You're offline, showing the last version we saved.
Build with AI · Using AI safely

Shadow AI: find the AI your team already uses, without blame

Your team is probably already using AI the firm doesn’t know about. That’s usually people trying to do good work faster. Here’s how to find it without blame, and move it somewhere safe.

For beginners · Checked 11 November 2026 · Not advice

In plain English

Shadow AI is any AI tool used for work that the firm hasn’t approved: a personal ChatGPT account, a free PDF summariser, a browser extension, or an AI feature switched on by default in software you already pay for.

Treat it as a sign of demand, not misconduct. Banning it tends to push it out of sight. Finding it and offering a safe option brings it back where you can see it.

What can go wrong

  • Personal accounts Client data sits in an account the firm can’t see, and it leaves when the person does.
  • Free tools Free summarisers and converters often have terms nobody has read.
  • Browser extensions Some can read every page you open, including client portals and email.
  • Default-on features AI summaries and drafting switched on in email, meetings and documents without anyone deciding.
  • Notetakers that join calls A bot joins a client meeting before anyone has asked the client.

For beginners

Run an AI amnesty in six steps

  1. Step 1: Announce an amnesty

    Say clearly that nobody gets in trouble for anything they tell you. Copy the message below.

  2. Step 2: Ask four simple questions

    Which tools, what for, which account, and has client information gone in. Keep it short.

  3. Step 3: Sort what you find

    Keep it, replace it with an approved tool, or stop it. Most needs can move to one approved tool.

  4. Step 4: Give everyone an approved account

    The safe way has to be the easy way, or the shadow tools come back.

  5. Step 5: Switch off or block what you stopped

    Ask your IT provider about blocking tools on firm devices and switching off default-on AI features.

  6. Step 6: Repeat every quarter

    New tools appear all the time. Make the amnesty a regular, friendly check-in.

Where to look

Where shadow AI hides

Ask about these by name: people often don’t think of them as AI.

  • Personal ChatGPT, Claude, Copilot or Gemini accounts on work devices
  • Free PDF, document and spreadsheet summarisers
  • Browser extensions that write, summarise or translate
  • AI features in email, Microsoft 365, Google Workspace, Zoom or Teams
  • Meeting notetakers that join calls automatically
  • AI features inside your practice and accounting software

Your IT provider may be able to report which apps and extensions are installed on firm devices.

Copy and use

The amnesty message

Send it from the owner, by email or in a team meeting.

Subject: AI amnesty: tell us what you use, nobody is in trouble

Hi team,

Lots of us are using AI tools to get work done faster, and that's a good thing. We want to make sure the tools we use protect our clients, so we're running an AI amnesty.

Please reply by [date] and tell us:
1. Which AI tools or features you use for work (including free ones, browser extensions and features inside other software)
2. What you use them for
3. Whether it's a personal account or a firm account
4. Whether any client information has gone into them

Nobody will get in trouble for anything you tell us. We'll use the answers to give everyone an approved tool that's safe for client work.

Thanks,
[Name]

If someone tells you client data went in

  1. Thank them. The amnesty only works if owning up is safe.
  2. Note what went in, when and in which tool, and delete the chats if you can.
  3. Follow your AI incident plan and assess whether it’s likely to cause serious harm.
  4. Move them to an approved account the same day.

Use these next

Please read: use these at your own risk

  • These prompts, guides and tools are general information, not professional, legal, privacy or IT advice. The Firm takes no responsibility for how they are built, changed or used, or for anything that results.
  • AI writes a slightly different tool each time. Whatever you build or download is yours to check, test and approve before you rely on it or use it with client data.
  • Check your AI provider’s current settings and terms for how your data is stored and whether it is used to train its models. Plans and settings change.
  • Bring your own judgement, and follow your firm’s AI policy and your professional and privacy obligations.

Questions firms ask

What is shadow AI?

AI tools people use for work without the firm’s approval, such as personal ChatGPT accounts, free summarisers, browser extensions and AI features switched on by default in other software. The risk is client data going somewhere the firm can’t see or control.

Should we just ban AI?

Bans tend to push use out of sight rather than stop it. Giving everyone an approved tool, with a clear rule about client data, reduces the risk far more than a ban the firm can’t check.

How do we find out which AI tools staff are using?

Ask, with an amnesty so nobody is punished for answering honestly, and name the places people forget: browser extensions, free summarisers and AI features in software you already use. Your IT provider may also be able to report what’s installed on firm devices.

What if staff keep using unapproved tools after the amnesty?

Find out why. Usually the approved tool is missing something they need. Fix that, make the approved tool the easiest option, and ask your IT provider about blocking the rest on firm devices.