What to do about shadow AI?

Workers are embracing AI – whether their bosses know it or not. Steve Cassidy explores the threat, and the opportunities

Really, we IT types ought to have seen this one coming. In computing, new working practices and technologies frequently become commonplace not through big formal rollouts, but via unofficial “shadow” practices. So while C-suite types are discussing how to build AI carefully into their businesses, it’s not surprising to learn that it’s already a de facto part of many workflows. Microsoft research published last October revealed that 71% of UK employees had used unapproved AI tools at work, with 51% admitting that they do so on a regular basis.

Let’s be clear what we’re talking about. “Shadow IT” is the umbrella term for technologies and services that workers use to help them do their jobs without organisational approval or knowledge. With free tools such as ChatGPT able to answer questions, summarise reports and spot data trends in seconds, it’s hardly surprising that shadow AI is booming across all sorts of industries.

What is the actual threat?

The problem with shadow IT in general is that it’s unmanaged. When you don’t know exactly who’s using what external systems, you’re at risk of hidden security issues and compliance holes. If shadow IT is present in your organisation, it’s very likely that some sort of operational data is leaving your systems and being shared with external companies whose privacy policies, it’s fair to say, you probably haven’t audited and approved.

And shadow AI brings particular additional concerns. A big part of AI’s appeal is that you can tell it what to do in plain English – you don’t need to figure out how to use a specialist application interface, or even really understand what it’s doing at all. You can just paste in a load of numbers, ask it which are the ones you ought to be worried about, and get on with your day.

From a technology and management perspective, this is not necessarily a good thing. You get your answer, but you don’t know exactly what the AI did, or how it did it; it’s not even guaranteed that the next run will produce the same output. These are challenging issues for businesses that have been running for decades on neatly documented, repeatable processes. As an example of the risk this raises, let’s consider a classic shadow AI scenario: an administrator in a small business has been using a clunky cloud application to file and search invoices. It’s secure but slow, and has limited search and reporting options. Then the administrator discovers that they can upload a folder full of PDFs to ChatGPT and get all sorts of instant insights about company spending. The immediate impact is a huge benefit to their workflow, and potentially to the business as a whole – but decisions stop being checkable and accountable, and the sharing of potentially sensitive financial information is a clear governance risk. There’s a procedural risk, too: if managers come to rely on this new information, you’ve created a new dependency on a third-party service that you don’t control or even have any formal relationship with.