Free guide · Hands-on AI training for teams, live online or in person in NYC and Philadelphia
What is shadow AI at work?
Shadow AI is your team using AI tools the company never approved: personal ChatGPT or Claude accounts, browser extensions, AI note-takers. At a small business it is rarely sneaky. Nobody set the rules.
78% of AI users bring their own AI tools to work.
What it looks like in a small office
- Personal accounts for workFree or personal-plan chat accounts the company cannot see, manage, or shut off when someone leaves.
- Extensions and note-takersBrowser add-ons that read the page and AI bots that join calls, installed by one person and never checked.
- Client data pasted inNames, emails, contracts, or numbers dropped into a chat window to save five minutes.
- Output nobody checkedA confident answer with a wrong number or date, sent under your name.
Why it matters
- $670K more per breach at companies with heavy unapproved AI use.
- 97% of companies hit by an AI-related breach had no proper AI access controls.
- 48% of privacy and security pros admit entering non-public company info into AI tools.
$670K and 97%: IBM Cost of a Data Breach Report 2025 (Ponemon, 600 organizations)
48%: Cisco 2024 Data Privacy Benchmark Study
Five steps to get it under control
- Ask, don't audit. A no-blame list of the AI tools people already use, and for what.
- Pick the approved tool and plan. Company accounts, paid for by the company.
- Write one page of rules. What never goes in, what is fine, who to ask. Free template.
- Fix the settings. Training off where the tool allows it, no public share links, remove extensions nobody approved.
- Train on real work. If the approved way is also the faster way, people use it.
Banning AI with no approved option tends to push it out of sight. Most small teams do better with one approved tool and written rules.
Common questions
What is shadow AI?
Shadow AI is staff using AI tools for work that the company has not approved or set up: personal ChatGPT or Claude accounts, free browser extensions, AI note-takers, and other apps nobody checked. At a small business it is usually not sneaky. People are trying to get work done, and nobody has written down the rules.
Is shadow AI a problem for small businesses?
It can be. Client, patient, or employee details can end up in personal accounts the owner cannot see or shut off, and AI output can go out to clients without anyone checking it. In IBM's 2025 Cost of a Data Breach Report, companies with heavy unapproved AI use paid $670K more per breach on average.
How do I stop shadow AI without banning AI?
Pick one approved tool and plan on company accounts, write a one-page policy that says what data never goes in, turn on the safer settings, and train people on real work so the approved way is also the easier way. A ban with no approved option tends to push AI use out of sight.
Does Ninety Minute AI help with shadow AI?
Yes. In two hands-on 90-minute sessions for up to 8 people we set clear data rules with your team, practice on real tasks with the tools you approve, and leave a follow-up sheet of saved prompts and workflows. Sessions run live online, or in person in NYC, Philadelphia, and nearby Pennsylvania. It is practical training, not legal or compliance advice.
Practical guidance, not legal or compliance advice. Related: Is ChatGPT safe for company data? · AI policy for small business · Security & usage
Get your team on the same page.
20-minute call. Tell me your team size and one task you want off your plate.