Shadow AI is your team using AI tools you have not approved, usually to do their job faster. Here is what it looks like in a small business, and what to do.
Short answer: Shadow AI is when people in your business use AI tools you have not approved or do not know about. It is almost never malicious. It is someone trying to finish a quote faster, and the risk is not the tool. It is what gets pasted into it, and where that ends up.
Key takeaways
Every security vendor defines shadow AI as "the use of AI tools without the approval, monitoring or involvement of an organisation's IT or security teams".
That definition assumes you have an IT team to bypass. Most businesses of three to twenty people do not, wherever they are. There is no approval process to go around, no security team to hide from, and often no list of which tools anyone is using.
So the honest version for a small business is simpler: shadow AI is everyone quietly using whatever helps, and nobody knowing what has been shared.
A bookkeeper pastes a client's bank statement into ChatGPT to summarise the transactions. An engineer uploads a tender document to get help rewriting the methodology. A developer drops an API key into a chat window while debugging an integration. A new starter uses a personal AI account because the business never bought one.
Each of these is an ordinary person doing their job well. None of them is trying to leak anything, and that is precisely why policies aimed at bad actors miss. The behaviour you are trying to change is competence under time pressure, not misconduct.
The pattern worth noticing is that shadow AI concentrates in the roles that handle your most sensitive material. Bookkeeping, legal drafting, tender writing and engineering are exactly the work AI is most useful for, and exactly the work where the documents contain client identifiers, pricing and credentials. The tool is most attractive where the data is most sensitive.
When something is pasted into a consumer AI tool, it leaves the building. Depending on the tool and the plan, it may be retained, reviewed by humans for quality, or used to improve the model. Free and consumer tiers generally offer weaker protections than business tiers, and the terms differ between providers and change over time, so check the terms of the specific plan your team is on rather than assuming.
Three kinds of exposure follow, and they are not equally serious.
Credentials. A leaked API key, password or access token is not a privacy question. It is an unlocked door that anyone who obtains it can walk through immediately, and rotating the key is the only fix. This is the most serious category and the least discussed.
Client confidentiality. Professional obligations and client engagement terms usually bind you regardless of what privacy statutes require. A confidentiality clause does not have a turnover threshold.
Commercially sensitive material. Tender pricing, drawings and case strategy do not become less sensitive because they were shared accidentally.
This is where shadow AI stops being a housekeeping problem and becomes a legal one, and it applies to small businesses that assume privacy law does not reach them.
In Australia, APP 8 requires an entity to take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles before disclosing personal information to them. Section 16C goes further: an entity that discloses personal information to an overseas recipient "is accountable for an act or practice of the overseas recipient that would breach the APPs". You do not hand off responsibility along with the data.
In New Zealand, IPP 12 permits sending personal information overseas only where the recipient is subject to the Privacy Act, will adequately protect the information (for example through model contract clauses), or is subject to comparable privacy laws. Otherwise you need the person's express and informed permission. There is no size exemption; the Privacy Act 2020 binds every agency.
In the European Union, transfers outside the EEA require an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a specific derogation. As the Commission puts it, "when personal data is transferred outside the European Economic Area, special safeguards are foreseen to ensure that the protection travels with the data."
None of these frameworks contemplate a staff member deciding, at 4pm, that a particular US-hosted chat service is an appropriate recipient of a client's identity documents. That decision is being made dozens of times a week in businesses that have never thought of it as a transfer decision at all.
Whether any of this binds you depends on where you operate and how large you are. That is a longer answer, and it is in our companion piece on whether privacy law applies to your small business.
The instinct is a policy that says "do not use AI tools". Three things happen.
The work gets slower, and staff notice that the competitor down the road is quoting faster. People use their phones instead, moving the activity onto devices you have no relationship with. And you lose the little visibility you had, because nobody will tell you about a tool they are not supposed to be using.
A ban converts shadow AI from a manageable problem into an invisible one. It also fails a basic test: if you would not enforce it, it is not a rule, it is a wish.
The workable approach is the opposite. Let people use the tools, name the handful of things that must never go in, and make the risky moment visible at the moment it happens.
Ask. Find out which tools people already use. Say plainly that it is not a disciplinary conversation, and mean it, or the answers will be wrong. Most owners are surprised by both the number of tools and how much genuine value people are getting.
Buy the accounts. If people are using personal free accounts because the business never provided one, that is your decision showing up as their risk. A business plan generally carries stronger commitments about retention and training, and it gives you one set of terms to reason about instead of a dozen.
Name the categories that must not go in. Client identity documents, bank and card details, passwords and API keys. Four concrete categories beat a ten-page policy nobody reads, because "do not share confidential information" is not something anyone can apply at speed.
Make the moment visible. A person about to paste a client's tax file number into a chat window generally does not realise it. Something that catches it at that moment does more than any amount of training, which reliably decays within a fortnight.
Prinn does the last one. It runs on each person's computer, checks a prompt before it is sent, and if it finds something sensitive it shows what it found and offers three choices: redact it, stop, or send it as is. The person decides; it never blocks anyone. Prompt content never leaves the machine, including to us. An owner sees the category, the tool, the date, the device and the choice made, without reading anyone's prompts.
It is reliable on credentials, financial details and identity numbers. Names, home addresses and dates of birth written into ordinary prose are harder, and it is still improving at those. Worth knowing before you rely on it.