Your employees are already using AI. Do you know what they're putting into it?

AI is finding its way into everyday business, often without anyone officially introducing it. The question isn't whether your employees are using it. It's whether they understand what they're sharing.

AI doesn't need an invitation

Think about how easy it is to use AI today.

You've got a difficult email to write. A spreadsheet that needs analysing. A customer complaint that needs a response. Maybe a complicated document you just want someone to summarise.

Open an AI tool, paste in the information, ask a question and get an answer in seconds.

It's incredibly useful. I use AI regularly, and I'm a big believer in what it can do when applied properly.

But there's something worth thinking about.

What exactly did you just give it?

Was that spreadsheet full of customer information? Did the email contain commercially sensitive details? Was the document something your organisation had agreed to keep confidential?

And perhaps more importantly, does anybody in your business know that information has been shared?

Meet shadow AI

There's a term for technology being used within a business without formal approval or oversight: shadow IT.

Shadow AI is effectively the latest version of the same problem.

An employee discovers a useful AI tool, starts using it to make their job easier, and before long it's become part of their daily routine.

Nobody necessarily approved it. Nobody checked how the information would be handled. And nobody thought to ask whether it was appropriate for the task.

The interesting thing is that the employee probably isn't doing anything malicious.

They're trying to do a better job.

And that's precisely why I think businesses need to approach this differently.

You don't solve shadow AI by treating everyone like they're doing something wrong. You solve it by understanding why they're using it in the first place.

The problem isn't necessarily the AI. It's the information.

Let's take a simple example.

Someone in your customer service team wants AI to help draft a professional response to a complaint.

Nothing particularly controversial there.

But instead of asking it to produce a general response, they paste in the entire customer email, complete with their name, address, order details and complaint history.

Suddenly, something that started as a harmless productivity exercise involves personal information being processed by an external service.

That doesn't automatically mean a data breach has occurred, or that using the AI tool is unlawful.

It does mean there are questions the organisation should already have considered.

Where is that information going? Who processes it? How long is it retained? Can it be used to improve the service or train models? What contractual protections are in place?

And remember, it's not just personal data.

Businesses also hold pricing information, contracts, intellectual property, financial forecasts, internal discussions and plenty of other information they wouldn't normally share with an unknown third party.

AI doesn't make those responsibilities disappear.

Banning AI isn't much of a strategy

I understand why some organisations respond by blocking AI tools altogether.

If you can't control the risk, remove the technology. Simple.

Except it isn't always that simple.

People have work to do. If a tool makes something substantially quicker or easier, there's a strong incentive to use it.

A blanket ban might be appropriate in particular environments or for certain activities, but on its own it doesn't help an organisation understand the opportunities, establish safe alternatives or build confidence in the technology.

I'd rather see businesses ask a more useful question:

How can we help people use AI safely, rather than just telling them not to use it?

That doesn't mean giving everyone unrestricted access.

It means putting sensible boundaries around a genuinely useful technology.

Five practical things I'd start with

You don't necessarily need an enormous AI governance programme to make progress.

For many organisations, a few straightforward steps would be a good start.

1. Find out what's already happening

Before writing policies or buying expensive software, speak to your teams.

Ask which AI tools they're using, what they're using them for and where they're finding them helpful.

You might discover some genuinely brilliant opportunities for improving the way your business works.

You'll also get a much clearer picture of the risks.

2. Make it clear what information is off-limits

Employees shouldn't need a qualification in data protection to understand whether something is appropriate to share.

Give them clear examples.

Customer records, employee details, confidential contracts and sensitive business information shouldn't be entered into unapproved AI services.

Where an approved AI solution is available, define what information it can process and under what conditions.

The important distinction is that not all AI tools have the same data-handling arrangements.

3. Give people an approved way to use AI

If you want people to follow the rules, make the safe option practical.

Choose appropriate tools, review their security and privacy arrangements, and explain what they're approved for.

Depending on the use, that might include reviewing supplier contracts, retention settings, access controls, data transfers and whether a data protection impact assessment is required.

An approved tool isn't automatically approved for every possible type of information.

4. Teach people to question the output

Data security is only part of the story.

AI can produce answers that sound perfectly convincing but are completely wrong.

That becomes particularly important when somebody uses it to interpret contracts, produce technical documentation, analyse information or support decisions about people.

Employees need to understand that AI can help them do their jobs, but it doesn't remove their responsibility to check the result.

5. Keep the conversation going

AI is moving quickly, and the way people use it will continue to change.

A policy written once and forgotten about isn't going to be particularly useful.

Give employees somewhere to ask questions, suggest tools and raise concerns without feeling they're about to get themselves into trouble.

And when something does go wrong, make sure there's a straightforward way to report it so the organisation can assess and respond appropriately.

Governance should make things possible

Having worked across technology, data and governance for more than two decades, one thing I've learned is that rules only really work when people understand why they're there.

You can have a beautifully written policy, but if it bears no resemblance to how people actually work, don't be surprised when they find a way around it.

AI presents a fantastic opportunity to remove repetitive work, improve processes and help people focus on things that genuinely need their expertise.

I wouldn't want to discourage any of that.

But the opportunity needs to sit alongside an understanding of the information we're handling and the responsibilities that come with it.

Good governance shouldn't be about making technology difficult to use.

It should make it easier to use with confidence.

One question worth asking tomorrow

If you asked ten people in your organisation which AI tools they used last week, what would they tell you?

And would their answers surprise you?

That seems like a pretty good place to start.

DataFormatter — Real problems. Practical experiments. Lessons shared freely.