How to Prevent Shadow AI in Your Organization: Governance Rules and Operational Design Beyond Simple Bans

We had supposedly banned it, yet some staff were quietly using a different AI tool

This is a familiar headache at organisations where generative AI has begun to spread across the floor, and it tends to land squarely on IT, security and compliance teams, as well as on the people driving digital transformation. Not so long ago, the prevailing view was that putting out a near-blanket ban would deliver a tidy measure of control. These days, though, generative AI has quietly worked its way into everyday tasks: summarising meeting notes, drafting emails, sketching out proposals, knocking together a first pass at research.

By way of illustration, suppose a 500-person B2B firm reviewed actual usage across all ten of its departments and found roughly twenty cases of unsanctioned AI use a month. Most of these arose not from any wish to flout the rules, but from a simple desire to get the work done faster. IT wants to manage risk. The floor does not want to lose pace. Leadership wants control and adoption to coexist. The vantage points differ; the underlying problem is the same.

In this article we set out the causes of shadow AI, and, while making usable alternatives available, explain the internal rules and operational design needed to cycle through visibility, prohibition and proper enablement. The aim is not a workforce using AI in the shadows, but one that can consult and use it with confidence within a sanctioned environment. That said, simply rolling out a tool will not make shadow AI disappear. The trick is to design rules, education, an allow-list and regular review as a single, joined-up package.

What shadow AI actually is

Shadow AI refers to a state in which staff use generative AI tools for work that the company has neither catalogued nor approved. Where the older notion of “shadow IT” pointed to unsanctioned SaaS and cloud services, shadow AI adds further questions to the mix: how input data is handled, how accurate the output is, and matters of copyright, contract and personal-data protection.

The following sorts of use, for instance, all qualify.

• Logging in to a generative AI service with a personal account and pasting in work documents
• Feeding meeting notes or minutes into a free AI summarisation tool
• Using AI features in browser extensions or third-party SaaS without company approval
• Entering customer information or internal materials into an external AI without checking the terms of service or data-retention conditions
• Sending AI-generated text outside the company without anyone reviewing it

The crucial point here is that the bulk of shadow AI does not stem from ill intent alone.

From the floor’s perspective, generative AI is genuinely handy. Tidying up prose, summarising what was said in a meeting, generating ideas, rephrasing an awkward sentence: these tasks crop up daily. Where there is no easy, sanctioned AI environment and no clear yardstick for judgement, it is only natural that staff reach for a tool they have found themselves.

Shadow AI, then, is not merely “a question of staff morals”. It is better understood as a structural problem that surfaces when a company’s rules and infrastructure have failed to keep pace with genuine business need.

Why shadow AI arises

To prevent shadow AI, you first need to understand why staff reach for unsanctioned AI in the first place. Misread the cause and you simply pile on more prohibitions, widening the gulf with the floor.

The floor already has work it wants AI for

There are concrete business needs behind staff turning to generative AI.

Sales people want to pull next actions out of their meeting notes. Marketers want a first draft of an article or an email. Back-office teams want to speed up answers drawn from internal regulations and FAQs. Managers want a tidy meeting agenda or a clean set of one-to-one notes.

These are pressing, real-world needs.

Being told merely that “you mustn’t use AI” does nothing to shrink the pile of work in front of you. The less official provision there is, the more readily staff drift towards outside tools.

Nobody is sure what they may use

At companies where shadow AI takes hold, staff are left holding questions like these.

• Is there an AI tool the company has actually sanctioned?
• May I use a free generative AI service for work?
• May I enter internal materials?
• May I enter customer information if it has been masked?
• May I use AI-written text as it stands?
• When in doubt, whom do I ask?

When the answers to such questions are vague, staff act on their own judgement.

Generative AI has a famously low barrier to entry. Because you can create an account and be away in moments, use often begins without ever passing through a formal internal approval process.

Application and approval are too heavy-handed

Even where a company has set up a mechanism for requesting AI use, an over-engineered process will see little uptake on the floor.

