All guides / Team rules
How do we handle shadow AI (staff using unapproved AI tools)?
Ask staff how they are using AI and what they need help with. Find out which tools they use, which jobs they do and what they share. Then give them a clear route to an approved tool or a person who can help.
“Shadow AI” means staff using AI tools the business has not approved. Start with a calm chat about the work. The aim is to understand what is happening and make the next step clear.
Try the promptAsk the team. Give them a route. Review what works.
Ask about the work first
Talk to the people doing the job. What takes too long? What do they copy, rewrite or put off? Ask which tools they have tried and whether they used a work or personal account.
More on this step
Let staff say “I’m not sure” when they do not know a setting. Keep unknowns on your list. Ask about the type of data shared, without copying the data into a new file. Pick someone to collect questions and follow them up with the right team.
Make the next step easy
Give staff a route for asking to use a tool. Ask for the job, the hoped-for result and an invented sample. Agree who will review it and when staff should expect an answer.
More on this step
The ICO’s guidance covers personal data used with AI. Ask your data lead to check proposed uses of real records. Meanwhile, set a clear rule for uploads to unapproved tools. Tell staff who to contact if they have already shared something private.
Read the source: ICO: AI and data protection guidance
Try the rules on real types of work
Use made-up examples to test your guidance. Try a public product sheet, a client complaint and a staff absence note. Ask staff which route they would follow and why.
More on this step
Review the exact account and features, including connected apps. Microsoft notes that third-party agents can have their own terms. Do not assume one approval covers each new feature. Write down the scope of your decision and when the team should ask again.
Read the source: Microsoft: Copilot and third-party agents
Not sure where to start?
Find out what your team needs
Try this interview to prepare for staff conversations. Describe types of work. Keep names and private details out of your answers.
Try this in your AI app
ChatGPT
Claude
Gemini
CodexUsing Gemini? The button copies the prompt. Paste it into the new chat.
Help me understand why staff in my business may use AI tools we have not approved.
Ask one question, wait for my reply and build on it. Explore the tasks that take too much time, where staff need help and what our current rules allow.
Ask what we know about tools, accounts and types of data shared. Mark what is unknown. Do not treat a lack of reports as proof that no one uses AI.
Find out how staff can ask for a tool and how long a decision takes. Ask who reviews data handling and who staff should tell about a wrong upload.
Repeat the main needs back to me. Then help me write a short plan for talking with staff, testing made-up examples and choosing an approval route.
Give me a table of tasks, current gaps, owners and next steps. Keep the tone calm. Do not invent staff behaviour or promise that a written policy will solve the problem.
Watch Warren's story
Warren learnt to use AI for his role
Warren started with ChatGPT and no clear way to apply it to hotel work. We coached him in Leader Lab and set up a Claude Project around his role and standards. He now uses ChatGPT and Claude with more confidence and has built a reporting dashboard.
Read the source: Warren’s Leader Lab story
Testimonial · 0:24
"I’ve learned more than I have playing around with it in the last couple of months."
Warren Lavender · Luxury hospitality
Worked example
Ask architects and surveyors about the task
An architect finds that staff use a personal chatbot to tidy project notes. She asks which part takes time. They say they struggle to turn meeting notes into a clear list of open points. They try an approved route with invented notes and a named checker.
A surveying firm asks staff about the tools they use for visit summaries. The team tests a draft with made-up site details. Real photos and client files stay outside that trial. A surveyor checks the meaning of each note. Staff also get a clear contact for questions about past uploads or a new tool.
Made-up example.
Staff’s task
Ask how project or visit notes are used.
Approved test
Use made-up notes and an agreed account.
Named reviewer
Check the draft and handle tool requests.
A few more things to know
Deal with past uploads properly
If private data may have been shared, gather enough facts for the person responsible to assess it. Note the tool, account, time and type of file. Avoid spreading the same material through more chats.
Ask your data lead what must be checked and which steps to take. A closed browser window is not proof of deletion. Keep the staff member involved so they know what to do next. Change unclear instructions once the facts are known.
Check whether the route works
Review the requests staff make. Note which ones get a clear answer, which wait too long and which need better examples. Ask whether the agreed tool helps people finish the job.
Keep room for a different answer. A shorter form, a better template or a shared checklist may solve the need. Give staff a way to raise that too. Revisit the rules when work changes or a tool adds features. Name the person who will keep the guidance up to date.
Should we ban every AI tool?
Choose a rule that fits your work and data. A clear boundary needs a usable way to ask for help. Talk to staff about the tasks behind their use before choosing the next step.
How will we know our plan is helping?
Check whether staff know the route, can get an answer and can finish the task within the agreed rules. Track open requests and mistakes, then fix the parts that cause confusion.