Someone on your team is probably using AI right now. There’s a good chance you don’t know about it.
Maybe someone is pasting a draft grant narrative into a free chatbot to help tighten it up. Maybe they’re using an AI note taker during a client call or asking for a browser extension to summarize a contract. They’re not necessarily thinking about the risks. They’re trying to get their work done more efficiently, and often the tool helps them do exactly that.
That’s shadow AI. In conversations with nonprofit, association, and law firm leaders, I see it come up regularly. It’s an easy gap to overlook, especially when everyone is busy and AI tools are so easy to access. The good news is that you can address it without treating your staff like they’ve done something wrong.
What is shadow AI?
Shadow AI is the use of AI tools at work that your organization hasn’t approved, can’t monitor, or doesn’t know about. It’s like shadow IT: think of the personal Dropbox account or unapproved app someone starts using because it solves a problem faster than the official option.
AI is especially easy to adopt. Many tools are free, simple to use, and available without going through IT or a purchasing process. AI features are also being built into tools employees already use, including email, word processors, web browsers, and video-conferencing platforms. Sometimes people start using AI without making a deliberate decision to adopt a new tool at all.
And in most cases, this isn’t about people trying to get around the rules. They’re looking for ways to do good work with limited time and resources. That’s familiar territory for almost every nonprofit, association, and law firm.
What does shadow AI look like in practice?
The details vary by organization, but the pattern is usually the same: someone has a real task to finish and finds an AI tool that makes it easier.
At a nonprofit, a development associate might paste donor notes into a chatbot to draft personalized thank-you letters. A program manager might upload participant-outcome data to help write a funder report. Both uses could save time, but they could also expose donor or beneficiary information to a tool the organization hasn’t reviewed.
At an association, a staff member might use AI to analyze member survey results or draft a renewal campaign. Depending on what gets uploaded and which tool is being used, member contact details or other sensitive information could end up outside the systems the association controls.
At a law firm, a paralegal might ask an AI assistant to summarize deposition transcripts or help prepare a first draft of a motion. The result might be useful, but putting client information into an unapproved tool can raise serious questions about confidentiality and professional responsibilities.
In each case, the employee is trying to get the job done. The issue isn’t necessarily the task or the person doing it. The issue is that the organization may not know what information is being shared, where it’s going, or what happens to it afterward.
Where the real risk is
Shadow AI is first and foremost a visibility problem, not simply a question of whether employees should be allowed to use AI. To understand your organization’s exposure, leadership needs to be able to answer three basic questions:
- Which AI tools are people using, and what are they using them for?
- What information are they putting into those tools?
- What happens to that information once it’s there?
That last question is particularly important. The data terms for a free, consumer AI account may be different from those for a paid business account. Depending on the service and its settings, information entered in a tool may be retained or used to improve its models. A tool that’s appropriate for business use under one set of terms may be a poor choice when someone accesses it through a personal account.
If you can’t answer these questions, it’s difficult to assess the risk, or to give a confident answer when a funder, board member, client, or auditor asks how your organization manages AI.
Why banning AI can backfire
When leaders discover shadow AI, the first reaction is often to shut it down: block the websites, send a warning, or add a rule to the employee handbook. I understand why that’s tempting, but a ban doesn’t address the reason people started using AI in the first place.
The grant deadline is still Friday. The board report still needs to be written. If AI is helping someone get that work done, they may look for another way to use it, whether that’s a personal phone, a home computer, or a tool IT hasn’t identified yet.
In that situation, AI use hasn’t necessarily stopped. It’s just become harder to see. A strict ban can also discourage staff from being open about the tools they’re using, which makes it even harder for leadership to understand what’s happening.
The goal shouldn’t be to ignore the risks or let everyone use whatever they want. It should be to create a clear, practical way for people to use AI when it makes sense, and to understand where the boundaries are.
How to bring AI use into the open
Organizations that manage shadow AI well don’t rely on a rule alone. They make the safe option clear and practical. Here are six steps to get started.
-
Ask, without judgment. Use a short, anonymous survey to ask which AI tools people are using and what they use them for. Explain that you’re trying to understand current practices, not catch people breaking rules. You’re more likely to get useful answers when people feel comfortable being honest.
-
Check what your systems can already tell you. Your IT team or provider may be able to identify AI sites and apps being used through tools such as firewall monitoring, email security, and device management. Combine that information with staff feedback to build a more complete picture.
-
Classify information by sensitivity. Give staff a straightforward way to understand what information can be used with which tools. A simple set of categories, like public, internal, and confidential, can be a useful starting point.
-
Provide approved tools that do the job. If staff turn to AI because it saves time, give them a vetted business option that meets their needs and has appropriate data protections. The approved tool needs to be useful in practice, not just approved on paper.
-
Put the rules in writing. Use what you learn to create a clear AI use policy. Spell out which tools are approved, what information can be shared, and when employees need to ask first. “Use AI responsibly” is a goal, but it isn’t enough guidance on its own.
-
Keep the conversation going. AI tools and their capabilities change quickly. Revisit how staff are using them a few times a year and make it easy for people to ask questions before adopting a new tool.
You don’t need to launch a major project to make progress. For many organizations, these steps can help establish a much clearer picture of AI use and the work needed to manage it.
Where to go from here
Finding shadow AI doesn’t automatically mean your team has done something wrong. It often means people see value in AI and are trying to find practical ways to use it. The job for leadership is to understand what’s happening, set sensible boundaries, and give staff a safe way to put those tools to work.
If you’d like to explore the topic further, I’ve put together a short video series on using AI safely:
-
Shadow AI: What shadow AI is and why banning it can backfire. Watch the video →
-
The Vacation Test: What happens when your organization’s AI know-how lives in one person’s head. Watch the video →
-
Build an AI Use Policy: How to build a practical AI use policy, step by step. Watch the video →
-
AI Policy Stress Test: How to use Claude to identify and address gaps in your policy. Watch the video →
Not sure where your organization stands? Take our free AI Readiness Quiz for a quick look at where you are today. If you’d like a closer assessment, our AI Stack Review helps identify where AI is being used across your organization, what information is involved, and what may need attention.
Scott Midgley is co-founder and CIO of Wellforce IT, which provides managed IT, cybersecurity, and compliance services for nonprofits, associations, and law firms across the Mid-Atlantic.
