Shadow AI at Work: Should Your Business Ban, Tolerate, or Sanction It?

The Short Answer

Sanction it. Pick a small set of business-grade AI tools, write down what data may go into them, turn on the controls that enforce those rules, and block the rest. Banning AI outright almost never works because the tools are a browser tab away, and simply tolerating it leaves client and company data in systems you have no contract with.

The rest of this post explains why sanctioning wins, what it actually involves, and where California law and LA industries such as entertainment and legal services make the details matter more than usual.

Your Staff Are Already Using AI. You Just Didn’t Pick the Tools

Most owners treat AI as a future decision. For their staff it is already a habit. Microsoft and LinkedIn’s 2024 Work Trend Index found that 75% of knowledge workers use generative AI at work, and 78% of those users bring their own AI tools rather than waiting for their employer to provide them. The same research found that many users are reluctant to admit they rely on AI for their most important tasks, which means managers often have no idea it is happening.

That gap now shows up in breach data. IBM’s Cost of a Data Breach Report 2025 found that one in five organizations studied reported a breach involving shadow AI, and that high levels of shadow AI added roughly $670,000 to the average breach cost. The same report found that 63% of breached organizations either had no AI governance policy or were still writing one, and 97% of organizations that reported an AI-related security incident lacked proper AI access controls.

The pattern is consistent with what attackers have exploited for years. Verizon’s 2025 Data Breach Investigations Report attributes around 60% of breaches to a human element such as error, misuse or social engineering. Pasting a client contract into a free chatbot is the same kind of well-meant human error, only faster and harder to see.

Ban, Tolerate, or Sanction: How the Options Compare

Every business ends up in one of three positions, whether it chose one or not.

Factor	Ban AI tools	Tolerate (no policy)	Sanction approved tools
What employees actually do	Use personal accounts on personal phones, out of sight	Use whatever free tool they found first	Use the company’s approved tools under company accounts
Who holds the data	Unknown consumer services	Unknown consumer services	Vendors under a business contract you reviewed
Model training on your data	Often on by default in consumer tiers	Often on by default in consumer tiers	Off by contract in most business tiers
Visibility for IT	None	None	Audit logs, usage reports, DLP alerts
Offboarding	Chat history leaves with the employee	Chat history leaves with the employee	Account disabled, data retained by the company
Productivity	Lost, or hidden	Uneven and unmanaged	Measurable and improvable
Answer for a client or insurer asking about AI	”We prohibit it,” which is hard to prove	No good answer	A written policy plus the controls that enforce it
Cost profile	Low on paper, unpredictable when something leaks	Low on paper, unpredictable when something leaks	Higher and predictable licensing, lower incident exposure

Banning looks safe, but the evidence above says people use AI regardless, so a ban mostly moves the activity onto devices you cannot monitor. Tolerating gives you the same exposure with less paperwork. Sanctioning is the only position where the company holds the contract, the logs and the off switch.

The Real Difference Between Consumer and Business AI Is the Contract

The chatbot interface looks the same in the free and business versions. The terms underneath it do not.

Training. OpenAI states in its enterprise privacy commitments that it does not train its models on business data from ChatGPT Enterprise, Team or the API by default. Microsoft’s documentation on enterprise data protection in Microsoft 365 Copilot says prompts and responses are not used to train the underlying foundation models. Consumer tiers of many tools have historically trained on user content unless the user opted out.
Retention and ownership. Business tiers let an administrator set retention, run eDiscovery and keep the data when an employee leaves. A personal account belongs to the person.
Identity. Business tools sign in through your Microsoft 365 or Google Workspace identity, so your multi-factor and conditional access rules apply to them as well.

Terms also change. Recent coverage of Meta revising the wording of its business terms after publisher pushback over AI training is a reminder that a vendor’s position on your data is set by a document it can update. Whoever owns AI governance at your company should reread the data-use terms of each approved tool at least once a year and whenever the vendor announces a change.

California and LA Industries Raise the Stakes

Southern California businesses carry obligations that a generic AI policy template will miss.

State privacy rules now reach automated decisions. The California Privacy Protection Agency has finalized regulations under the CCPA covering automated decisionmaking technology, risk assessments and cybersecurity audits, with requirements phasing in over the next several years. If you meet the CCPA’s thresholds and use AI to help make significant decisions about people, such as hiring, screening or eligibility, you need to know which tool does it, what data it uses and what notice you give. A shadow tool that a recruiter picked on their own makes those questions impossible to answer.

