Your Team Is Already Using AI at Work — Write the Policy Anyway
Shadow AI is what happens when staff use personal chatbot accounts for work. Here's how to get visibility, what belongs in a one-page AI policy, and what Colorado law is doing.
There's a conversation we have regularly with small business owners. It goes: "We haven't rolled out any AI tools." And then, ten minutes later, someone mentions that the office manager has been using a chatbot to clean up proposals, and the estimator uses one to draft scopes of work, and marketing has been generating first drafts of everything for a year.
That's shadow AI — staff using consumer AI tools on work data, through personal accounts, with no visibility on your side. It isn't a discipline problem. People adopted these tools because they genuinely help, and nobody told them not to.
The problem is what goes into the prompt box.
What's Actually at Risk
Not the technology. The data path.
Confidential information leaves your control. When an employee pastes a client contract, a patient record, an unreleased financial statement, or a candidate's resume into a consumer chatbot, that data goes to a third party under whatever terms that free account carries. Consumer tiers and business tiers frequently have very different commitments about retention and whether inputs can be used to improve models — and almost nobody reads which one they're on.
Contractual obligations get broken quietly. If your customer agreements or NDAs restrict where their data may be processed, or require subprocessor disclosure, a personal chatbot account is an unapproved subprocessor. This is increasingly showing up in customer security questionnaires — larger clients are asking their vendors directly how AI tools are governed.
Regulated data has rules. Protected health information under HIPAA needs a business associate agreement with any service that touches it. Cardholder data, driver's license numbers, and Social Security numbers carry their own obligations. A free chatbot account has no BAA.
Accuracy becomes your liability. These tools produce confident, fluent, occasionally wrong output. If a fabricated citation, a miscalculated figure, or an invented product spec goes to a client under your letterhead, "the AI wrote it" is not a defense anyone will accept.
There's no audit trail. When something goes wrong, you can't investigate what you can't see. Personal accounts leave nothing behind.
Step One: Find Out What's Actually in Use
Before writing anything, get visibility. Practical ways to do it:
- Check OAuth app consents in Microsoft 365 or Google Workspace. AI tools that connect to mail, calendar, or files show up here, and it's a genuinely eye-opening list in most organizations.
- Review browser extensions deployed on managed devices — a large share of AI tools arrive that way.
- Look at network or DNS logs for traffic to major AI service domains.
- Check expense reports and card statements for individual subscriptions bought outside procurement.
- Ask. Not as an investigation — as a survey. "What are you using, and what does it help with?" People answer honestly when the framing is enablement rather than enforcement, and you'll get a much better list than any technical scan produces.
That last one also tells you which use cases to support officially, which matters for the next step.
Step Two: Give People a Sanctioned Option
The single most effective control isn't a rule. It's a licensed account.
If your team has an approved AI tool with business terms, single sign-on, and no data-training on inputs, they'll use it — because it's already open in their browser and it's faster than the workaround. If they don't, they'll use a personal account, and you're back to zero visibility.
What to look for when picking one:
- Business or enterprise tier terms that explicitly state customer inputs aren't used to train models
- SSO integration with your identity provider, so accounts follow your onboarding and offboarding process
- Admin visibility into who's using it
- Data residency and retention settings you can configure
- A DPA, and a BAA if you handle PHI
- Documented security posture — SOC 2 or equivalent
Most businesses already own one through their productivity suite. If you're on Microsoft 365 or Google Workspace, an assistant is likely available in a plan you have or can add — which is far preferable to a dozen individual subscriptions on personal cards.
Read the terms of the specific plan you're on. The differences between a free tier, a personal paid tier, and a business tier are exactly the differences that matter here.
Step Three: Write One Page
Not a fifteen-page framework nobody reads. One page, in plain English, that answers the questions people actually have.
Which tools are approved. Name them. Include how to request a new one, and commit to a response time — an unanswered request is how shadow AI restarts.
