Shadow AI at Work: Ban, Allow, or Sanction Employee AI Tools?

The Short Answer

You shouldn’t ban AI, and you shouldn’t ignore it either. For most small and mid-sized firms, the position you can defend is to sanction a short list of business-grade AI tools, block or restrict the rest, and control the data as well as the apps.

A ban moves the usage to personal phones and home laptops, where you can’t see it. Letting staff use anything they like puts client files into consumer accounts that your firm has no contract for, under terms the vendor can change. The middle path takes more setup work. It’s also the only one of the three that gives you visibility into what’s being used, a contract with each AI vendor, and a real answer when a client, studio, or cyber insurer asks for your AI policy.

Below we cover why this got urgent, where the data actually leaks, what California law and professional rules expect, a side-by-side comparison of the three options, and the order we use to roll out controls.

Why Shadow AI Became an Owner-Level Problem

Shadow AI means AI tools that employees use for work without IT approval: personal ChatGPT or Claude accounts, browser extensions, AI meeting notetakers, and email assistants connected to corporate mailboxes. A Hartford Business Journal report recently warned that AI tools are opening new paths for attackers as businesses adopt them. The data backs that up.

Usage is already everywhere. In Microsoft and LinkedIn’s research, 75% of knowledge workers use generative AI at work, and 78% of those users bring their own AI tools. At small and medium-sized companies, that bring-your-own share is 80%.
Much of it runs on unmanaged accounts. Verizon’s 2025 Data Breach Investigations Report found that 15% of employees routinely accessed generative AI on corporate devices, and 72% of them used non-corporate email addresses as their account identifiers. If someone leaves the firm, that account and its chat history go with them.
It’s already causing breaches. IBM’s 2025 Cost of a Data Breach research found that one in five organizations reported a breach involving shadow AI, and high levels of shadow AI added roughly $670,000 to the average breach cost.
Governance lags behind adoption. In the same study, 13% of organizations reported breaches of AI models or applications, 97% of those lacked proper AI access controls, and 63% of breached organizations had no AI governance policy or were still writing one.
US breaches cost the most. IBM put the average US breach at $10.22 million, the highest of any country studied.

AI itself isn’t the problem. The risk comes from AI nobody approved, signed in through accounts nobody manages, and connected to data nobody classified.

Where the Data Actually Goes: Four Exposure Paths

When owners picture AI risk, they usually think of an employee pasting a contract into a chatbot. That does happen, but it’s only one of four paths.

1. Consumer terms you never signed. Business tiers of the major AI tools generally keep your data out of model training by default. OpenAI, for example, states that it does not train on business data from its enterprise and API products by default. Consumer tiers work differently, and their terms change. In 2025, Anthropic updated its consumer terms so that users choose whether their chats can be used for training, with retention extended to five years for users who allow it. When an employee pastes a client’s deal memo into a personal account, the employee accepted those terms. Your firm didn’t, and your firm has no say over them.

2. OAuth grants to AI apps. This path is the one most owners miss. An employee clicks Sign in with Microsoft on an AI email assistant or meeting notetaker and approves a permission prompt. That third-party app now holds a token that can read the person’s mailbox, calendar, or OneDrive, and the token stays valid after the browser tab closes. Notetaker bots that join client calls on their own are the most common example we find.

3. Prompt injection and over-permissioned agents. The OWASP Top 10 for LLM Applications lists prompt injection, sensitive information disclosure, and excessive agency among its top risks. In practice, if an AI assistant can read incoming email and also send email, a carefully written message from an outsider can instruct it to forward data.

4. Oversharing that sanctioned tools make easy to find. This one surprises firms that thought they had done everything right. Microsoft 365 Copilot only surfaces data the user already has permission to access, so it doesn’t break your permissions. But in a lot of firms, those permissions are a mess. A SharePoint folder of HR files shared with Everyone was hard to stumble into before. Now anyone can find it by asking a plain-English question.

What California Law and Professional Rules Expect

California doesn’t have one AI-at-work statute for private employers. Several existing rules already apply, though.

Trade secrets. Under the California Uniform Trade Secrets Act, information is only a trade secret if it is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. Suppose your unreleased scripts, deal terms, or pricing models go into uncontrolled AI tools and you have no written policy against it. The other side in a dispute will argue that you didn’t make reasonable efforts. That’s the point behind recent coverage calling AI the new frontier for trade secrets.

Privacy. The California Privacy Protection Agency finalized regulations in 2025 covering automated decision-making technology, risk assessments, and cybersecurity audits. If you use AI to make significant decisions about consumers or employees, such as screening job applicants, read those rules before deploying the tool, not after.

Lawyers have explicit duties. The State Bar of California’s practical guidance on generative AI says lawyers must not input confidential client information into an AI tool that lacks adequate confidentiality and security protections, and that they should review the tool’s terms of use. The ABA’s Formal Opinion 512 goes further: before client information goes into a self-learning tool, informed client consent may be required, and boilerplate in an engagement letter isn’t enough. For entertainment-law firms holding talent contracts and details of unannounced projects, this sets the minimum.

Studio and client contracts. Many production NDAs and vendor agreements limit which third parties can process content. If your company is in a studio supply chain and has been assessed through the Trusted Partner Network, assume any AI tool that touches pre-release material falls within your content-security obligations, and confirm with the studio before you use it.