You only want to rephrase or summarise a short passage, yet several departments must sign off; replies take an age; and the verdict shifts depending on who happens to be handling it. In that state of affairs, staff readily conclude that “it’s faster to just use it myself than to apply”.

High-risk use does, of course, warrant careful scrutiny. But weigh every instance of AI use on the same heavy scales and you end up halting even the low-risk, perfectly sensible applications.

Prohibition has run on ahead

A common failure in tackling shadow AI is making “you mustn’t” the very first message.

Spelling out which information must not be entered and which uses are off-limits is necessary. Prohibition on its own, however, leaves the floor unable to move.

What matters is conveying these two things as a pair.

• This you must not use
• Instead, this you may use

Where prohibitions and alternatives do not come as a set, staff may well take it that “the company wants to put a stop to AI adoption”. The upshot is that visible use dwindles and hidden use grows.

The risks of letting shadow AI run unchecked

Shadow AI is not simply a matter of “the company not knowing which tool is in use”. It reaches into several domains at once: information management, legal, quality control and the running of the organisation.

The risk of entering confidential and personal information

The most obvious risk is the entry of confidential or personal information.

If, for instance, the following sorts of information find their way into an external AI, problems of information governance may well follow.

• Customer names, contact names and contact details
• Contract terms, proposed pricing and deal histories
• Unpublished results and business plans
• Staff appraisal data and health information
• Internal-only technical materials and operating manuals

A member of staff may “only mean to have a bit summarised”, yet not grasp precisely how the information they have entered will be handled. Use a service without checking its terms, its data retention, whether inputs are used for training, and the settings in its admin console, and information may end up in territory the company cannot govern.

The risk of flawed output seeping into the work

Generative AI excels at producing natural-sounding prose. It will, on the other hand, sometimes serve up statements at odds with the facts, or claims that need their grounds checked.

With unsanctioned use, there is often no settled rule for checking output, and so problems of this sort arise all too easily.

• A mistaken summary is shared as a meeting’s agreed decision
• Information that does not exist makes its way into a document
• An inaccurate account of a contract or regulation is passed on to staff
• A customer email carries overblown language or an unwise promise
• Nobody is quite sure who owns the AI-written text

AI is effective for drafting and tidying, but it is no substitute for the final call. Documents that leave the building, figures, citations, and any account touching on contracts or regulations should be run on the premise that a human checks them.

An unmanageable sprawl of tools

Once each department, and each individual, starts reaching for a different AI tool, governing matters at a company level becomes a tall order.

Contracts, users, permissions, input data, output, leavers’ accounts and costs all become scattered, and the overall picture slips from view. What began as a small convenience can, before anyone notices, be woven into a critical business process.

Reach that state and the effort needed to impose control after the fact grows considerably.

The rift with the floor deepens

Run your shadow-AI response as a “crackdown” and the rift with the floor only deepens.

IT and security teams write rules to protect the company. The floor, meanwhile, wants to get on faster with serving customers, producing materials and squaring things away internally.

When the two are at loggerheads, AI adoption itself struggles to advance.

What is needed is not to dismiss the floor’s needs, but to halt the higher-risk practices while steering people towards lower-risk ones.

The guiding principles for tackling shadow AI

The guiding principles for preventing shadow AI come down to these three.

1. Make actual usage visible
2. Provide usable alternatives
3. Run prohibition and proper enablement as separate tracks

The order matters. Lead with prohibition alone and the floor may simply move to using AI out of sight. First grasp what is actually happening, then set out options staff can use with confidence.

Make actual usage visible

The first thing to do is to take stock of actual usage.

The important thing here is not to turn it into “an inquiry for the purpose of blaming whoever used it”. Staff who feel they are being blamed find it hard to declare matters honestly. And without a clear picture of reality, you cannot frame sensible rules.

To begin with, check items such as these.

