Shadow AI at Work: Why Professionals Use Unapproved AI (And How to Stay Safe)

Why shadow AI at work is now normal

Shadow AI at work is majority behaviour, not fringe behaviour. In Microsoft and LinkedIn’s 2024 Work Trend Index, a survey of 31,000 knowledge workers across 31 countries, 75% said they used AI at work — and 78% of those users were bringing their own tools rather than using anything the company provided.

Those 2024 figures are still the ones everyone cites, and the detail underneath them is more useful than the headline:

• It isn’t generational. 85% of Gen Z AI users brought their own tools — but so did 73% of boomers.
• It’s worse at smaller companies (80%), where there’s no enterprise licence to inherit.
• Almost nobody was trained. Only 39% of people using AI at work had received any AI training from their employer.
• Pressure is the engine. 68% said they struggle with the pace and volume of work, and 46% reported burnout.

Security teams see the same picture from the other side. Gartner surveyed 302 cybersecurity leaders between March and May 2025 and found 69% of organisations either suspected or had evidence that staff were using prohibited public AI tools. Almost everyone knows. Very few have done anything beyond blocking domains.

The underground worker problem

The most revealing number in that Microsoft research has nothing to do with security. 52% of people using AI at work were reluctant to admit they used it for their most important tasks, and 53% worried that using it made them look replaceable.

That’s the real engine of shadow AI at work. It’s a disclosure problem before it’s a data problem — people hide the tool because they’re afraid of what using it says about them, and the hiding is precisely what strips away every safety net that would otherwise exist. Most IT directors will tell you the same thing off the record: a blanket ban doesn’t reduce usage, it just relocates usage onto personal phones where nobody can see it at all.

Shadow AI at work vs shadow IT

Shadow IT was about unapproved software. Shadow AI at work is about unapproved software that you feed your company’s information into, which is a different risk with a different shape.

The distinction changes what you should actually worry about. With an unapproved file-sharing app, the risk is where the file ends up sitting. With an unapproved AI tool, the risk is what the tool does with your text after you press send.

The line worth remembering: your prompt is often more sensitive than your file. “Draft a redundancy letter for our Manchester warehouse team” leaks a business decision that exists in no document anyone could have stolen.

What you can safely paste

The whole of shadow AI at work turns on one question, and it takes two seconds to answer. Before you paste anything, ask whether you’d be comfortable seeing that exact text on a public forum with your employer’s name attached. If the answer is no, it needs work before it goes near a personal AI account.

In practice, work data sorts into three lanes.

If you want the red lane in a form you can forward to a colleague, these five categories are the ones that turn a productivity shortcut into an incident report:

1. Personally identifiable information — customer names, addresses, email addresses, ID numbers.
2. Unreleased financials — forecasts, budgets, and results before they’re announced.
3. Proprietary material — source code, trade secrets, unfiled patent material.
4. Health and HR records — anything covered by medical or employment confidentiality.
5. Signed agreements — contracts, NDAs, and merger or acquisition documents.

One caveat people miss: the red lane applies to what comes out as well. Ask a public model to help you interpret a contract clause and the clause is now in that conversation, however carefully you worded the question.

The Strip-Swap-Send Method

Sanitising a document is the core skill of doing shadow AI at work safely, and most advice on it stops at “remove sensitive information” — which isn’t a method, it’s a wish. The Strip-Swap-Send approach we teach at PromptPeakAI turns it into three passes you can run in under a minute, ordered so the pass that catches the most serious leaks happens first.

Delete every name that identifies a person or an organisation: clients, colleagues, suppliers, internal project codenames, office locations. This pass goes first because it removes the legally sensitive material rather than the merely commercially sensitive material.

Don’t leave holes — replace what you stripped with labelled stand-ins. Models produce better output when they know a slot exists and what kind of thing belongs in it, and you keep the ability to find-and-replace the real values back into the finished draft. Exact figures rarely need to survive either: round them, index them, or turn them into ratios.

The final pass isn’t about privacy — it’s about accuracy. A sanitised document has gaps in it, and a model asked to be helpful will cheerfully fill those gaps with plausible inventions. So tell it not to.

Work only from the text I provide below. Do not add facts, figures, names, dates, or examples that are not present in it.

Where information is missing, write [GAP] rather than guessing.

If a bracketed stand-in appears in the text, keep it as a stand-in in your output. Do not invent a real name or number to fill it.

Text:
[paste your sanitised text here]

That instruction matters more than it looks. The most common failure after sanitising isn’t a leak — it’s the model quietly replacing [Client] with a realistic-sounding company name that then survives into a document you send to someone.

You are an operations analyst preparing a briefing for a senior manager.

Below is an anonymised extract from an internal status document. Names have been replaced with bracketed stand-ins and figures have been generalised.

Produce:
1. Three risks, ranked by urgency
2. Five decisions the manager needs to make
3. One line on what happens if nothing changes

Rules: work only from the text provided, keep every bracketed stand-in exactly as it is, and mark anything you cannot determine as [GAP].

Text:
[paste your sanitised extract here]

Act as a privacy reviewer. Do not summarise or rewrite the text below.

List anything that could still identify a real person, company, client, or project — including indirect clues like unusual dates, job titles, locations, or figures specific enough to trace back.

