Shadow AI at firms: what it is and how to keep client data safe.

It rarely starts with bad intent. Someone has a deadline, the approved tools are slow or missing, and a chatbot on their phone gets the draft done in two minutes. Microsoft and LinkedIn surveyed 31,000 people in 31 countries in 2024: three in four knowledge workers already used AI at work, and 78% of those users brought their own tools.

What shadow AI looks like at a firm

• A personal chatbot account used to summarise a client file or polish a letter.
• An AI note taker that joins calls from a calendar invite and keeps the recording on its own servers.
• A browser extension that reads every open page, client records and the CRM included.
• A transcription or translation website used for a document someone needed in a hurry.
• A small tool a colleague built with an AI coding assistant and connected to a shared drive.

Each of these moves client data somewhere the firm can't see, under terms nobody at the firm has read.

Why it matters for client data

IBM's 2025 Cost of a Data Breach report studied 600 organisations that had a breach. One in five reported a breach due to shadow AI, and those with high levels of shadow AI paid on average $670,000 more per breach than those with little or none. 63% of the breached organisations had no AI governance policy, or were still writing one.

For a firm, the cost that matters most is harder to count: a client who learns their file went into a tool nobody approved.

Banning AI tends to make it worse

When every AI tool is blocked, the work still needs doing, so people move to personal phones and accounts, where the firm sees even less. InformationWeek put it plainly in 2024: a blanket prohibition on AI will likely lead to shadow AI. Firms that keep client data safe tend to say yes to AI and set the terms.

Five steps to bring shadow AI into the open

1. Ask. A short, no-blame survey of which tools people use and what for. The answers show where the approved tools fall short.
2. Look. Sign-in logs, browser extensions, calendar invites from note takers and expense claims for AI subscriptions show what the survey missed.
3. Choose approved tools. Business plans usually come with different data terms from personal accounts. Read them, and pick the tools that keep client data in the firm's own accounts.
4. Write it down. One page is enough: which tools are approved, which data never goes into any of them, and who to ask. Our AI use policy template is a place to start.
5. Keep watching. New tools appear every month. Monitoring software can flag client data moving to an AI tool nobody approved; a person checks each flag, and the IT team closes the gap.

Where data loss prevention fits

Shadow AI is one of the ways client data leaks. Data loss prevention is the wider practice: knowing where sensitive data lives and stopping it leaving through the wrong door, whether that's email, shared files, AI tools or backups. Microsoft's data loss prevention documentation now lists Microsoft 365 Copilot and, through the browser, ChatGPT among the places its policies can reach.

Our data loss prevention service begins with a complimentary audit that maps where your client data lives and which AI tools can reach it.

Questions firms ask

Is shadow AI the same as shadow IT?

Shadow IT is any technology used without the IT team knowing. Shadow AI is the part of it that reads, writes and remembers what people give it, which is why client data is the worry.

Is using ChatGPT at work shadow AI?

It is when the firm hasn't approved it, or when someone uses a personal account for client work. A business account the firm chose and set up is an approved tool.

Should we ban AI tools?

Most firms that try find the use moves to personal phones. Approved tools, a one-page policy and monitoring keep the gains of AI and keep client data in view.

How do we find out what people use?

Ask first, then check sign-in logs, browser extensions and expense claims. An audit does both.