Copy article

Shadow AI

ended 18. September 2026

Your staff are spending £958m a year of their own money on AI tools you never approved.

Deloitte surveyed 25,000 UK workers and found 63% use generative AI at work. Nearly a third of those users, 31%, do it without their employer knowing. https://www.deloitte.com/uk/en/about/press-room/british-workers-spend-one-billion-pounds-of-their-own-money-on-gen-ai-for-work.html

17% pay for at least one tool out of their own pocket. Across the UK that's £958m a year of workers' own money spent doing their day job. Around half have had no training at all on using it safely.

For a small firm that means client details, staff records and quotes going into free tools nobody has checked. It's the office kettle somebody brought in from home. Handy, right up until it trips the electrics.

Most owners haven't banned it and haven't approved it. They just haven't looked.

Pick one tool, write one page, train the team on it. A ban you can't enforce is worse than no policy at all.

Be blunt:

  • Should staff paying for their own AI tools be reimbursed, or is that their choice?
  • Ban it or approve it: which is safer for a firm with no IT department?
  • Whose fault is shadow AI, the employee who used it or the employer who never gave them one?
  • Does an AI policy mean anything at all without training behind it?
  • Have you found staff using AI you didn't know about? What did you actually do?

5 responses from the Newspage community

Copy all

Star Quote
Copy

Pro
Kate UnderwoodVerified
Founder & Chief People Strategist at Kate Underwood HR and Training
Here's the bit that stings. Your team aren't being sneaky. They're being productive on their own money, because nobody gave them a tool or a rule. Then something goes into a free chatbot that should never have left the building, and suddenly it's a data breach with your name on it. Small business owners, this is a one page job. Name the tool you'll pay for. Say what must never be pasted in. Train the team once and write down that you did. The cheapest policy you'll ever write is the one you write before the incident.
Copy

Pro
Lewis MaxwellVerified
Director at Adviser IQ
As someone who specialises in the development of AI tools and systems, nobody should be using personal accounts with client details. Enterprise plans are a must to prevent AI training. Also, residency is a massive issue, as a lot of regulated firms use these tools, and data going to the likes of the US where data can be accessed and you would never know. Massive data issue.

Bottom line, company controlled or not at all.
Copy

Pro
Matt CoulsonVerified
Founder at Heron Financial
The £958m figure is really the symptom. People pay out of their own pockets because the tools genuinely help them and their employer hasn't given them a sanctioned way to use them. Banning it just drives it underground, and in a regulated business that is the real danger: client data dropped into a free, often US-based tool with no oversight. This is a leadership issue before it's an IT one. If half of staff have had no training, that sits squarely with the employer. The answer is a proper, secure, approved set of tools, with clear rules and training, so nobody needs to go rogue to do their job well. Reimbursing whatever people have already signed up to just subsidises the risk. We built our own systems partly for this reason: give people good technology inside a governed environment and the shadow problem largely fades. Small firms can't opt out. If your staff use AI already, you're already exposed, so get ahead of it.
Copy

Pro
Tony RedondoVerified
Founder at Cosmos Currency Exchange
In the opinion of my IT guru, the use of shadow AI in businesses is down to leadership failure and all businesses should stop letting employees pay for unvetted tools out of pocket; reimbursing them sanctions software that's never had a security or GDPR review. Banning it outright is pointless without IT to enforce it as employees would just switch to their own phones. The fix is one approved, enterprise-grade tool with zero data retention for training, plus a clear line on what can and can't be uploaded. Staff turn to shadow tools because nobody gave them a proper alternative. That's a governance gap, not employee misconduct. And a policy nobody's trained on is a paper shield; people need to know what counts as sensitive data and why pasting it into consumer tools is a legal risk. When shadow AI surfaces, don't panic-ban it but audit what's actually being used, consolidate onto one secure platform, and set plain boundaries on what it's for.
Copy

Pro
Tony SanchezVerified
Founder at Bridging Loan Directory
If a business wants the productivity gains from AI, it should pay for approved tools and give people time to learn how to use them. Staff should not have to fund a work tool themselves, but that does not mean every personal subscription should be reimbursed.

I use AI in running Bridging Loan Directory. The useful work is deciding what it can help with, what information it can receive and what needs checking before it leaves the business.

Drafting a routine email and uploading a borrower’s financial documents are very different uses. An AI policy needs to make that distinction clear, with examples people can recognise.

For a small firm, I would favour approved access and practical training over a blanket ban. Employees still have responsibilities, but an owner cannot leave the rules unwritten and then act surprised when everyone invents their