AI News
09 Jul 2026
Read 10 min
How to manage shadow AI and prevent staff data leaks
How to manage shadow AI: use clear policies and provide approved tools to stop employee data leaks
Learn how to manage shadow AI with a simple plan: find where AI is used, set clear rules, offer safe tools, and block risky data sharing. Pair DLP and SSO with an AI gateway that logs, redacts, and monitors prompts. Train staff, approve vendors fast, and keep a human in the loop for AI agents to stop leaks.
Shadow AI is now a daily problem at work. New research shows 55% of UK employees use unapproved AI tools, and 1 in 10 have shared sensitive data with them. Only 16% of security leaders say their company manages AI safely. At the same time, 27% of workers add their own tools because the official ones do not fit their jobs. This gap fuels risk and slows real AI gains.
Teams cannot get the right AI tool fast, so they use what is easy.
Approval steps feel hard, so staff skip them.
People do not know what data is safe to paste into chatbots.
No one explains who owns the output or how it is stored.
Deadlines push staff to seek shortcuts.
Deepfakes and phishing raise confusion and fear, making mistakes more likely.
Use CASB/secure web gateways to spot traffic to AI sites and APIs.
Review DNS, proxy, and browser extension logs for AI domains and plugins.
Run short, anonymous pulse surveys to learn which tools workers use and why.
Map data flows: what data leaves, where it goes, and who can see it.
Adopt a “traffic light” guide:
• Green: public data (OK to use),
• Amber: internal data (use only in approved tools),
• Red: secrets/PII/IP (never paste into public AI).
State three no-go items: customer PII, credentials/secrets, unreleased IP.
Define approved use cases (summaries, drafts, code review) and banned ones (legal advice, clinical decisions, final copy without review).
Explain incident reporting: how to raise a hand fast if data was shared.
Pick enterprise AI that does not train on your data and supports data residency.
Use SSO, RBAC, and separate environments for sensitive teams.
Provide managed extensions and app integrations that meet your policy.
Create prompt libraries and style guides to boost quality and consistency.
Deploy an AI gateway/proxy to:
• log prompts and responses,
• scan/redact PII and secrets,
• block risky models or endpoints,
• enforce token and spend limits.
Enable DLP on endpoints, email, and cloud apps to stop copy/paste of sensitive data into unapproved sites.
Implement secret scanning in code repos and clipboards.
Use browser isolation or allowlists for high-risk roles.
Start with read-only access; add write actions only after review.
Scope tasks tightly; set timeouts, budgets, and rate limits.
Require approvals for external actions (sending emails, filing tickets, updating records).
Keep full audit trails of agent decisions, prompts, and outputs.
Run short drills: “Would you paste this dataset?” “Spot the deepfake voice.”
Teach safe prompt patterns (describe task, data boundaries, and checks).
Normalize asking for help. Reward reports of near-misses, not just perfect behavior.
Include phishing and deepfake examples tied to daily tools.
Create a 48-hour intake path for AI tools with a short security checklist.
Require DPAs, clear data-use terms, SOC 2/ISO 27001 where relevant, and UK GDPR alignment.
Demand tenant isolation, data retention controls, and export/delete rights.
Re-check vendors quarterly as models and defaults change often.
Classify content at creation; add watermarks and labels to AI-generated files.
Set retention and sharing rules in M365/Google Workspace for AI outputs.
Use tagging to route sensitive requests to approved models and regions.
Track: percent of AI traffic via approved tools, time to approve a tool, DLP blocks, incident count, and staff confidence scores.
Survey quarterly to learn which tasks still push staff to unapproved tools.
Retire unused tools and double down on the most loved safe options.
Publish a one-page AI policy with green/amber/red rules.
Turn on DLP and block known risky AI domains.
Roll out one approved enterprise AI with SSO and logging.
Launch a simple “Ask before you paste” campaign.
Stand up an AI gateway with redaction and allowlists.
Create an AI request form with a 48-hour SLA.
Limit agent autonomy; add human approval steps.
Run a 30-minute training with real copy/paste scenarios.
Measure usage monthly; share wins and lessons.
Iterate tools and rules based on feedback.
