Shadow AI Is the New Shadow IT – And Boards Are Already Behind. Here’s What You Need to Know to Protect Your Data

You type a quick prompt into ChatGPT, maybe asking it to summarize a quarterly report you’ve been working on. Or you drop a spreadsheet into Copilot to help spot trends. It feels harmless – just saving time. But what you may not realize is that you’ve just shared potentially sensitive company information with an external service that has no obligation to keep it confidential.

This is “shadow AI” – the use of artificial intelligence tools without official approval from your IT or security team. It’s the modern version of shadow IT, and according to a recent article in CX Today, many organisations are already behind in addressing the risks. Boards are only now waking up to the scale of the problem, while employees in nearly every department have already adopted these tools on their own.

What Happened

Shadow AI isn’t a hypothetical future threat. It’s happening right now in offices, home workspaces, and even on personal devices used for work. The CX Today piece – published in May 2026 – highlights how this trend has caught many senior leaders off guard. Employees turn to tools like ChatGPT, Microsoft Copilot, or Google Gemini because they’re free, easy to use, and genuinely helpful. But most users don’t stop to ask whether their company has a policy around them, or whether the data they paste is protected.

According to Gartner, by 2026, 40 percent of organizations will have experienced a shadow AI-related security incident. That prediction is already proving accurate. The problem is not the technology itself – it’s the fact that consumer-grade versions of these AI tools often train on user inputs. That means your confidential contract terms, customer lists, or strategic plans could end up reused in responses to someone else’s queries.

Why It Matters

If you’re an everyday professional using AI at work, the immediate risk is to your own job and reputation. A single data leak – intentional or not – can lead to disciplinary action, client lawsuits, or compliance violations under regulations like GDPR or HIPAA. But the broader risk is to your employer’s security posture. Boards are required to oversee risk management, and shadow AI creates blind spots that are difficult to audit.

Even when you trust a platform, there’s nuance. Enterprise versions of tools like ChatGPT (“ChatGPT Enterprise” or “Copilot for Microsoft 365”) include data protection agreements that prevent your inputs from being used for training. Free versions generally do not. Most employees don’t know the difference, and many companies haven’t communicated it clearly.

The result: sensitive information flows out of the organisation without anyone tracking it. And boards, as the CX Today article notes, are only now beginning to realise how far behind they are.

What Readers Can Do

You don’t need to stop using AI entirely. But you do need to be deliberate. Here are concrete steps you can take today.

First, find out your company’s policy. Check your employee handbook or ask your manager if there is an approved list of AI tools. Many organisations now have a policy – even if it’s just “don’t use free versions for anything confidential.” If there is no policy, that’s a sign the company is behind, and raising the question constructively can help.

Second, use enterprise-approved tools when possible. If your employer provides a paid version of ChatGPT, Copilot, or another service, use that one. The license likely includes contractual protections for your data. The free version does not.

Third, sanitise your inputs. When you must use a consumer tool – maybe you’re doing a quick draft or brainstorming – redact or replace any personally identifiable information, customer names, financial figures, or internal project names. Ask yourself: if this prompt appeared on a public forum next week, would I be comfortable?

Fourth, avoid logging into personal AI accounts on work devices. Mixing personal AI use with work data increases the chance of accidental exposure.

Fifth, if you suspect shadow AI is widespread in your team, raise it without blame. Say something like: “I noticed people are using AI tools to speed up work – should we agree on which ones are safe to use with our data?” This invites a conversation rather than pointing fingers.

None of this is about slowing down productivity. It’s about making sure you keep your data and your job safe while you work faster.

Sources

  • CX Today, “Shadow AI Is the New Shadow IT – And Boards Are Already Behind,” May 6, 2026. [Link to article]