Ban vs. Allow Anything vs. Sanction and Govern

This comparison drives the decision for most firms:

Factor	Ban all AI	Allow anything	Sanction and govern
Data exposure	Moves to personal devices you can’t see	High; client data lands in consumer accounts	Contained to vendors with business terms
Visibility into usage	Very low, because users hide it	Low; no inventory	High; logs, inventory, and audit trail
Employee behavior	Workarounds and resentment	Each person sets their own rules	Clear rules and a fast way to request new tools
Productivity	Lost entirely	Gained, but uneven	Gained and shareable across teams
Answer for clients and insurers	A policy nobody follows	No credible answer	A written policy with technical enforcement
Trade secret posture	Weak if the ban isn’t enforced	Weakest	Strongest; shows reasonable efforts
Ongoing IT effort	Low on paper, high in reality	Low until an incident	Moderate and steady
Cost profile	Low direct cost, unpredictable incident risk	Scattered personal subscriptions, unpredictable risk	Predictable licensing and admin, much lower incident risk
Best fit	Rare cases where a client contract requires it	No firm that holds client data	Almost every professional-services firm

If a client contract truly forbids AI on its matters, handle that per client with labels and access controls. Don’t ban AI for the whole firm.

Decide What Data Can Go Where

A tool list alone doesn’t hold up. People need a quick rule for what they’re allowed to paste. Four tiers cover most firms:

Data tier	Examples	Personal or consumer AI	Sanctioned business AI
Public	Published marketing copy, public filings, press releases	Allowed	Allowed
Internal	Procedures, internal memos, templates without client details	Not allowed	Allowed
Confidential	Client contracts, deal terms, financials, personnel records	Not allowed	Allowed only in approved tools, with sensitivity labels applied
Restricted	Unreleased scripts or cuts, privileged strategy, SSNs, passwords and keys	Never	Case-by-case approval; credentials never

In Microsoft 365, enforce these tiers with sensitivity labels so the policy goes with the file. Purview’s Data Security Posture Management for AI can then show you which sensitive data is being used in AI interactions. Which of these features you can use depends on your Microsoft 365 licensing.

The Rollout Order That Works

The order matters. Most failed AI policies started at step five.

Find out what’s already in use. Pull web filter or DNS logs for AI domains. Use the generative AI category in Microsoft Defender for Cloud Apps discovery if you’re licensed for it. Review the enterprise applications list in Entra ID for AI apps that already have consent. Scan expense reports for AI subscriptions. Then ask staff directly and promise no penalties. You’ll learn which tools people find useful, and that tells you what to sanction.
Close the side door. Restrict user consent in Entra ID so employees can’t grant broad mailbox or file access to unverified apps (Microsoft’s user consent settings). Turn on the admin consent workflow so requests reach IT instead of hitting a dead end. Revoke grants you don’t recognize.
Choose sanctioned tools on contract terms, not features. Require no training on your data by default, controllable retention, SSO with MFA, admin audit logs, a published sub-processor list, and a data processing agreement. If you already run Microsoft 365, tools that stay inside your tenant are usually the easiest to govern.
Fix permissions before you turn on Copilot. Run an oversharing review of SharePoint, OneDrive, and Teams. Remove Everyone and organization-wide links from sensitive folders, then apply labels.
Write a short policy that people will read. Include the approved tool list, the data tiers above, a requirement that a human checks AI output before it reaches a client or court, disclosure rules, and how to request a new tool. Base it on the Govern function of the NIST AI Risk Management Framework. The NIST Generative AI Profile lists 12 risks that generative AI creates or makes worse, and it works well as a checklist.
Block or warn, and redirect. Set the web filter to show a warning on unsanctioned AI sites and link to the approved tool. Blocking with no alternative just recreates the ban problem.
Train with real examples. Show staff an actual permission prompt from an AI notetaker, and walk through a redacted example of a prompt that crossed the line. Abstract slides don’t change behavior.
Review every quarter. Vendors add agent features and connectors all the time, and the tool you approved last spring may now be able to send email on a user’s behalf.

AI Agents Raise the Stakes

A chatbot answers questions. An agent takes actions: it sends email, updates records, moves files, and books payments. Goldman Sachs’s CEO recently said that very little of the bank’s work needs frontier models. For a small firm, that means capable agent features will arrive in tools you already pay for, not only in expensive new platforms. Plan for them now.

Give each agent its own identity with the narrowest permissions it needs. Don’t let it borrow a partner’s account.
Require human approval before any action that sends data outside the firm, moves money, or deletes records. That’s the main safeguard against the excessive agency risk OWASP describes.
Keep agents away from finance by default. Wire transfers and vendor banking changes stay manual and need two people.
Log everything the agent does, and keep the logs where the agent can’t change them.

Automating real workflows with agents is worth doing. It just needs to be designed in from the start, not bolted onto a tool someone installed on their own.

Questions to Ask Your IT Provider This Quarter

Put these to your internal IT lead or your MSP. Vague answers are your signal to act.

Can you show me a list of every AI app with consent to our Microsoft 365 tenant, and who approved each one?
Can our users currently grant third-party apps access to their mailbox without IT review?
Which AI tools are our people actually using, based on logs and not on guesses?
Have we fixed SharePoint and OneDrive oversharing, and can you show me the report?
Do our sensitivity labels and DLP policies cover AI interactions?
If an insurer or a studio asked for our AI policy tomorrow, what would we send them?
Who reviews new agent features in the tools we already license?

Firms that get this right don’t spend less time thinking about AI. They spend it on choosing which workflows to automate, not on cleaning up after tools nobody approved.

We Solve Problems runs both sides of this for Los Angeles firms and clients across the US: managed IT that locks down Microsoft 365, consent, and data protection, and AI operations that find the manual workflows worth automating and build them safely. We work closely with entertainment-law and professional-services firms, where client confidentiality isn’t optional. If you aren’t sure what AI is running in your business right now, request a consultation and we’ll help you find out.