For each item, say what it reveals and suggest a generic replacement.

If nothing identifying remains, reply with one word: CLEAR.

Text:
[paste your sanitised text here]

Then reverse the swap. Paste the output into your own document, find-and-replace the stand-ins with the real values, and the finished work is identical to what you’d have written by hand — except the tool never learned who it was about. The same principle covers summarising a long document and asking for an Excel formula, where you only ever need the column structure, never the rows.

Switch off training in your tools

Sanitising your input is the habit that protects you. Switching off model training is the setting that protects you, and it’s the half of shadow AI at work most people never touch — on personal accounts it is usually not off to begin with.

Here is where each control lives, checked against each vendor’s current documentation.

For ChatGPT, the path in OpenAI’s Data Controls documentation is profile icon, then Settings, then Data Controls, then turn off Improve the model for everyone. Your chat history stays where it is; only the training use stops.

Claude’s equivalent is Help improve Claude, under Settings and then Privacy. Worth knowing: Anthropic changed the consumer default in September 2025, so Free, Pro, and Max accounts now contribute to training unless somebody turned that off. Business accounts don’t. There’s more in our guide to whether Claude is safe to use at work.

Gemini is the awkward one, because Google is mid-rename — the control has been called Gemini Apps Activity and is being relabelled Keep Activity. The location stays stable even when the label doesn’t. Switching it off stops future chats being sampled for human review, but conversations already selected for review are kept for up to three years, and deleting your activity doesn’t pull those back.

None of these settings make a consumer tool suitable for red-lane material. They reduce what happens to your text afterwards; they don’t change the fact that you sent it. For the tool-by-tool detail, see our guides on whether ChatGPT is safe to use at work and what Copilot can see of your work data.

The safe tool you already have

Here’s what most shadow AI at work guides get wrong. They frame the choice as a personal account with training switched off versus a paid licence nobody will approve. For a lot of readers there’s a third option sitting in a login they already use daily.

Two of them, specifically:

• Microsoft 365 Copilot Chat. If your organisation has a qualifying Microsoft 365 subscription and you sign in with your work account, you get AI chat covered by enterprise data protection at no extra cost. Prompts and responses aren’t used to train the underlying models.
• Gemini inside Google Workspace. On a Workspace business plan, Gemini is a core service and Google contractually excludes your organisation’s data from training its models. Same product surface, entirely different terms from the consumer app.

Spend ten minutes checking what your employer already pays for before assuming the answer is no. And if the sanctioned option turns out to be genuinely weaker than what you’ve been using — which does happen — that gap is the strongest argument you can put in a licence request. Our comparison of free versus paid Copilot covers where the line actually falls.

How to get AI tools approved

The permanent exit from shadow AI at work is a licence, and most requests for one fail on framing rather than budget. They arrive as a preference — “can we get ChatGPT?” — rather than as a business case with the risk answer already in it. Security teams reject requests that make them do the thinking.

A request that works fits on one page and answers four questions before anyone asks them: what the task is, what it costs today, what the tool costs, and what happens to the data. Use AI to draft it — a structured internal memo is exactly the kind of document it handles well.

You are helping me write a one-page internal request for an AI tool licence.

Audience: [IT security lead] and [my line manager], neither of whom uses AI daily.

Context:
- Team: [team name], [number] people
- Recurring task: [task], currently around [hours] per person per week
- Tool requested: [tool and plan], [cost] per user per month
- Data involved: [describe it, and say whether it is anonymised]

Structure it as: the problem, the current cost in hours, the proposed tool, the data-handling answer, the cost, then a 30-day trial with success criteria.

Rules: no hype, no adjectives, under 400 words. Lead with the risk answer rather than the benefit. Do not invent statistics — where I need a number, write [GAP].

The one line that changes response rates is the line that names why they’d say no. Something close to: “we’re doing this work in personal accounts today, which is worse for the company than the licence would be.” That reframes you as the person solving their problem rather than the person creating it.

If you need to build the numbers out properly, our walkthrough on writing a business case covers the cost-benefit section, and any manager rolling this out across a team will get more from getting a team using AI consistently than from a licence request alone.

What this method cannot protect

Every guide on shadow AI at work oversells its own advice. Here’s the honest version of what Strip-Swap-Send does not cover.

That last limit deserves its own habit. Anything factual a model hands you needs checking before it carries your name — the reasoning is in our guides to why AI invents things and fact-checking AI research. And if you’re structuring prompts well in the first place, the Role, Goal, Context, Format approach improves output quality more than any amount of sanitising will.

When it goes wrong

Four situations come up constantly in shadow AI at work, and the last one isn’t really a problem at all. None are as bad as they feel in the moment.

On that last row: the honest answer is almost always the easy one. “Yes — I drafted it with AI, and I checked the figures against the source before sending” is a far stronger position than pretending, and it’s the sentence that starts moving a team out of the shadows.

Shadow AI at work isn’t solved by hiding it more carefully. You solve it by moving the work into a lane where hiding isn’t necessary: a sanctioned tool if you have one, a sanitised input if you don’t, a licence request when the gap costs you real hours. Start this week — check your work login, switch training off anywhere you’re signed in personally, then run your next document through Strip, Swap, and Send.