Guide
Glossary
Shadow AI
Shadow AI is the use of AI tools at work without the firm's knowledge or approval, such as staff pasting client emails into a personal ChatGPT account, installing an AI browser extension or letting an AI note-taker join client meetings. It usually starts with good intentions: people want to save time. The risk is that client and staff information goes to services the firm has not checked, under consumer terms that may let the provider keep or train on it, with no record of what was shared. Blocking AI websites on the office network does not stop use on personal phones. Firms reduce shadow AI by providing an approved tool, a clear AI acceptable use policy and training.
Also called unsanctioned AI, unapproved AI use
Last updated:
Example
In a law firm
A graduate lawyer at a 40-person firm uploads parts of a discovery bundle to a free AI tool from home to summarise it overnight. Nobody else knows the documents left the firm. Once a partner finds out, the firm reviews the tool's terms, assesses whether it is a notifiable data breach, gives staff an approved AI plan with single sign-on and updates its acceptable use policy.
Guides that explain it in context
Secure by design. Set up correctly. Fully managed.
Talk to us before you commit to anything
Start with a free 45-minute discovery call. We look at your systems and priorities, then recommend a first step with a fixed scope, or tell you if we are not the right fit.