Shadow AI: the policy gap sitting inside your business right now

Why bans fail

Blanket bans push AI use underground without reducing it: staff use personal devices and personal accounts, which strips away even the visibility you had. The tools are genuinely useful, which is exactly why prohibition loses to convenience every time. The goal is governed use, not pretended abstinence.

The five parts of a workable AI policy

• 1. An approved-tools list with sanctioned, paid accounts, so data handling terms are contractual rather than consumer-grade
• 2. Data classification rules: what may never leave the building (client data, financials, personal information) stated in plain language
• 3. Human accountability: AI output is a draft; a named person owns what goes out the door
• 4. Disclosure norms: when clients and staff are told AI was involved
• 5. Review cadence: the tool landscape changes quarterly, and the policy has to keep up

Classify the risk before you write the rules

Not all AI use carries the same exposure, and a policy that treats a marketing brainstorm like a client-data upload will be ignored. Three tiers cover most businesses. Tier 1, low risk: AI on public or non-sensitive material (drafting generic copy, summarising published research) — allow with attribution rules. Tier 2, controlled: AI touching internal business information (process documents, internal reports) — approved tools only, on paid accounts with contractual data handling. Tier 3, prohibited without explicit sign-off: anything involving client data, personal information, financials, credentials or legal matters — named-approver exceptions only, logged.

The tiers do the policy's heavy lifting: staff can self-classify most tasks in seconds, and the policy stops reading as a ban with loopholes and starts reading as a map.

The six clauses every AI policy needs

• 1. Approved tools: the sanctioned list, on paid/enterprise terms, and the request path for adding to it
• 2. Data rules: the three tiers above, with concrete examples per tier in your business's own vocabulary
• 3. Human accountability: AI output is a draft; a named person owns anything that leaves the building
• 4. Disclosure: when clients, candidates or staff are told AI was involved, and who decides
• 5. Logging and review: what usage is visible to the business, reviewed quarterly, because the tool landscape changes quarterly
• 6. Consequences and amnesty: how breaches are handled, plus a one-time amnesty for declaring existing shadow AI use, which converts your hidden users into your pilot group

Start with discovery, not documents

A policy written before you know what staff actually use is fiction. Discovery first: which tools, which teams, what data. Then policy, then approved alternatives, then training. That order is what turned our audit client's 30% exposure into a governed capability, and their board's anxiety into an evidence-based position.