The Unlisted Risk: Governing Employee Use of Generative AI

Generative AI has arrived in UK workplaces through the browser tab, not always through procurement. An employee summarises a contract, drafts a client email, reviews a spreadsheet or asks a chatbot to explain a policy. The tool may be free, convenient and outside any approved supplier arrangement. This is shadow AI, and it deserves a place on the board risk register.

The issue is not that staff are curious about new technology. The issue is that unsanctioned AI use can move confidential information, personal data and intellectual property into services the organisation has not assessed. That is a data protection question, a commercial confidentiality question and, potentially, an incident response question.

Why shadow AI is a board-level data protection issue

UK GDPR does not pause because a tool is free or used informally. If an employee pastes personal data into an unsanctioned AI service, the organisation may still be the controller. It needs a lawful basis, transparent information, appropriate security and a written arrangement with its processors. It also needs to know where the data has gone and whether it can be retrieved or deleted.

Many consumer AI tools reserve broad rights over inputs or use them to improve models. Some transfer data across borders. Some retain conversations for review. The employee may see only a helpful answer; the board should see an unmanaged data transfer with contractual, regulatory and reputational consequences.

The risk is not limited to personal data. Draft strategies, pricing models, legal advice, source code and customer lists can all be commercially sensitive. Once disclosed to an external service, confidentiality may be difficult to restore.

The incident response angle

Shadow AI becomes an incident response matter when data is exposed, a supplier suffers a breach, or an employee reports that sensitive information was uploaded in error. Without a register of approved tools and a clear reporting route, the organisation may not know what was sent, to which service, or when.

A proportionate playbook should answer basic questions. Who receives the report? How is the tool identified and access contained? What records are preserved? Is the supplier contactable? Does the incident meet the threshold for notification to the Information Commissioner's Office within 72 hours? What does the organisation tell affected clients or staff?

These questions are easier to answer before an incident than during one. The board does not need to manage the technical response, but it should ensure that shadow AI is included in incident scenarios and that management can describe the organisation's exposure.

A proportionate governance model

Governance should make safe use easier, not simply ban tools and hope for compliance. A workable model has five connected parts.

1. Acceptable-use rules

Set clear, short rules with practical examples. Staff should know which information may never be entered into an unsanctioned tool, which tools are approved for which purposes, and what to do if they are unsure. Rules should be written for the whole organisation, not only for technical teams, and should be reflected in contracts, policies and training.

2. Data classification

Most organisations do not need an elaborate taxonomy. A simple set of tiers — public, internal, confidential and restricted — is enough to guide behaviour. Restricted personal data, client secrets and unpublished financial information should not be placed in general-purpose AI tools. Approved enterprise tools may be suitable for some confidential work, but only where the contract, security and retention terms support it.

3. An approved-tool route

If every AI tool is prohibited, staff may use them anyway. A better approach is to provide a sanctioned route. That means assessing a small number of tools, completing data protection impact assessments where required, agreeing contractual terms, configuring retention and training controls, and publishing clear guidance on appropriate use.

4. Monitoring and discovery

Organisations need reasonable visibility of AI use without turning the workplace into a surveillance operation. Network logs, cloud access security brokers, software discovery tools and expense records can reveal unsanctioned services. User reporting should be encouraged, with a no-blame route for honest mistakes. Monitoring should be proportionate, transparent and consistent with employment law and internal policies.

5. Board reporting

A quarterly dashboard can be modest but useful: approved-tool adoption, blocked or flagged attempts, reported shadow AI incidents, training completion and open exceptions. The board should see trends, not a false assurance that the issue has disappeared. Material incidents should be escalated through the existing incident response process and, where appropriate, reflected in cyber insurance notifications.

Making the model stick

Policy alone will not change behaviour. Staff need to understand why the rules exist and what good practice looks like. Managers need to model approved use. Procurement and IT need a fast route to assess new tools. Legal and data protection teams need to be involved early, not asked to approve a fait accompli.

It is also worth testing the organisation's response. A tabletop exercise that begins with an employee uploading a client database to a chatbot can reveal gaps in detection, escalation, supplier contact and regulatory assessment. Those gaps are better found in a rehearsal than in a real incident.

Shadow AI is not a reason to resist productivity gains. It is a reason to govern them deliberately. For UK boards, the practical question is simple: if a member of staff used an unsanctioned AI tool tomorrow, would we know, would we be able to respond, and could we evidence that our oversight was proportionate? If the answer is uncertain, the risk belongs on the register.