An employee has a deadline and a long set of handover notes. The company has an AI policy, but the employee cannot tell whether it covers the task in front of them. Their familiar personal chatbot seems an obvious way to produce a summary.
The decision takes a moment. Understanding its consequences may take much longer.
Shadow AI at work describes AI use outside an organisation's approved systems or approach. It creates a visibility problem: leaders may not know which information, tools and decisions they need to assess. It can also reveal a gap between the work people need to complete and the support their employer provides.
The appropriate response combines clear boundaries, usable alternatives and a way for employees to raise questions. It also distinguishes an unapproved action from a confirmed security incident. Neither automatic reassurance nor an assumption of wrongdoing provides enough information.
Start by separating the situations
An employer may prohibit a particular service. It may permit that service for specified tasks but exclude certain information. It may have no clear position, or employees may simply not know what has been decided.
These circumstances are not interchangeable.
Likewise, an employee paying for a tool does not establish whether its workplace use is authorised. An employer paying for a tool does not establish that every possible use is appropriate. Permission needs to make sense in relation to the account, task, information and intended action.
The UK's National Cyber Security Centre defines shadow AI in terms of use outside approved systems and processes. Its 7 September 2026 guidance highlights risks including exposure of sensitive information and reduced visibility and control over data. It also recommends understanding employees' needs and supporting open communication. This is security guidance, not a study proving the effectiveness of a particular workplace programme.
For managers, the immediate question is therefore more precise than “Are people using ChatGPT?” It is: Which uses are taking place, under what arrangements, and what remains unknown?
What the survey headlines can—and cannot—tell you
A PagerDuty survey release published on 11 June 2026 describes respondents using AI tools they believed were not permitted by company policy. It covered 1,250 office professionals in Australia, Japan, the UK and the US, at organisations with annual revenues of at least $500 million.
That is a particular population, not every employee or business. The findings report people's accounts and their understanding of permission; they do not independently verify each organisation's rules or establish that each use caused a breach. The vendor release is useful evidence of a reported approval gap, with those limits.
Avoid combining figures from surveys that ask different questions. Employer knowledge, formal permission, personal payment and use of public tools measure different things. None is a reliable substitute for understanding the actual situation in your organisation.
A survey can make a leadership conversation more urgent. It cannot tell a manager whether the colleague across the desk has disclosed confidential information.
Follow the task before judging the workaround
Consider a fictional client-services team preparing a handover between account managers. One employee wants help turning extensive notes into a concise briefing.
Several needs could sit behind that request. The notes may be poorly organised. The employee may be uncertain about the required format. There may be too little time to review them properly. Or the available approved assistant may not support the intended task.
Those are different problems, even if each leads to the same proposed workaround.
Ask the employee to explain what they were trying to achieve without asking them to repeat sensitive material in another system. What inputs did the task require? What output was needed? Which part was difficult? Had they sought an approved route?
Understanding the need does not retroactively authorise the action. It helps the organisation choose an appropriate response rather than issue a generic reminder that leaves the original difficulty untouched.
In the fictional example, a clearer handover template might reduce the burden without AI. A suitable approved tool might help with part of the work. A lack of access might require a service decision. The answer should follow the actual obstacle.
Make the first disclosure useful
Suppose the employee tells their manager that they have already used a personal AI account for the handover. The manager needs to establish what happened while giving accurate information about the next steps.
Start with the facts: the service and account involved, the type of information submitted, any connected access, and what was subsequently done with the output. Use the organisation's designated reporting route when information or access may have been exposed.
Avoid asking colleagues to circulate the same material widely to explain the issue. Avoid assuming that removing a local copy or recalling a message reverses what happened elsewhere. The relevant specialists need to assess the circumstances.
At the same time, do not promise immunity from consequences that the manager has no authority to grant. Explain who will review the situation, what can be clarified now and what remains uncertain.
Australia's National AI Centre guidance on unapproved AI use connects openness with clear expectations, suitable alternatives and training. It is practical guidance, not a guarantee that disclosure will be consequence-free or that training alone resolves the risk.
An organisation needs both an accurate account of the event and a fair, established process for responding to it. Treating every question as a confession can make it harder to obtain the first.
Translate permission into an ordinary work decision
A list of approved products is a starting point. Employees also need to know what approval means for a task.
For the fictional handover, the organisation might need to clarify whether a specified account can be used, what information is suitable, whether additional permission is required and who remains responsible for checking the briefing. Those answers depend on the organisation's assessment, not this article.
Useful guidance lets a colleague answer four practical questions:
- May I use this account for this task?
- What information or access is permitted?
- What must I check before relying on the result?
