How do I avoid using "shadow AI" at work?

Today, most of us resemble Aladdin, carrying a magical oil lamp that can summon an extraordinary genie called AI.

This genie’s vast knowledge often appears to be the solution to almost any problem. But is that really true?

Consider this scenario:

James installs a complimentary AI browser extension designed to assist with drafting emails. This installation helps James get efficient with his work.

However, James doesn't realize that it raises concerns regarding potential data breaches. The extension automatically scans content entered in the company email system.

Using unapproved tools that access company systems or data and bypass security and governance controls may result in significant consequences.

This is shadow AI in action: using AI tools without the knowledge or oversight of an organization’s IT or security teams.

We just examined a scenario illustrating the hidden risks of using AI without IT oversight. However, there are many other consequences of using shadow AI.

Risks of shadow AI include:

• Exposure of sensitive data: Using certain tools can result in customer information or internal code being stored on third-party servers, potentially exposing sensitive data unnoticed.

• Unauthorized processing of sensitive data: Shadow AI can seriously compromise sensitive data. Employees may unknowingly enter sensitive data into external AI systems, risking unknown storage locations.

• Increase in areas of vulnerability: Unsecured Application Programming Interface (APIs), personal devices, or unmanaged integrations can give attackers more entry points to access confidential or secure information.

• Lack of accountability: Shadow AI outputs can't be traced, making it impossible to check what data was used, how it was processed, or why decisions were made if something goes wrong.

• Potential model failure and unreviewed outputs: Using external models trained on the wrong data can produce biased, incorrect, or manipulated results. This can cause business credibility issues.

• Regulatory noncompliance: When an organization fails to meet legal or industry-specific standards, this can lead to severe consequences such as massive fines, lawsuits etc. Shadow AI tools can dodge data handling requirements, opening the door to fines, investigations, or lawsuits.

Quiz: What should Maria have done?

Maria works in a healthcare company in the US. She is preparing a quarterly regulatory report that includes patient data summaries. To save time, she uploads internal spreadsheets containing patient treatment details into a public AI tool to generate an executive summary.

The AI tool processes the information and provides a well-written report, which Maria submits to leadership. Two weeks later, the company's IT security team identified that the AI tool keeps all uploaded data and may use it for model training purposes.

Company policy prohibits uploading sensitive patient information to unapproved third-party platforms. Such actions may constitute a violation of the Health Insurance Portability and Accountability Act (HIPAA) data privacy requirements.

What should Maria have done to avoid regulatory non-compliance?

A. Remove patient names before uploading the data.

B. Confirm whether the AI tool is approved by IT/security and avoid uploading protected health information to unapproved platforms.

C. Upload the file but delete it immediately after receiving the AI output.

D. Proceed as long as the report is only shared internally.

Many employees use shadow AI unintentionally. Employees might use it simply to make their work processes faster to meet demands for efficiency.

This could involve using ChatGPT for document summaries or third-party AI plug-ins in design, development, or marketing workflows.

Other factors contribute to shadow AI in the workplace:

• Availability of AI tools for all users: Because AI tools are easily accessible today, employees can incorporate them into their workflows with little difficulty. This enables employees to try out these tools independently of IT supervision.

• Companies not having proper policies: A lot of businesses don't have official rules for using AI, which leads to varied approaches among teams when implementing and handling AI technologies.

• Employees not ready for AI: "A lack of AI literacy among many employees contributes to the uncontrolled spread of shadow AI."

Take a look at the video below to see an example that connects the causes of shadow AI to its consequences:

• In 2023, an electronics company faced serious consequences after employees used ChatGPT for debugging, unknowingly exposing confidential code. The breach resulted in millions of dollars lost, leaked trade secrets, and major reputational harm.

• Misusing AI can lead to financial losses. In February 2024, an Air Canada customer reportedly manipulated the company’s AI chatbot to obtain a refund larger than expected. The chatbot misinterpreted the request, leading to an overpayment.

These are just a couple of examples. The danger of shadow AI is real, and it boils down to careful and wise use of this extraordinary genie to help us, but not rule and ruin us.

Ethical values and principles serve as fundamental guides for the moral conduct of any individual, whether in the workplace or beyond.

Take a look at some ways to prevent shadow AI at your workplace:

Video created by Smitha Chungath using Canva

• Understand and follow AI policies: Read your company's AI, IT, and data security policies.

• Use only sanctioned AI tools: Check all the approved tools that you can use. If you're not sure, check with your manager before you use one.

• Protect sensitive data: Avoid sharing confidential information such as customer data, financial data, company documents, etc. The thumb of rule to follow: if you wouldn't post a piece of information publicly, then don't paste it into public AI.

• Engage in training: Take initiative to stay updated on your company's AI and data security policies by attending relevant training.

• Use proper intake channels: If you find an AI tool or feature within a tool already used by your company, reach out to the IT department. Describe how it can benefit the business.

• Report unofficial tools: If you see risky AI practices, data uploads, security issues, or use of unapproved AI tools, report them through the proper channel.

Quiz: Put on your thinking hat!

A project management platform introduces a new built-in AI feature. Your manager suggests trying it immediately to improve reporting.