What is shadow AI and why does it matter to a business owner?
Shadow AI is the AI your staff already use without approval, usually on free accounts, often with your data pasted into it. It matters because the exposure is yours, the record of what was sent sits outside your systems, and a rule nobody wrote cannot be enforced after the fact.
Your company is already running AI. Nobody signed anything, nobody scoped it, and nobody can tell you what left the building last week.
How widespread is unsanctioned AI use at work?
KPMG and the University of Melbourne surveyed more than 48,000 people across 47 countries between November 2024 and January 2025. Of the employees who use AI at work, 57 percent said they hide it and present the output as their own. Two-thirds said they rely on that output without checking it for accuracy. Close to half said they have put company information into free public tools.
Forty percent said their employer has any guidance on generative AI at all. The rest are improvising with a public chat window and a deadline.
The Bank of Canada found the same split from the other side. In research published in August 2026, Chanya Chawla and Crystal Arnburg report that two-thirds of business leaders use AI weekly themselves, while only 8 percent of firms use it significantly in core operations and 28 percent have no plans to adopt it this year. The tools are already inside the company. The company has not noticed.
The distance between personal use and sanctioned use is the shadow layer, and the executive suite is standing in it.
Why banning it makes the exposure harder to see
A ban removes the record, not the tool. The work still has a deadline, the draft still has to be written by Thursday, and the phone in the drawer has a free account on it that your network will never see.
| Response | What it produces |
|---|---|
| Ban it | Use moves to personal devices and personal accounts, off your network and out of your records |
| Ignore it | Exposure compounds until a client, an auditor or a regulator finds it before you do |
| Sanction it and instrument it | A named tool, a written data rule, and a log somebody actually reads |
Statistics Canada found that cybersecurity and privacy concerns were the barrier cited most often by Canadian businesses not using AI, at 13.4 percent, ahead of cost at 10.6 percent. The same worry that keeps AI off the official roadmap is what pushes it onto personal accounts, where none of the controls the worry was about can reach it.
What belongs in a one-page data rule
- The approved tools, by name. Paid accounts with a business agreement, not the free tier, because the free tier is where the terms are worst and the logging is thinnest.
- What never gets pasted. Client identifiers, employee records, unreleased financials, anything covered by a confidentiality clause you signed.
- Who checks the output before a client sees it. Named by role, not left to whoever sent it.
- Usage logging. A tool that cannot report who used it and how much is not a business tool yet.
- A review date. The rule changes when the work changes, and the work is changing every quarter.
One page. Longer than that and nobody reads it, and a rule nobody reads produces exactly the behaviour you have now.
Ask before you audit
Start with an amnesty. Tell the team you want to know what they use, say plainly that nobody is in trouble, and write down what comes back. Expect the list to be longer than you think and to include at least one tool holding client data. That list is worth more than any policy, because it is the only honest map of where AI already touches the business.
Then buy the sanctioned version of what people are already using, attach the rule to it, and decide what a system is allowed to do without a person in the loop, which is the question the ORKA AI briefing on delegation takes apart. When the paid tool goes into procurement, put the data terms in the contract rather than the pitch, per the procurement problem.
Run the amnesty this month. It costs one email and an hour of listening, and it ends the part of this problem where you are the last person in the company to know.
Sources
- KPMG and the University of Melbourne, Trust, attitudes and use of artificial intelligence, a global study 2025. Nicole Gillespie and Steve Lockey, 48,000 respondents across 47 countries.
- Chanya Chawla and Crystal Arnburg, Bank of Canada, Canadian businesses’ use of AI, what the evidence shows, August 2026.
- Statistics Canada, Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026.
Software is only the surface. Infrastructure is the rest.