What must never be entered. Be specific and concrete:
- Protected health information or anything covered by HIPAA
- Social Security numbers, driver's license numbers, financial account or card numbers
- Credentials, API keys, or configuration secrets
- Client data covered by an NDA or a contract restricting processing
- Unreleased financial results, M&A material, or legal advice
- Employee personnel records, performance reviews, or candidate information
- Proprietary source code, unless the tool is explicitly approved for it
What's fine. This half matters just as much, because a policy that only says no gets ignored. Public information, internal drafts, general research, brainstorming, rewriting your own text, summarizing a meeting you attended, explaining an error message.
A human reviews everything before it leaves the building. Client deliverables, public content, code, contract language, and anything involving numbers get checked by a person who understands the subject. The reviewer owns the output.
Disclose where it matters. Decide your stance on telling clients when AI assisted a deliverable, and be consistent. Some contracts require it.
High-stakes decisions need a human decision-maker. Hiring, promotion, termination, credit, pricing to individuals, and anything affecting a person's access to a service or benefit. This is both an ethics matter and, increasingly, a legal one.
Who to ask. Name a person. Policies without an owner don't survive their first ambiguous case.
The Colorado Angle
Colorado has been unusually active here, and the situation has moved more than once.
The 2024 Colorado AI Act (SB 24-205) was postponed, then had its enforcement stayed by a federal court in April 2026, and was ultimately repealed and replaced by SB 26-189, signed in May 2026, which takes a narrower approach focused on automated decision-making technology and takes effect January 1, 2027. You can track the current text through the Colorado General Assembly.
The practical read for a small business: if you use AI tools to draft emails and summarize documents, this is unlikely to reshape your operations. If you use automated systems to make or substantially inform consequential decisions about people — hiring, lending, housing, insurance, access to services — talk to your attorney about what documentation and notice obligations will apply, and start keeping records now rather than in December.
Given how fast this area is moving, verify the current status rather than relying on any article, including this one. Nothing here is legal advice.
For a structured, vendor-neutral way to think about AI risk generally, the NIST AI Risk Management Framework is a reasonable starting point that doesn't require a compliance department to read.
Step Four: Train, Then Revisit
Twenty minutes with the team beats a policy emailed as a PDF. Cover:
- The approved tools and how to log in with the company account
- Three real examples of what not to paste, drawn from your actual work
- Why the review requirement exists — show a plausible-looking wrong answer
- How to request a new tool
Then put a calendar reminder to revisit the policy every six months. The tools change quarterly; the policy should at least keep pace with the vendors you use.
Frequently Asked Questions
Should we just block AI tools? Blocking pushes usage onto personal phones, where you have no visibility at all and the data risk is identical. Sanction, license, and govern instead.
Is our data safe in business-tier AI tools? "Safe" depends on the specific contract. Business and enterprise tiers generally commit to not training on customer inputs and offer retention controls. Verify it in the agreement you signed, and confirm you're on that plan rather than assuming.
Do we need a BAA to use AI with patient data? Yes — any service processing PHI on your behalf needs one, and most consumer AI tools will not sign one. That's a hard stop.
What if a client asks whether we use AI? Answer honestly, and have a written policy to point to. A clear policy is increasingly a competitive advantage in security questionnaires, not a liability.
We're 15 people. Do we really need a policy? It's a one-page document, and the risk it addresses doesn't scale with headcount — one pasted contract is one pasted contract at any size.
Need a Straight Answer on This?
Most small businesses don't need an AI strategy. They need to know what's already being used, get their team onto accounts with business terms, and write down the rules in language people will actually follow.
netkraft helps Denver-area businesses do exactly that — discovery, tool selection with the contract terms read properly, SSO and account setup, and a policy short enough to be used. For the broader security foundation it plugs into, see our complete guide to cybersecurity for small businesses.
Contact netkraft to talk it through, or read more about our IT consulting and cybersecurity services.