Shadow AI

Staff are already using it, and a ban mostly moves it onto their phones.

Shadow AI is the use of consumer tools on work material without approval — drafting in a personal account, pasting a document into a free chatbot, running meeting notes through a transcription service nobody procured. Surveys consistently find it is widespread in organisations that believe they have prohibited it.

Prohibition without a sanctioned alternative produces the worst outcome available: the same use, on personal devices and personal accounts, invisible to the organisation, with no record and no data protection. The material most likely to be pasted into an unapproved tool is the material someone is struggling with, which is often the sensitive material.

The organisations that have handled this well have generally done the same three things: provided a sanctioned tool quickly, said clearly what may and may not go into it, and made the approved path faster than the unapproved one.

Why it matters here

For a public sector agency this is a records, privacy and information security exposure simultaneously — and in Queensland, a Public Records Act and RTI question as well, since a draft made in a personal account is still arguably a public record. It is also the most common gap between what an executive believes is happening and what is actually happening.

The question to ask

What is our sanctioned tool, how long does it take to get access, and is it faster than the free one?

Reviewed 2026-09-20 · All decoders