A practical guide / Hotel finance controls
Shadow AI in hotel finance teams: what should a CFO do?
Give the finance team an approved way to use AI for month-end commentary, forecast work and spreadsheet support. Find the jobs people already use it for, agree the data allowed in each job and retain a clear trail from the source extract to the approved pack.
Shadow AI means AI use outside your agreed tools or process. For a hotel CFO, start with the close calendar. Trace where guest records, payroll files and forecasts leave the finance system, then bring useful tasks into a controlled routine the team can follow.
Create a finance task cardGive each finance task an approved route through the close.
Walk through one recent month-end pack
Ask the finance lead to show how last month’s pack was made. Follow rooms revenue, agency wages and one cost line from the export to the final text. Note each file, tool and account used. Ask who made each change and where they saved it.
More on this step
Ask where AI helped with a formula, a board paragraph or a messy extract. Keep the discussion tied to getting the pack done. Invite staff to show an output they found useful. Use that to design a method the whole team can share.
Make an inventory with task, input, account, output and next close date. Group the tasks by the data they use. Monthly department totals can give you a useful first task to approve. A payroll file needs its own data review.
Publish a finance task register
Give each approved task a short task card. List its aim, allowed fields, business workspace, source folder and saved output. Name who signs it off. Add a prompt and a completed draft so a colleague can cover the task during leave.
More on this step
For budget comments, use agreed actuals, the budget and managers’ notes. Start payroll work with department totals and cost groups. For guest revenue, use dates, segments and values where those answer the question. Choose fields that serve the job.
The ICO’s AI guidance covers security and the duty to use only the personal data you need. Write down why a task needs each field and who can see the files. Keep that note with the task card.
Read the source: ICO: AI and data protection
Keep the close trail beside the output
Save the source extract, mapping version, prompt and final text in the close folder. Record which figures came from the ledger and which reasons came from hotel managers. A reader should be able to trace a wage cost comment back to the agreed figures.
More on this step
Choose business accounts with terms your firm has reviewed. Microsoft describes data protection and audit support for work Copilot use. The controls depend on the plan. OpenAI sets out business data terms for ChatGPT Business and Enterprise. Name the product and workspace on the task card.
Agree with IT how long to keep chats and close records. Decide where the useful working record will live. A colleague should still be able to follow the close file when its author changes roles or leaves the hotel.
Read the source: Microsoft Learn: enterprise data protection; OpenAI: enterprise privacy commitments
Worked example
Replace a private commentary habit with a shared method
Example with made-up details: the finance lead at Moorbank Hotel uses a personal AI account to draft rooms commentary. The CFO helps her recreate the task in the approved business workspace using department totals and a manager’s note about a cancelled conference.
The new close record links the £18,000 rooms shortfall to the signed-off revenue schedule. It stores the conference note apart from the figures and records the finance lead’s final explanation. The same method is assigned to the deputy finance lead for holiday cover.
The CFO now has a useful task to approve and teach. The next step is to apply the same record to the agency wage commentary before the following close.
Illustrative example.
Inventory
Follow AI use through one monthly pack.
Approve
Define the input and business workspace.
Retain
Save the source and final explanation.
Handle past uploads through the existing incident route
If the inventory shows guest or payroll data sent to an unapproved service, use your incident process. Give privacy and security staff the file name, date, account and known access. They can assess what happened and decide the next steps.
Agree the supplier’s data terms and allowed inputs before using live records. The ICO explains the contract needed when a processor handles personal data for a controller. The CFO signs off the pack and owns the finance judgements it contains.
Read the source: ICO: contracts between controllers and processors
Try a practical task
Write a month-end AI task card
Use this brief to turn one successful finance task into a repeat close step.
Try this in your AI app
ChatGPT
Claude
Gemini
CodexUsing Gemini? The button copies the prompt. Paste it into the new chat.
Create an operating card for our [rooms revenue / payroll cost / cash forecast] task. The close timetable is [dates]. Inputs are [approved fields and file locations]. The business AI account is [workspace]. Final output goes to [close folder].
Describe how to export the input file, supply the budget and manager’s notes, and save the resulting draft. Set out the source references needed for each financial explanation. Include the pack approver and the cover arrangement.
Use these storage period and data rules [rules]. End with the exact records a colleague needs to rerun the task next month and a short demo plan for the finance meeting.
Questions about this task
Where should the CFO begin?
Choose one commentary task in the next close. Approve its input fields, workspace and saved records, then show it using a previous month’s pack.
Should every forecast have a saved AI conversation?
Define the evidence your forecast process needs. Keep source versions, working estimates and sign-off with the forecast. Retain the right AI working record under the policy agreed with IT.