Shadow AI at Work: What Your Team Is Already Using, and a One-Page AI Policy

Ask an office manager which AI tools the company uses and you hear “none, officially.” Both halves are usually true.

What Shadow AI Is, and Why It Matters

The three behave differently. A chat account belongs to a person, so there is no admin view and no contract. An extension sits in the browser session and sees pages after sign-in. A note-taker leaves a transcript you do not control. Most policies cover the first and ignore the rest. Why that matters:

• The data stops being yours. What you cannot administer, you cannot label, log, hold or delete.
• The terms change with the tier. Microsoft states that for Microsoft Copilot and Copilot Chat, prompts, responses and Microsoft Graph data are not used to train foundation models. Consumer sign-ups sit under different agreements.
• Confidentiality does not pause. Health information in a tool with no business associate agreement is a real exposure, and client questionnaires now ask about AI. The voluntary NIST AI Risk Management Framework puts exactly this — legal requirements, accountability, third-party software risks — in its GOVERN function.

The Surface Nobody Governs: AI Note-Takers

A recording is a record: discoverable, subject to retention, easily forwarded. Invite the bot from a personal account and the transcript lives there, still there after the person leaves. In Microsoft Teams, recording and transcription are set by meeting policies, and Microsoft documents an -ExplicitRecordingConsent setting requiring participants to consent before being recorded or transcribed. Recording-consent law differs by state — your attorney’s question, not your IT provider’s.

Three rules cover most offices: the host announces that notes are being taken, one approved note-taker runs under company sign-in, and no bot joins a client meeting without the client agreeing. Extensions are the same problem — in Microsoft Edge, ExtensionInstallAllowlist and ExtensionInstallBlocklist set what staff can install, via Intune.

How to Find What Is in Use, Without a Witch Hunt

• Ask, and mean it. No reports means no visibility, not no usage. A three-question anonymous survey gets a real inventory; a policy memo first gets silence.
• Review what is connected. Entra ID’s enterprise applications area shows permissions granted by user or admin consent, and lets an admin revoke them.
• Read the sign-in logs. Entra logs cover interactive, non-interactive, service principal and managed identity sign-ins, plus a newer agent activity log.
• Use discovery if licensed. Microsoft states the Defender for Cloud Apps catalog lists over 31,000 discoverable cloud apps scored against 90-plus risk factors, with a generative AI category, and that discovery analyzes traffic logs for shadow IT visibility.

A One-Page AI Policy People Will Actually Read

A policy nobody finishes is worse than none. One page, seven lines.

1. The approved list. Tools allowed for company data — about three. Short lists get followed.
2. The account rule. Company data goes into company accounts.
3. The off-limits list. Client records, payroll, anything about one person’s job.
4. Human review. Which output a person reads before it leaves.
5. Who approves, and how fast. A named person and a turnaround time.
6. Exceptions expire. Each needs an owner and end date.
7. Train first, sign second. An acknowledgement without training is paperwork.

The long version — classification, enforcement, review cadence — is our AI governance and AI use policy service.

Guardrails You May Already Own

• An approved tool on a commercial tier. Enterprise data protection, in Microsoft’s wording, means your access controls apply, Copilot inherits your labels and retention, and interactions can be audited. Admins also control which agents are allowed, so the approved list can be enforced rather than published. Copilot rollout starts as permissions clean-up.
• Sensitivity labels. Purview stores the label in metadata, so it travels with the content wherever it is saved. Microsoft’s guidance: effectiveness drops above about five labels.
• Endpoint data loss prevention. Windows devices onboarded to Purview can be set so endpoint DLP warns or blocks staff pasting sensitive information into third-party generative AI sites in a browser.
• User consent settings. Entra ID decides whether staff can grant an app access alone. Microsoft recommends user consent only for verified-publisher apps, with the admin consent workflow routing requests to an admin.

Most of this sits in Microsoft 365 plans you already buy, beside your security controls. For the mailbox side, read should you connect AI to your email.

Vendor Questions to Ask Every Time

• Business plan, or a personal sign-up?
• A data processing agreement, and no training on our data, in writing?
• How long are prompts, files and transcripts kept, and who sees them?
• Company sign-in, and can an admin revoke the connection?
• What happens to our data when we leave? Regulated work adds the business associate agreement — see HIPAA compliance.

Common Mistakes

Where TVG Consulting Fits

We run managed IT from Burbank and greater Los Angeles, and Nashville and Franklin. A Burbank post house with unreleased creative in a chat window and a Franklin clinic with a note-taker in a patient call ask the same question.

This is vCIO work, not a ticket: find what is in use, pick the approved tool, write the page, switch on controls you already pay for, review on a cadence. The easiest place to start is a free Shadow AI Audit call. Urgent issues get immediate engagement.

Frequently Asked Questions

What is shadow AI?

Any AI tool used for work that nobody approved: a personal chat account, a browser extension, an AI note-taker in meetings.

How do I find out which AI tools my team is using?

A no-blame anonymous survey, then enterprise applications and sign-in logs in Microsoft Entra ID. If licensed, Defender for Cloud Apps discovery analyzes traffic logs against a catalog of over 31,000 cloud apps.

Are AI meeting note-takers a problem?

A records and consent question. The transcript belongs to whichever account invited the bot, recording-consent law varies by state, and Teams policies can require participant consent before recording.

Is Microsoft Copilot safer than a free AI tool?

Easier to govern. Microsoft states that for Copilot and Copilot Chat, prompts, responses and Microsoft Graph data are not used to train foundation models. It does not fix permissions.

Can we stop staff connecting AI apps to company data themselves?

Yes. Microsoft Entra ID user consent settings control whether an employee can grant access alone; the admin consent workflow routes the request to an admin.