Shadow AI: How to Find Out Which AI Tools Your Team Already Uses

What is shadow AI, and why is it probably already in your business?

Most owners suspect their team is using AI tools they have never approved. Many have not asked, partly because they are not sure what they would do with the answer. That hesitation is understandable, and it is also how a business ends up with client information sitting in accounts nobody at the company controls.

Shadow AI is the name for that gap: AI tools used for work that the business has not approved or does not know about. It is usually ordinary. A free chat account used to draft emails. A browser extension that rewrites text. A note-taker that joins video calls and sends a summary. An assistant a software vendor switched on inside a tool you already pay for.

None of that requires bad intent. It only requires a capable person, a deadline, and no clear answer about what is allowed.

Why do good employees use AI without telling you?

In my experience, people who use AI quietly are usually trying to do good work faster. They found something that saves them an hour, nobody told them the rules, and the business never offered an approved option. Some worry that admitting it will look like cutting corners. Others worry it will raise a question about whether their job is needed.

So here is the reframe I would offer. Shadow AI is not mainly a loyalty problem. It is your team showing you where the work is heavy and where the business has not kept up. Every hidden tool marks a task someone wanted help with. That is useful information, and you get it for free if you ask the right way.

The risk is still real. A personal account may keep what is typed into it under terms the business never agreed to. A note-taker may record a client call the client did not expect to be recorded. A draft may go out under the company name with nobody checking it. But a crackdown rarely fixes those risks. Bans in a small company tend to push the use further out of sight, which is the opposite of what you need.

How do you find out which AI tools your team already uses?

Use more than one source. People forget what they use, and some tools are switched on without anyone choosing them. Between them, these six checks catch most of it.

1. 01Ask with an amnesty. Tell the team plainly that nobody is in trouble for anything they share, and that the goal is to give them better options. Ask three questions: which AI tools do you use for work, what do you use each one for, and what kind of information goes into it. Offer a short written form as well as a conversation, so quieter people can answer too.
2. 02Check the software you already pay for. Open the settings of your email, CRM, phone system, accounting, and document tools, and look for anything labeled AI, assistant, copilot, or summary. Write down what is on and who turned it on.
3. 03Check the admin side of email and files. Business platforms such as Google Workspace and Microsoft 365 give an administrator a view of the outside apps people have connected to their company accounts. Look for note-takers, writing assistants, and anything that can read email, calendars, or files.
4. 04Check the spending. Card statements and expense reports show AI subscriptions that nobody mentioned, including ones paid personally and reimbursed.
5. 05Check the meetings. Look at the attendee lists of recent video calls for note-taker bots, especially on calls with clients.
6. 06Check the browsers. On company computers, look at installed browser extensions. Writing and summarizing tools often live there and see everything typed into a web page.

Put everything in one simple list: the tool, who uses it, what it is used for, what information it touches, and whether anyone reviews what it produces. This is the same inventory I recommend in When Does a Small Business Need an AI Audit?, and shadow AI is usually where most of its rows come from.

What should you do with what you find?

Sort every tool on the list into one of three decisions. Make the decision about the tool and the information it touches, not about the person who found it.

• Approve: the tool is useful, the information it touches is low risk, and you can support it. Move it to a business account if it is not on one already, and name one person who owns how it is used.
• Replace: the need is real, but the tool or the account is wrong, for example client details going into a personal free account. Give the team an approved alternative that does the same job, then retire the old one.
• Stop: the tool touches information that must never leave your control, nobody reviews what it produces, or you simply cannot support it. Explain why, and say what people should do instead.

Then close the loop with the team. Thank the people who were honest, tell everyone what you decided and why, and make the approved path easier than the hidden one. If the only option that works is a personal account, people will keep using it no matter what the policy says.

This is where the 4C Framework helps you read the results. A cluster of hidden tools around one task often points to a Capacity problem: too much work for the people doing it. Tools used because nobody knows a better way point to Capabilities: the team needs training on approved tools, not a warning. Either way, the finding is about the business, and the fix is a decision you can make.

Where should you start this week?

1. 01Send the team a short note with the amnesty and the three questions, and ask for answers by the end of the week.
2. 02Spend thirty minutes on two checks you control directly: the settings of the software you pay for, and the connected apps page in your email and file platform.
3. 03Put every tool you find into one list, and mark each row Approve, Replace, or Stop.
4. 04Tell the team what you decided in a short meeting, and write the decisions into your AI policy so the next tool starts from them.

If you do not have a policy yet, A Practical AI Policy for a 20-Person Company gives you a one-page outline, including approved tools and the information that never goes into them.

If the list turns out longer than you expected, an AI audit reviews each tool, the information it touches, and who owns it, and AI governance consulting turns the decisions into owners and review steps the team will follow. When the real need is for approved tools and the skills to use them well, Practical AI Team Enablement is built for that.