Maybe you’ve already made some thoughtful decisions about AI. You don’t put confidential client information into ChatGPT. Anything important is double-checked before publishing it. Everyone involved in your business understands that AI is a tool rather than a substitute for professional judgment.
Great!
Now I have another question for you: What is everyone else who works with your business doing?
Because you may have considerably more AI in your business than you realize.
Meet “Shadow AI”
There’s a term increasingly used for AI tools that employees or independent contractors use without the organization’s knowledge or approval: “shadow AI.” It sounds ominous.
AI use isn’t inherently a problem. The concern is whether someone you’ve trusted with confidential information is giving that information to another technology provider without your knowledge. And that someone could be an employee or even an independent contractor. How are they using AI? Have you ever asked?
Of course, your confidentiality agreement may say that your contractor must protect confidential information. But if everyone has a different understanding of whether pasting that information into an AI tool violates confidentiality, you’ll need to address the issue directly.
In a small business, Shadow AI can be incredibly ordinary:
- A virtual assistant pastes a client’s email into an AI tool and asks it to draft a response.
- Your social media manager uses AI to create your posts.
- The web developer uses an AI coding assistant.
- A copywriter uses AI to create first drafts.
- Your bookkeeper enables an AI meeting assistant.
- An employee uploads a spreadsheet because AI can analyze it much faster.
They aren’t trying to do anything wrong. They’re trying to work efficiently. The problem is that nobody stopped to decide what the rules were.
Your Existing Software May Be Using AI Too
AI isn’t always a separate tool someone intentionally signs up for. Software companies are adding AI functionality to the programs businesses already use.
- Meeting platforms.
- Customer relationship management systems.
- Accounting software.
- Project management tools.
- Cloud storage.
That can be enormously helpful.
But an AI feature may also need access to your data in order to work.
So periodically take inventory. What software does your business use? Which programs now include AI functionality? Which features have been enabled? What information can those features access?
You may discover that your business adopted AI without anyone ever consciously deciding to “adopt AI.”
Don’t Forget Vendors
Then there are the technology vendors themselves.
Before adopting a new AI-enabled service, consider what information you’re allowing it to access and what the provider does with that information. A tool that helps you rewrite an occasional paragraph presents a very different risk from an AI application with access to your entire email account, CRM, customer database, or cloud drive.
Access should be intentional.
A Human Needs to Stay in Charge
AI helps get the work done faster and more efficiently. But businesses shouldn’t quietly allow important decisions to migrate from humans to algorithms without realizing it. Be especially cautious if AI is being used to evaluate job applicants, assess employees, determine compensation, decide who receives a particular opportunity, or make other consequential decisions about people.
AI can assist.
But a human should remain accountable.
Start Asking the Question
You don’t need to conduct a forensic investigation into every application your business uses. But you should know, at least generally:
- Who is using AI on behalf of my business?
- Which tools are they using?
- What information are they giving those tools?
- Which business systems can those tools access?
- What are they relying on AI to decide or create?
If you don’t know the answers, that’s not a reason to panic.
It’s a reason to have a conversation.
Because AI use in your business shouldn’t happen entirely by accident.
©2026 Cheri D. Andrews, Esq. This material is informational only and does not constitute legal advice. This material does not create an attorney-client relationship between Cheri D. Andrew, Esq and the reader. Recipient should consult with counsel before taking any actions based on the information contained within this material.
