Shadow AI: your staff are already pasting your IP into chatbots

Two-thirds of office professionals have used AI at work believing it broke company policy. A stricter policy is not the fix.

Your confidential material is already going into consumer AI tools, and the people sending it are not being careless. They are doing their jobs with the best instrument available to them, which is the problem.

What the numbers say

A survey of 1,250 office professionals — conducted by Wakefield Research in April 2026, at companies with at least $500 million in annual revenue, and deliberately excluding IT and technology roles — found:

One caveat we will state rather than let you discover: that survey covers Australia, Japan, the UK and the United States. It does not cover India. We are not going to convert its percentages into an Indian statistic, because we would be making it up. Read it as evidence of the pattern in comparable large enterprises — which is what it is, and which is enough.

What it looks like when it happens

In May 2023, Samsung Electronics restricted employee use of generative AI tools after three separate incidents inside roughly twenty days at a single division.

An engineer pasted in proprietary source code while debugging. Another transcribed a recorded internal meeting and pasted the transcript in to generate notes. A third used it to optimise a chip test sequence.

Read that list again, because the detail that matters is easy to miss: all three were ordinary work, performed competently. Nobody was careless. Nobody was malicious. Nobody was circumventing a control for personal gain. Three capable engineers reached for the fastest available tool to do the thing they were employed to do.

That is what shadow AI is. It is not a security failure in the usual sense. It is a productivity decision made by someone who does not have the full picture of the risk and does not have a sanctioned alternative that works as well.

Why policy does not fix it

The instinctive response is governance: write the policy, run the training, block the domains. Each of these fails, and the survey shows how.

66% used AI believing it was already against policy. At organisations with more than 1,500 employees, that figure rises to 72%. The policy exists. People are aware of it. They use the tools anyway, because a policy competes with a deadline and loses.

89% of people using AI for their job adopted it outside work first. By the time the question reaches your governance committee, your staff have been using these tools for months in their own lives, have formed a view of how useful they are, and are being asked to give up something that already works.

39% would use AI without disclosing it — 47% at companies above $1 billion in revenue. So enforcement pushes usage underground rather than eliminating it, which is strictly worse: you lose the ability to see what is happening while the material keeps flowing.

Blocking domains fails for the simplest reason of all. The device in their pocket is not on your network.

The uncomfortable inversion: 72% of respondents believe they understand AI use better than their own company's AI management team. Whether or not that is true, it is what the people making the daily decisions believe — and it predicts how much weight your policy actually carries.

Smaller organisations are more exposed, not less

The assumption that this is a large-enterprise problem is backwards. Among the same respondents, 40% of staff at companies with fewer than 1,500 employees entered customer data into public AI tools, against 27% at larger companies.

The reason is structural. Smaller organisations have fewer sanctioned tools, less procurement capacity, thinner IT functions, and correspondingly more individual latitude. The same qualities that make them fast make them porous.

What the risk actually is — stated precisely

We are going to be careful here, because this argument is routinely overstated and the overstatement is what makes security teams tune it out.

Frontier AI providers contract not to train on enterprise data, and there is no reason to believe they violate those contracts. That is not the exposure.

The exposure is that material entering a consumer tool through an individual account is outside your governance entirely. You do not know what was sent. You have no record of it. It sits under consumer terms rather than your negotiated enterprise agreement, subject to that provider's retention schedule, their sub-processors, and their jurisdiction. You cannot answer a regulator's question about it, you cannot include it in a breach assessment, and you cannot delete it, because you do not know it exists.

The problem is not that your provider is untrustworthy. The problem is that nobody in your organisation can tell you what left the building.

What actually removes the incentive

If people use the consumer tool because it is the best instrument available, then the only durable fix is to make the sanctioned instrument better at their actual job.

That is a higher bar than most internal AI deployments clear, and it is worth being specific about what it means:

It has to know things the consumer tool cannot. This is the one advantage that is structurally unavailable to a public chatbot: your contracts, your tickets, your policies, your history. A tool that can answer "what did we agree with this supplier about price escalation" from the actual agreement is doing something ChatGPT categorically cannot, no matter how capable the underlying model is. That asymmetry is the entire basis of the sanctioned option winning.

It has to be fast. If the internal tool takes eight seconds and the consumer one takes two, people will use the consumer one for anything that isn't obviously sensitive — and their judgement about what counts as sensitive is not your judgement.

It has to be where the work is. A separate portal requiring a separate login loses to a browser tab that is already open. Meet people in the tools they are already in.

It must not require permission. Every approval step is a reason to route around it. If using the sanctioned tool is more friction than not using it, you have built a control, not an alternative.

And the sensitive path has to be enforced in code. A rule saying "don't put client data in the external tool" is not a control — it is the same policy that 66% of respondents already ignore. A model registry and a privacy filter that make the sensitive path physically unable to reach an external endpoint is a control. The difference is whether the guarantee survives someone being in a hurry.

The honest limits

This does not eliminate the risk, and we are not going to claim it does.

Someone can still use their phone. Someone can still decide the internal tool is inconvenient for one particular task. A sanctioned alternative changes the economics of the choice; it does not remove the choice.

What it does change is the shape of the residual problem. Instead of everyone routing around a policy that competes with their deadline, you get a small number of people making a deliberate exception — which is a governance problem of a size you can actually manage, and which your monitoring can actually see.

That is a realistic goal. Zero shadow AI is not.

What to do this week

Four things, in order, none of which require buying anything:

1. Measure before you legislate. Find out what is actually being used and for what. Ask, in a way that does not punish honest answers — the survey above suggests that punitive framing produces concealment rather than compliance.
2. Find the two or three workflows driving most of it. Shadow AI is not uniform. It clusters around a handful of genuinely painful tasks — usually drafting, summarising long documents, and explaining something unfamiliar.
3. Sanction something immediately, even if it is imperfect. An enterprise agreement with a frontier provider, with your own terms and your own logging, is dramatically better than individual consumer accounts and can be in place in days. It is not the end state, but it stops the bleeding.
4. Then decide what needs to be internal. The workflows that touch your most sensitive material — and only those — are the ones that justify an architecture where the data physically cannot leave.

That last step is where we work. The first three you should do regardless of whether you ever talk to us, and they are worth more in the first month than any procurement decision.

Sources. Shadow AI Survey conducted by Wakefield Research, 9–20 April 2026, n=1,250 office professionals at organisations with $500M+ annual revenue, excluding IT and technology roles, across Australia, Japan, the UK and the US; published by PagerDuty. Samsung incidents as reported by Bloomberg and Forbes, May 2023.

Want to know which of your workflows genuinely need to stay internal? A one-day Discovery Sprint produces a written recommendation — including the recommendation that a workflow does not need on-premise infrastructure, where that is the answer.