Law firms have explicit ethics guidance. The State Bar of California’s Practical Guidance for the Use of Generative AI in the Practice of Law tells lawyers not to put confidential client information into any generative AI tool whose terms or security they have not vetted, and to supervise how staff use these tools. For a firm, an unvetted chatbot holding client facts is a confidentiality problem as well as a security one.

Entertainment work runs on NDAs. Unreleased scripts, cut lists, deal memos and talent contracts are normally covered by confidentiality clauses that say nothing friendly about third-party AI services. The Writers Guild’s 2023 agreement with the studios also set rules on how AI can and cannot be used with literary material. Production companies, agencies and entertainment law firms should assume any AI use touching that material needs a written basis, and should be able to show which tool was used.

A 30-Day Plan to Move From Shadow AI to Sanctioned AI

This sequence works for a business of 10 to 200 people and does not need a dedicated AI team.

Week 1: find out what is already in use. Pull a discovery report of AI services seen on your network and endpoints (the Microsoft tools below can do this), and send a short anonymous survey asking staff which tools they use and what for. Make it clear nobody is in trouble. You want the truth, and amnesty gets it.

Week 2: choose the approved set. For most firms that means one general assistant tied to your existing identity platform, plus specific tools for specific jobs such as transcription or document review. For each candidate, confirm in writing that business data is not used for training, that you control retention, that it supports single sign-on, and where the data is processed.

Week 3: write a one-page policy. Sort data into three groups. Public information can go into any approved tool. Internal information can go into approved tools only. Client-confidential, privileged, personal or NDA-covered material can go only into tools specifically cleared for it, or nowhere. Name a person who approves new tools, and require a human to review AI output before it reaches a client. The NIST AI Risk Management Framework and its Generative AI Profile are useful references if a client or auditor asks what your policy is based on.

Week 4: enforce and train. Turn on the technical controls, block the unapproved tools you found in week one, and run a half-hour session showing staff what the approved tools can do. People abandon shadow tools when the sanctioned option is at least as convenient.

After that, review the discovery report each month. New AI tools appear constantly, and the list of approved tools will need regular updates.

Controls You May Already Own in Microsoft 365

Many LA professional-services firms already pay for security features they have never switched on. Depending on your licensing:

Microsoft Defender for Cloud Apps can discover cloud and generative AI apps in use across your organization and mark them sanctioned or unsanctioned, which drives blocking on managed devices.
Microsoft Purview includes data security and compliance protections for AI that can show what sensitive data is flowing into AI apps and apply data loss prevention policies to it.
Sensitivity labels on documents travel with the file, so a document labeled “Client Confidential” can be kept out of tools that should not see it.
Conditional access can require a managed, compliant device before anyone reaches an approved AI tool through company sign-in.

One caution about Copilot in particular: it can see whatever the signed-in user can see. If your SharePoint and Teams permissions are loose, with old “everyone” links and overshared folders, Copilot will surface that material in answers. Clean up permissions before you roll it out widely, not after.

AI Agents Make Governance More Urgent

The headlines have moved from chatbots to AI agents, meaning tools that read your email, browse the web and take actions on your behalf. Banks and software vendors are now building agents for small business customers, and staff will connect agents to company inboxes on their own if nobody stops them.

An agent that can act creates risks a chatbot does not. The OWASP Top 10 for LLM Applications ranks prompt injection as the top risk. In a prompt injection attack, hidden instructions in an email or web page trick the AI into doing something its user never asked for, such as forwarding files. The same list flags excessive agency, which means giving an AI more permissions than its task needs.

The practical rules are simple:

No agent gets connected to company email, files or financial systems without IT approval.
Agents get the narrowest permissions that work, and read-only access wherever possible.
Anything that sends money, deletes data or emails outside the company needs a human to confirm it.
Every agent runs under an identity you can audit and disable.

What Good Looks Like Six Months From Now

A business that has sanctioned AI properly can answer five questions without having to look anything up: which AI tools are approved, what data is allowed in each, who approved them, how it would know if someone used an unapproved tool, and what happens to a departing employee’s AI history. Cyber insurers, enterprise clients and law firm general counsel are starting to ask these questions on security questionnaires. Firms with clear answers win the work and renew without trouble.

The productivity side matters as much. Once AI use is visible, you can see which manual workflows staff are already patching with chatbots, such as intake summaries, document comparison and status reports. Those are the best candidates for proper automation built on approved tools and connected to your systems.

We Solve Problems runs both halves of this for Los Angeles businesses: the managed IT and Microsoft 365 security that keeps AI use contained, and the AI operations work that finds manual workflows and automates them safely. We work closely with entertainment-law and professional-services firms, where confidentiality is non-negotiable. If you want to know which AI tools your team already uses and what to do about them, request a consultation.