• Which AI tools are in use
• For which tasks they are used
• What sort of information is being entered
• How the output is being used
• What people are struggling with
• What AI environment they would like the company to provide

Combining surveys, departmental interviews, a review of existing SaaS contracts and a look at network logs makes it easier to get the overall picture. That said, lean on logging and monitoring alone and the floor may grow defensive. Marrying technical insight with conversation is what counts.

Provide usable alternatives

Once visibility has surfaced the business needs, the next step is to provide alternatives.

If staff are pasting meeting notes into an external AI, for example, provide an internally sanctioned summarisation environment. If they are using an external AI to draft proposals, restrict the information that may be entered and then furnish an internal AI chat and a set of prompt templates.

There is more than one option: the AI features bundled with your existing groupware, enterprise AI services whose security settings you can administer, an AI environment built in-house, or a work-support platform.

A service such as Kanata, which lets you organise AI chat, AI summarisation and e-learning by unit of work, is one option where you want to separate users, data and prompts by department or project. Kanata is designed around the notions of spaces, projects, apps and libraries, so you can organise your organisation, your units of work, your AI features, and the training data and prompts you reuse.

Whichever tool you choose, though, introducing it will not make shadow AI vanish of its own accord. It needs to be run together with internal rules, education, permission management and a review regime.

Separate prohibition from proper enablement

Treat every instance of unsanctioned AI use the same way and the floor will struggle to come round to it.

To begin, sort use into three categories.

• Use to be prohibited at once
• Use that can be properly enabled subject to conditions
• Use the company can recommend

Entering personal information or unpublished financial information into an external AI is use to be prohibited at once. Drafting a piece of prose from public information, or summarising using masked information, on the other hand, are uses that may well be enabled once the conditions are in place.

With this classification in hand, the floor finds it easier to understand “what is absolutely off-limits, and what may be used after a quick word”.

Drawing up an AI allow-list

At the heart of any shadow-AI response sits the AI allow-list.

An AI allow-list sets out, in a single view, the AI tools the company sanctions, the purposes they may serve, the information that may be entered, the prohibitions, the manager responsible, and so on.

It is not a bare inventory of tools; the point is to build it so the floor can make judgements in the course of everyday work.

What goes on the allow-list

At a minimum, the allow-list should carry the following items.

The trick is to write down not only “which tools you may use” but “for which tasks, and on what conditions, you may use them”.

Note merely that “AI chat is permitted”, for instance, and the floor will struggle to judge. Put it like the following and they can decide concretely.

• Drafting an article outline from public information: permitted
• Summarising a masked meeting note: permitted within an internally sanctioned environment
• Entering a deal history containing a customer’s name and contact details: prohibited
• Summarising material containing unpublished results: prohibited
• Drafting an outbound email: permitted, provided the responsible person checks it before it is sent

Bring it down to this level of granularity and the floor is far less likely to be left guessing.

Settle your information categories first

Settling the categories of input information before you draw up the allow-list makes the whole thing easier to run.

This table works well placed at the very top of an internal portal or AI usage guideline.

It is worth noting that bodies abroad have published frameworks that hold the adoption of AI and the management of its risks in balance, and these make sound reference points when you draw up internal guidelines. The NIST AI Risk Management Framework and the OECD AI Principles are two such references. They are not something a private company can apply wholesale, but they serve as candidates to consult when framing your own internal rules.

How to make unsanctioned AI visible

You may draw up an allow-list, but unless you can actually see what AI staff are using, there is no improving the way it all runs.

Make things visible in the following three stages.

Take a no-blame inventory

For the first inventory, make it plain that you are “taking stock of the present”, not “punishing past use”.

In the survey, ask questions such as these.

• Have you used generative AI for work?
• Which tool did you use?
• For what task did you use it?
• What sort of information did you enter?
• How did you use the AI’s output?
• Was there anything that made you uneasy while using it?
• Are there rules or an environment you would like the company to put in place?

In this exercise, understanding the use and the risk takes priority over pinning down individuals. Where a serious information leak is suspected, however, the matter must be handled individually in line with internal regulations.