55% of workers use unapproved AI tools.
1 in 10 have shared sensitive data with them.
58% of security leaders see shadow AI as a top risk, yet only 16% feel effective today.
27% augment official tools with their own picks, signaling unmet needs.
46% set safety targets for the next year—progress is possible with focus.
Security and productivity do not have to clash. When you learn how to manage shadow AI with clear rules, strong guardrails, and better tools, people stop going around the system. You cut data leaks, speed approval, and unlock safe AI gains—today and as your agents take on more work.
Why shadow AI spreads
Missing tools and slow approvals
Unclear rules
Pressure and threats
How to manage shadow AI
1) Find and measure current AI use
2) Set simple, clear rules that people remember
3) Offer safe, approved tools that reduce friction
4) Build guardrails that prevent leaks by default
5) Keep humans in the loop for AI agents
Research shows 19% of firms let agents act with limited oversight. Put brakes on autonomy.6) Train for real-world mistakes, not just theory
7) Approve vendors fast and right
8) Integrate compliance without slowing work
9) Measure progress and adjust
10) Quick-start checklist
The risk in numbers you can use
(Source: https://www.techradar.com/pro/more-than-half-of-employees-are-using-unapproved-ai-tools-at-work)
For more news: Click Here
FAQ
Q: What is shadow AI and how common is it in workplaces?
A: Shadow AI refers to unapproved AI tools employees use instead of centrally sanctioned systems. Recent research found 55% of UK workers admit to using unapproved AI at work and 58% of cybersecurity decision-makers see it as a top risk, so understanding this is the first step in How to manage shadow AI.
Q: Why do employees turn to unapproved AI tools?
A: Employees often use unapproved AI because the right enterprise tools are slow to approve or do not meet their needs, with 27% admitting they supplement corporate AI with their own picks. Pressure from deadlines and confusion around threats like deepfakes and phishing also push staff toward quick, unofficial solutions.
Q: What are the main data risks of shadow AI?
A: One in 10 employees have knowingly shared sensitive company information with unapproved AI, increasing the risk of leaks of PII, credentials, or unreleased IP. Research also shows 19% of firms let AI agents act with limited human oversight, which raises further audit and control concerns.
Q: How can organizations start to find and measure shadow AI use?
A: Use CASB or secure web gateways to spot traffic to AI sites and APIs, review DNS, proxy and browser-extension logs, run short anonymous pulse surveys, and map data flows to see what leaves the network. These discovery steps are practical first actions when learning How to manage shadow AI and prioritising mitigations.
Q: What simple policy framework reduces accidental data sharing with AI?
A: Adopt a traffic-light guide—Green for public data, Amber for internal data (use only in approved tools), and Red for secrets/PII/IP that must never be pasted into public AI—and list three explicit no-go items: customer PII, credentials/secrets, and unreleased IP. Also define approved versus banned use cases and a clear incident-reporting route so staff know how to act if data is exposed.
Q: Which technical controls are most effective to prevent leaks to unapproved AI tools?
A: Deploy an AI gateway that logs prompts and responses, scans and redacts PII, blocks risky models or endpoints, and enforces token and spend limits, paired with DLP on endpoints, email and cloud apps and SSO/RBAC for approved tools. These controls help enforce policy by preventing risky copy/paste, keeping audit trails, and are central to How to manage shadow AI in practice.
Q: How should organizations manage AI agents to avoid uncontrolled actions?
A: Start agents with read-only access and add write actions only after rigorous review, scope tasks tightly with timeouts, budgets and rate limits, and require approvals for external actions such as sending emails or updating records. Maintain full audit trails of agent prompts, decisions and outputs and limit autonomy until oversight, approvals and incident paths are established.
Q: What quick actions and metrics show progress in reducing shadow AI?
A: Follow a quick-start checklist: publish a one-page AI policy with green/amber/red rules, turn on DLP and block known risky AI domains, roll out one approved enterprise AI with SSO and logging, stand up an AI gateway with redaction, run a short training and implement a 48-hour vendor intake process. Track percent of AI traffic via approved tools, time to approve a tool, DLP blocks, incident counts and staff confidence monthly to measure progress and adjust.
Contents
