Your Team Is Already Using AI. Do You Know What They’re Sharing?

On Tuesday, we talked about moving past basic chat tools to AI that delivers real results. Before you build anything, though, there's a more immediate question: what AI is your team already using, and what information is going into it?

For most businesses, the honest answer is "we're not sure." Employees discovered AI tools on their own, found them useful, and started using them for work. Nobody approved it, and nobody set rules, because nobody asked.

That's called shadow AI, and it's one of the most common technology risks we see in 2026. The good news is that it's also one of the easiest to fix.

What is shadow AI?

Shadow AI is the use of AI tools at work that the business hasn't reviewed, approved, or secured. It usually means employees using personal or free accounts on public AI services to handle company information.

It looks completely ordinary:

• A bookkeeper pastes a client's financial summary into a chatbot to draft an email.
• A salesperson uploads a contract to get a quick summary of the terms.
• An office manager connects a free AI note-taker to company meetings.
• A manager drops an employee review into an AI tool to clean up the wording.

Each of those saves time. Each also sends business data somewhere the business doesn't control.

How common is shadow AI?

Very common. In PagerDuty's 2026 survey, 66% of office professionals said they had used AI tools at work despite believing they weren't permitted, and many had entered sensitive business data. Another 2026 survey of small and midsize businesses found that while 81% had adopted AI tools, only 69% had a policy governing their use.

The cost of getting it wrong is measurable. IBM's 2025 Cost of a Data Breach Report found that 20% of breached organizations had an incident tied to shadow AI, adding an average of $670,000 to the cost of the breach.

Sources: PagerDuty 2026 Shadow AI Survey, IPFone on the 2026 SMB survey and IBM's breach report.

What does shadow AI look like in a real business?

During an assessment for one of our clients, we found employees using free AI platforms, including ChatGPT, Grok, and other public tools, to write job proposals and bids and to process company information. None of it went through company accounts, and there were no security controls or oversight in place.

The owners were very concerned to learn that sensitive business data had been going into personal AI accounts the business couldn't see or manage. It's the most common way shadow AI shows up: people trying to get work done faster, with nobody watching where the data goes.

As a result, the owners have begun implementing a formal AI usage policy, and they're continuing to develop it, to keep this from happening again and make sure company data is handled securely.

Why is shadow AI a risk for a small business?

The risk isn't AI itself. It's business data leaving your control without anyone knowing.

A few specific problems:

• Training on your data. Free tiers of many public AI tools may use what you type to improve their models unless that setting is turned off.
• No visibility. If something goes wrong, you can't see what was shared, by whom, or when.
• Compliance exposure. Customer, patient, or financial information entered into an unapproved tool can create obligations under privacy and industry rules, and that responsibility sits with the business.
• Lost work when people leave. Prompts, files, and outputs in a personal account walk out the door with the employee.

Should you just ban AI tools?

No. Banning AI usually pushes it underground instead of stopping it. People who've found a tool that saves them an hour a day will keep using it, just more quietly, and you lose any chance of seeing what's happening.

The better approach is to make the safe path the easy path: give people approved tools that meet their needs, set clear rules about data, and explain why the rules exist.

What should an AI acceptable use policy include?

A practical AI policy tells employees which tools they can use, what information they can never put into them, and who to ask when they're not sure. It should fit on a page or two, because a policy nobody reads protects nobody.

At minimum, cover:

1. Approved tools. Business-tier AI tools the company provides, with data protections turned on.
2. Restricted data. Customer records, financial information, employee data, contracts, passwords, and anything regulated stay out of unapproved tools.
3. Appropriate uses. Examples of tasks AI is good for, and tasks where a person must review the output before it goes anywhere.
4. New tool requests. A simple way to ask for a tool to be reviewed instead of signing up on their own.
   Ownership. One person responsible for keeping the tool list and the policy current.

How do you roll out approved AI tools?

Start by finding out what people are already using and why. Those answers tell you which approved tools will actually replace the shadow ones.

Then:

1. Ask your team, without blame. A short survey or a team conversation gets more honest answers than an audit.
2. Choose business-tier tools that match what people need, with admin controls and data protections.
3. Turn off what you don't need. Review sharing, connector, and retention settings before rollout.
4. Train briefly and practically. Show people what good use looks like in their actual jobs.
5. Review every quarter. New tools appear constantly, and your approved list should keep up.

Policy first, then progress

An AI policy isn't red tape. It's what lets your business use AI confidently instead of hoping nothing goes wrong. Once the guardrails are in place, the projects we talked about on Tuesday get much easier to approve.

Let's see what AI is already in your business

At Absolute, we do IT differently. We help East Texas businesses find the AI already in use, write a policy people will actually follow, and set up approved tools that protect your data. If you don't have an AI policy yet, we'll help you build one that fits how your team works.

Call us at 903-807-0303 or reach out via our contact form.