Set out each department’s usage needs

Next, set out usage needs department by department.

Check logs and contract status as a supplement

Where needed, also check network logs, SaaS contracts, browser extensions and the external services in use.

Trying to stamp out shadow AI by technical monitoring alone, however, is unrealistic. Monitor too heavily and the floor may simply go further underground.

A look at the logs is no more than a supplement for grasping risk. The important thing is to pursue it together with conversations on the floor and with education.

Separating use to prohibit from use you can properly enable

In tackling shadow AI, rather than prohibiting everything, you sort the handling according to risk.

Use to be prohibited at once

Use of the following sort should, as a rule, be prohibited.

• Entering personal information into an external AI
• Entering a customer’s confidential information into an unsanctioned AI
• Entering unpublished results, M&A information or personnel information
• Entering information whose external disclosure is restricted by contract
• Sending AI output to a customer or business partner without checking it
• Making legal, accounting or appraisal decisions on the strength of AI output alone

Use that can be properly enabled subject to conditions

There is, on the other hand, use that can be put to work once the conditions are in place.

• Organising the key points of research grounded in public information
• Improving the wording of internal documents
• Summarising masked minutes
• Answering FAQs within an internally sanctioned environment
• Drafting emails from a prompt template
• Summarising training content and setting review questions

Settle the scope of the input information, the tools to be used and the output-check rule, and uses of this kind may well lift productivity on the floor.

Use you can recommend

What a company finds easiest to recommend are the low-risk uses whose benefit is plain to see.

• Summarising public information
• Producing a first draft of internal prose
• Organising a meeting agenda
• Summarising training videos
• Drafting run-of-the-mill emails
• Sharing prompt templates

Start with these uses and you will find it easier to win the floor round.

The items your internal rules should carry

Rules for tackling shadow AI go unread if they run on too long. Pitch them too abstractly, on the other hand, and the floor cannot use them.

Include, at a minimum, the following items and they become easier to put into practice.

Purpose of use

Set down plainly what AI may be used for.

• Drafting prose
• Summarising what was said in meetings
• Organising the key points of research
• Answering internal FAQs
• Producing training materials
• Reusing prompt templates

Write only “for the sake of efficiency” and the scope is far too broad, so the trick is to bring it down to concrete tasks.

Permitted tools

Set down plainly the AI tools the company has sanctioned.

When you do, write down not just the tool name but the plan and environment that may be used.

• Internally sanctioned AI chat
• Internally sanctioned AI summarisation tool
• AI apps for particular departments
• Tools under evaluation: usable only within a PoC environment

Information that must not be entered

Most important of all is the information that must not be entered.

• Personal information
• Sensitive information
• Customer confidential information
• Information whose external disclosure is restricted by contract
• Unpublished financial information

Masking rules

Where you are handling information that includes personal or company names, settle the method of masking.

• Names: replace with {staff member A}, {department head}
• Company names: replace with {a major manufacturer}
• Amounts: replace with {on the order of tens of millions of yen}
• Dates: coarsen the granularity, as in {mid-May 2026}
• Contact details, addresses, account numbers: delete them

Masking is no cure-all. The context can sometimes still betray an individual or a company. For that reason, even after masking, it is important to ask “do we actually need to enter this information into the AI at all?”

Output-check rules

Make it the premise that AI output is always checked by a human.

The following, in particular, need checking against the source.

• Figures
• Proper nouns
• Dates
• Accounts touching on laws, regulations or contracts
• Promises made to customers
• Quotations and citations

Generative AI can produce natural-sounding prose, but it cannot necessarily be left to verify facts or make the final call. The NIST AI Risk Management Framework, too, sets out the case for organisations to design, use and evaluate generative AI with reliability and risk firmly in mind.

The procedure for reporting an incident

Settle in advance, too, the procedure for when someone has mistakenly entered information that ought not to have gone in.

