or customer data entered into consumer AI tools.
- Only 29% expressed concern about the security of their organisation’s IT systems when using these tools.
This highlights an important challenge for business leaders: technology alone isn’t enough. Employees also need clear guidance on using AI responsibly.
Shadow AI vs Enterprise AI
Not all AI tools are created equal.
Here’s how consumer AI differs from enterprise AI solutions.
| Shadow AI (Consumer Tools) | Business AI |
|---|---|
| Personal accounts | Business-managed accounts |
| Limited governance | Organisational controls |
| Unknown data handling | Business security and compliance |
| No IT oversight | Central administration |
| Individual adoption | Organisation-wide governance |
| Separate from business systems | Integrated with Microsoft 365 and business applications |
For organisations using Microsoft 365, enterprise AI solutions such as Microsoft Copilot provide security, identity management and compliance features designed for business environments.
Which Businesses Are Most at Risk?
Every organisation using AI should have a governance strategy.
However, Shadow AI is particularly relevant for organisations that:
- Handle customer or personal data
- Operate in regulated industries
- Use Microsoft 365 extensively
- Have hybrid or remote workforces
- Work with confidential commercial information
- Need to demonstrate compliance to customers or regulators
Even organisations with fewer than 100 employees can face significant operational and reputational consequences if sensitive information is shared inappropriately.
How to Reduce Shadow AI Risks
Banning AI altogether is rarely effective, because employees will often continue using tools that help them work faster if approved alternatives aren’t available.
Instead, organisations should focus on responsible adoption.
1. Create an AI Usage Policy
Define:
- Which AI tools are approved
- What information can be entered
- Acceptable business use
- Security responsibilities
- Approval processes
Clear guidance removes uncertainty for employees.
2. Provide Approved AI Tools
If employees need AI to work efficiently, give them secure alternatives.
Enterprise AI platforms provide:
- Business-grade security
- Identity management
- Data protection
- Compliance capabilities
- Central administration
When secure tools are easy to access, employees are less likely to seek unapproved alternatives.
3. Train Employees
Many Shadow AI incidents occur because employees simply don’t understand the risks.
Training should cover:
- Sensitive data handling
- AI best practices
- Privacy considerations
- Regulatory obligations
- Safe prompt writing
Awareness is one of the most effective security controls.
4. Review Security Controls
Ensure your organisation has appropriate controls around:
- Identity management
- Multi-factor authentication
- Data Loss Prevention (DLP)
- Microsoft Purview
- Conditional Access
- Endpoint security
These controls help reduce the risk of accidental data exposure.
5. Regularly Review AI Usage
AI adoption is evolving rapidly.
Business leaders should regularly review:
- Approved tools
- Employee requirements
- Emerging risks
- Governance policies
AI governance should become part of ongoing cyber security and risk management—not a one-off project.
AI Adoption Is an Opportunity If It’s Managed Properly
Microsoft’s research also highlighted a more positive story. Employee confidence in AI is growing.
More than half (57%) of UK employees described themselves as optimistic, excited or confident about AI, compared with 34% earlier in the year. Employees are also increasingly recognising AI as part of their organisation’s future strategy.
For business leaders, this presents an opportunity.
Organisations that provide secure, well-governed AI tools can benefit from increased productivity while reducing the risks associated with Shadow AI.
How Impact IT Solutions Can Help
AI adoption shouldn’t come at the expense of security.
At Impact IT Solutions, we help organisations embrace AI safely by combining Microsoft technologies with practical cyber security and governance expertise.
Our services include:
- Microsoft 365 security assessments
- Microsoft Copilot readiness
- AI governance guidance
- Data protection and compliance
- Identity and access management
- Microsoft Purview implementation
- Cyber security reviews
- End-user awareness training
Whether you’re introducing AI for the first time or strengthening existing controls, we can help you build an approach that balances innovation with security.
Take Control of AI Before Shadow AI Takes Control of Your Business
AI is transforming the workplace, and employees are embracing it at pace.
The question is no longer whether your people are using AI, it’s whether your organisation has the right governance, security and policies to support it safely.
By adopting business-grade AI solutions and establishing clear governance, businesses can unlock the productivity benefits of AI while protecting sensitive information and maintaining customer trust.
Frequently Asked Questions
What is Shadow AI?
Shadow AI is the use of artificial intelligence tools that haven’t been approved or managed by an organisation’s IT or security teams.
Why is Shadow AI a security risk?
Employees may unknowingly upload sensitive company or customer information into external AI platforms, creating potential privacy, compliance and security risks.
Is using ChatGPT at work considered Shadow AI?
If your organisation hasn’t approved its use or established policies around how it should be used, then yes—it may be considered Shadow AI.
How can businesses reduce Shadow AI?
Organisations should provide approved AI tools, create clear AI usage policies, train employees and implement appropriate security and governance controls.
Is banning AI the best solution?
Generally, no. Employees often adopt AI because it improves productivity. Providing secure, enterprise-grade AI tools alongside clear governance is usually a more effective approach.