Q: What is shadow AI and how widespread is it? A: Shadow AI is the practice of skirting company IT policies to use chatbots, agents, or consumer AI tools for work without approval. Surveys in the article report 71% of UK workers have used unapproved consumer AI at work and mid-size companies can see about 200 unsanctioned AI tools per 1,000 workers, showing it’s common. Q: How to manage shadow AI: what are the first steps? A: Start by accepting it’s already in your company, map the tools people use through logs, browser extensions, and expense reports, and run a short, blame-free survey to hear where employees rely on their own tools. Create and regularly update an allowlist and blocklist, set clear guardrails, and offer approved, fast options so people don’t circumvent IT. Q: What kinds of data should be classified and protected from AI uploads? A: Classify data as public, internal, confidential, or restricted and enforce “never paste” rules for source code, customer PII, financial results, health data, legal drafts, and secrets or keys. Require client consent before uploading third‑party data and surface red-line banners or prompts in the UI to remind users at the moment of risk. Q: Which technical controls help prevent data leaks to unapproved AI tools? A: Use data-loss prevention (DLP) to flag uploads of PII or code and enforce company sign-in with SSO and least-privilege access so data doesn’t leave via personal accounts. Mask or redact sensitive fields before model calls and log prompts, files, and outputs to support audits. Q: How can offering approved tools reduce shadow AI use? A: Provide approved enterprise AI with data controls (no training on your inputs, audit logs, SSO), role-based apps, prompt libraries, and plug-ins so workers have fast, job-tailored alternatives. Publish a one-page comparison of approved versus blocked tools and offer a quick path to request new tools to reduce DIY hacks. Q: What steps should IT take to control agent sprawl? A: Keep a registry of agents and automations that lists what data they touch and what actions they can take, sandbox agents in read-only mode initially, and give every agent a kill switch plus alerts for unusual behavior. Use management suites to observe and govern agents; the article notes Microsoft made Agent 365 generally available to help companies take control of agent sprawl. Q: What should a company do if someone accidentally exposes data to a chatbot? A: Follow a simple playbook: contain the incident by revoking access and deleting data if possible, notify relevant teams, rotate keys, document what happened, and improve controls. Decide consequences in advance, focus on fixing the system that led to the slip, and practice drills with legal, communications, and leadership so the first time is not the real thing. Q: How should companies measure progress when trying to reduce shadow AI? A: Track both productivity gains and security by measuring time saved and incidents avoided, and set measurable goals like reducing unapproved tools and increasing adoption of approved tools. Review vendors and model terms quarterly, and make safe, approved tools the easiest path so workers choose the paved road over the alley.