- Where do I go when the case does not fit?
Test the wording against realistic examples. If experienced colleagues interpret the same instruction differently, the guidance may need revision. That is especially important when a broad phrase such as “do not share sensitive information” requires judgment that employees have not been helped to develop.
Permission should also have a maintenance owner. When services, settings or work practices change, staff need a dependable way to find the current position.
This is an editorial discussion aid. It is not a universal policy, a compliance assessment or a substitute for technical controls.
Provide an alternative that survives the deadline
An approved route is unlikely to feel workable if employees cannot obtain access, cannot use the relevant material or cannot get an answer when the task is urgent.
Investigate those constraints directly. Can someone complete the handover through the permitted process within the available time? Which steps add value, and which simply move the work elsewhere? Does the alternative require expertise that the user does not yet have?
Sometimes the answer involves better access or a different tool. Sometimes it involves changing the task, extending a deadline or improving the source material. “Use the approved option” is incomplete when nobody has checked whether the option supports the work.
This does not mean every request for a preferred application should be granted. A business can decline a use while explaining its reasoning and offering an appropriate route to complete the underlying task.
Keep the distinction visible: employees can contribute evidence about their work; the people with the relevant authority decide what the organisation can support.
Practise the uncertain case, not just the ideal one
A short learning activity can reveal misunderstandings before they become routine habits.
Give colleagues a fictional handover scenario with an approved tool, several categories of information and an ambiguous instruction. Ask what they would submit, what they would withhold and whom they would consult. Use synthetic material, not genuine client records.
Then change one condition. The approved account is unavailable. A note contains information outside the agreed scope. The generated summary omits an important qualification. What happens next?
The value lies in the reasoning people explain. Repeating the tool's name or reciting a policy sentence may conceal a different interpretation of the task.
The human learning advantage is relevant here: responsible use depends on people's ability to notice uncertainty, ask for help and revise an approach. Familiarity with a chatbot interface does not settle those decisions.
The exercise above is a proposed activity, not an intervention evaluated by the sources cited. Learning also needs support from clear processes and appropriately configured systems.
Look for improvement without confusing silence with safety
Fewer reports of unapproved use could reflect less use, less willingness to disclose or a different understanding of the question. Treat the count as a signal requiring interpretation.
A more useful review examines several kinds of evidence. Are employees able to identify the permitted route? Are requests receiving a timely answer? Do the same workarounds keep returning? Are reported concerns assessed and resolved? Can managers explain what changed after feedback?
Use appropriate technical and organisational evidence alongside employee accounts. Any monitoring requires its own assessment and communication; this article does not prescribe a surveillance system.
For the fictional client-services team, improvement might mean that employees can complete a handover through a supported route and know how to handle an exception. It would not mean declaring every AI-generated briefing safe because staff attended a session.
Leaders should also examine their own behaviour. Informal encouragement to use any available tool can undermine a formal policy. A request to work faster should not leave employees guessing which boundaries still apply.
A better conversation for a corporate AI event
Shadow AI is a useful topic for a leadership or workplace learning event when it connects security concerns with real work.
An opening keynote can challenge assumptions about adoption, human judgment and organisational learning. A facilitated discussion can then examine a fictional task with contributions from operations, HR, IT and the people doing the work.
Avoid making employees publicly disclose incidents or account details in a conference room. Offer the established confidential route for genuine concerns and keep the group activity focused on approved fictional material.
Our guide to designing a corporate AI learning summit explains how an event can connect perspective, practice and follow-through. A keynote can open the discussion; it cannot approve a tool, investigate an incident or establish technical assurance.
Bring the hidden decision into view
Sources were checked on 28 October 2026. They combine selected official guidance and a vendor survey of a defined population, rather than a systematic review or causal evaluation. The handover example is fictional. No particular platform's privacy settings, contractual protections or security capabilities are assessed here.
The Learning Coach perspective is to make responsible action understandable in the moment when a person needs to choose. That means learning about the work as well as explaining the rules.
Before asking only why someone used an unapproved tool, ask: Did we give them a clear boundary, a workable way to complete the task and a credible route for the uncertainty?
Bring that question to your next corporate AI event. Explore Learning Coach's international keynotes and request a tailored proposal.
References
- NCSC, Simon B. The hidden risks of shadow AI, 7 September 2026. Official security guidance; not an empirical programme evaluation.
- Australian National AI Centre. Manage unapproved AI use. Practical guidance, accessed 28 October 2026.
- PagerDuty. Shadow AI workplace survey release, 11 June 2026. Primary vendor report describing a survey of office professionals at large organisations; interpret self-reports within that scope.