1. Stop using it straight away
2. Record what was entered, when, and with which tool
3. Report it to your line manager and to the information-security team
4. Establish the scope of any impact
5. Contact those concerned as required
6. Feed measures to prevent recurrence back into the rules and the education

What matters here is creating an atmosphere in which people feel able to report. In a culture where the person who owns up gets blamed, incidents go into hiding.

Designing the operating cycle

Tackling shadow AI is not a case of writing the rules once and having done with it. The features and services of generative AI change quickly, and so does the way the floor uses them.

For that reason, you need to design an operating cycle.

What to check monthly

Each month, check indicators such as these.

• The number of AI usage applications
• The number of declarations of unsanctioned use
• The number of enquiries about AI use
• The number of updates to the allow-list
• Take-up of the education content
• The number of near-misses
• Requests for improvement from the floor

Where you use figures, always state the assumptions behind them.

By way of illustration, you might put it like this: “Over the course of April 2026, a review across all ten departments recorded twenty declarations of unsanctioned AI use, of which twelve were for summarising minutes or drafting prose.” Where the figures are not actual results, always flag them plainly as an illustration.

What to review quarterly

Each quarter, carry out a more substantial review.

• Whether to keep a permitted tool
• Whether to add a new AI feature to the allow-list
• Whether to update the definition of information that must not be entered
• Whether to revisit the usage rules department by department
• Whether to refresh the education content
• Whether to improve the incident-response flow

Because generative AI moves quickly, a rule that has gone unreviewed for more than six months may well drift out of step with the feel of things on the floor.

Feed back what the floor tells you

When it comes to improving how things run, feedback from the floor is vital.

Gather voices such as these, for instance.

• I’d like this use permitted
• The application process is hard to follow
• I’m unsure which information ought to be masked
• I don’t know how to use the sanctioned AI
• The yardstick for checking output is vague
• I’d like a template for each department

Feed these voices back into the FAQs, the allow-list and the training content.

What to get across in staff education

It would be a pity to leave staff education out of the picture, for it is education that brings the rules to life on the floor.

Why the rules are needed

Start by conveying the purpose of the rules.

The important thing is to explain it as “so we can use AI safely”, not “because the company wants to ban AI”.

Staff tend to find the following framing easy to accept.

• This is not about stopping handy AI use
• A line has to be drawn to protect customer and internal information
• We want to grasp how AI is being used so we can provide an environment people can rely on
• Keep to the rules and the scope for putting AI to work widens

Information you may enter, and information you may not

What staff find hardest to judge is the input information.

In the education, explain it with concrete examples.

• Already-published company information: may be entered
• General internal manuals: may be entered within a sanctioned environment
• Meeting notes containing a customer’s name: mask them, or handle them within a sanctioned environment
• An individual’s contact details: do not enter them
• Unpublished results materials: do not enter them

Where a judgement is hard to make, set down plainly whom to ask.

How to check AI output

AI is effective for drafting and tidying, but using the output as it stands is asking for trouble.

Encourage staff to make the following checks.

• Do the figures match the source?
• Are the proper nouns free of error?
• Is there any overly categorical wording?
• Is there any phrasing that might mislead a customer?
• Does it contradict the company’s own policies or regulations?
• Is it the sort of content that calls for expert legal, accounting or HR judgement?

The basics of prompting

Safe AI use also calls for the basics of prompting. A prompt is the instruction you give a generative AI.

When sharing one internally, casting it in a form like the following makes it easy to use in practice.

You are {role}.
Your objective is {objective}.
Your intended reader is {reader}.
The background information is as follows.
{information}

Please produce output in the following format.
{output format}

Constraints:
- For anything uncertain, write "needs checking"
- Do not fabricate figures
- Add a brief gloss for any technical terms

Kanata’s everyday-work best practices, too, organise this as a template for prompt design: be clear about the role, the objective, the intended reader, the background information, the output format and the constraints.

Where to turn when in doubt

Finally, make it plain where to turn when in doubt.

