Is Shadow AI a threat to your organisation?  

AI is successfully being used to bring efficiencies across the industry.  Whether that’s supporting route planning, predictive maintenance or driver behaviour analysis:  AI can support organisations in reducing costs and CO2, whilst helping to identify productivity gains.  

While its adoption is encouraging, organisations need to be mindful of the risk of potentially sleepwalking into the problem of shadow AI. 

The perils of unapproved Shadow AI 

Put simply shadow AI is the unauthorised use of AI in an organisation. This occurs when colleagues use free or low-subscription AI engines, like ChatGPT or Google Gemini, without the explicit approval, knowledge, or oversight of IT. 

Even with good intent, using these tools without understanding how your data is handled, processed, and stored creates significant privacy and security risks. This is why information security and the application of AI must be a board-level agenda item. 

Examples of data that should never be shared on unauthorised AI tools include: 

• Staff or customer data violating GDPR. 

• Financial data (P&L, budgets). 

• Legal contracts and agreements. 

• Strategic Business Plans (e.g. acquisition plans). 

Just as you wouldn’t share this information without proper safeguards in place, why would you upload it to external 3rd party AI agents without having considered the security implications. 

A survey commissioned by OneAdvanced showed that 64% of UK workers are using AI without restriction, 26% of businesses have no way of tracking AI use, and 28% of teams are using AI independently without a company-wide plan. 

Five steps to ensure AI compliance 

Embracing AI's potential is essential for growth. However, a planned and strategic approach is crucial to avoid the problems of shadow AI. 

1. Establish a clear strategy and usage policy: Develop a company-wide strategy and policy to guide the responsible use of AI, complementing existing data protection policies. 

2. Prioritise data quality, accessibility and management: AI systems are only as good as the data they receive. Centralise relevant business data into a "regimented system" to ensure it is accurate, consistent, and accessible with proper permissions. 

3. Use secure and authorised AI platforms: Choose AI solutions built with data privacy at their core, where your data is not used to train models and is processed within secure, approved environments. 

4. Invest in AI training for employees: Train staff to view AI as a complementary tool, understanding its capabilities and how to use it compliantly.  

5. Start small and collaborate: Begin with small-scale adoption and collaborate with experts to ensure data is managed correctly from the start. Don't be afraid to seek external support in devising your AI strategy. 

By helping companies with an integrated AI strategy and a clear governance framework, organisations can avoid the pitfalls of shadow AI and embrace the opportunities ahead. 

For more information and support with you AI strategy click here.  

About OneAdvanced 

OneAdvanced are a leading provider of AI and sector-focussed software solutions.  With over 30 years of experience, they work across some of the most important sectors in society, including local government, education and the NHS.  They also serve critical national infrastructure, the end-to end supply chain and some of the UKs most well-known and respect brands.