• AI usage rules in general: IT
• The confidentiality category of input information: the security team
• Contracts and customer information: legal or compliance
• How to put it to work: the digital-transformation team
• Operating the tool: the internal AI administrator

With nowhere to turn, staff simply press on under their own judgement.

How to think about building an internal AI environment

When it comes to preventing shadow AI, a sanctioned internal AI environment is important.

Merely providing a tool, however, is not enough. It needs a route into use that leaves the floor thinking “this I can work with”.

Start with the most-used cases

Try to bring every task under AI from the outset and the design grows unwieldy.

Start instead with the high-frequency, easy-to-govern cases.

• Summarising minutes
• Drafting emails
• Adjusting the wording of internal documents
• Summarising training content
• Producing a first pass at FAQs
• Organising meeting agendas

These are cases many departments find easy to use in common.

Separate projects, permissions and data

When you run an internal AI environment, you need to design who can reach which information.

Separating the scope of use by department, task, customer, engagement or training unit makes it easier to keep information from getting mixed together. Decide in advance, for instance, whether sales proposals and HR appraisal materials should sit in the same place, whether to separate environments by customer, and to whom administrator rights are granted.

Kanata lets you organise apps, members and libraries on a per-project basis, so it is one option where you want to separate AI environments by department or by task.

Reuse prompts and training data

When AI use is left to the individual, output quality varies.

For that reason, it pays to keep the prompts and reference materials you use often in a form the organisation can reuse.

You might prepare templates such as these, for example.

• A minutes-summary template
• A deal-note tidying template
• An internal FAQ-answer template
• A training-video summary template
• An email-drafting template
• A pre-dispatch external check template

Template things and staff have less call to go off and ask an external AI on their own.

How to go about rolling it out internally

When it comes to shadow AI, starting small and improving is more realistic than handing down a flawless set of rules to the whole company at once.

Grasp actual usage

First, survey how the floor is actually using AI.

At this stage, the aim is to grasp the business needs, not to root out unsanctioned use.

Build a risk classification

Next, classify the uses by risk.

• Use to be prohibited
• Use to allow subject to conditions
• Use you can recommend

On the strength of this classification, put together the allow-list and the list of information that must not be entered.

Provide sanctioned alternatives

Starting from the uses the floor most needs, set up sanctioned AI environments.

Summarising minutes, drafting prose, internal FAQs and training content, in particular, are common uses that make an easy place to begin.

Put education and FAQs in place

Merely publishing the rules will not let staff master them.

• What may be entered
• Which tools may be used
• How to check the output
• Whom to ask when in doubt
• How to report a mistaken entry

Get these across, again and again, through training, the internal portal and the FAQs.

Review monthly and quarterly

Revisit your AI usage rules at regular intervals.

When a new AI feature appears, when a request comes up from the floor, or when a near-miss occurs, that is the moment to update the rules.

In summary

Shadow AI is not the simple matter of staff getting up to something dangerous off their own bat.

In most cases, the floor has its reasons for wanting AI. To pull minutes together faster. To polish an email. To have a first draft of a document to work from. To organise the key points of some research. The need is there, and yet, with no usable environment or yardstick for judgement provided by the company, unsanctioned use is born.

To prevent shadow AI, it is important to proceed in the following order.

1. Grasp the reality of unsanctioned use without apportioning blame
2. Set out the purposes of use and the input information
3. Draw up an AI allow-list
4. Separate use to prohibit from use you can properly enable
5. Provide sanctioned alternatives
6. Embed it on the floor through education and FAQs
7. Keep reviewing it monthly and quarterly

Prohibition alone merely makes shadow AI invisible. What is needed is to acknowledge the floor’s business needs and then steer people towards a usage environment in which risk can be managed.

The adoption of generative AI will only widen from here. That is precisely why settling, early on, “what may be used”, “what must not be entered” and “who checks” lays the foundation that lets a company carry its AI adoption forward.

Q&A