An employee wants to summarize a proposal, clean up a spreadsheet, or draft a customer response. Before anyone has decided which AI tools the business should use, that employee opens a personal account and gets to work.

The intention may be reasonable. The business still needs to know which service is being used, what information is going into it, and who is responsible for checking the result.

That gap between employee adoption and company oversight is the problem behind shadow AI: work moving through personal or unmanaged AI tools outside the approved environment (Netskope’s shadow AI analysis). The intention may be productivity, but the business still needs a way to approve and oversee that work.

Why shadow AI deserves attention now

This is not just a theoretical concern. In its March 2026 AI Index article, Netskope reported that weekly AI application use in its observed enterprise population had grown from 19% to 44% of employees in a year, while 12% of enterprise users were bypassing approved tools for personal AI apps or instances each week (Netskope AI Index).

Those figures come from aggregated, anonymized activity across Netskope’s platform, not a survey of Dallas–Fort Worth small businesses, so they should not be treated as an estimate of what is happening in your company (Netskope’s methodology). They do give business leaders a reason to ask about actual use rather than assume an approved-tool list tells the whole story.

My recommendation is straightforward: find out how your employees want to use AI before writing a policy that does not match their work. A rule is easier to follow when people understand it and have a useful approved alternative.

What shadow AI can look like in an ordinary workday

Consider these hypothetical situations. They are examples to discuss with your team, not claims about any 48 Technologies customer:

Customer correspondence: An employee pastes an email thread into a personal AI account to draft a reply, without checking whether customer details are permitted.
Financial analysis: A manager uploads a forecast to a tool that has not been reviewed for that information or task.
Meeting notes: Someone enables an AI recording or transcription feature without confirming approval, participant expectations, or retention requirements.
Connected applications: An employee authorizes an AI assistant to access company files without a review of the permissions.
Subscriptions: Several departments buy overlapping AI tools without a named owner or shared spending review.

The useful question is not simply whether employees use AI. Ask which accounts they use, what tasks they perform, what information they submit, and whether any business systems are connected.

The risks are broader than data leakage

Information handling deserves attention, but it is not the only issue. A practical review should cover the service, the workflow, and the business decision that follows.

Where company information goes

Do not approve an AI workflow based on a brand name alone. Evaluate the particular account type, service terms, settings, and intended information before deciding what employees may submit.

Ask about retention, use of inputs, administrative access, and account ownership. Do not assume every paid subscription has the same protections or controls.

Who checks the answer

Treat AI-generated work as a draft that needs an appropriate reviewer. For a customer response, that may mean checking factual statements and commitments; for a financial summary, it may mean reconciling the figures to the original records.

Decide who performs that review before the workflow becomes routine. The employee or manager responsible for the business decision should remain accountable for it.

Who owns access and spending

Include AI accounts in access-removal and purchasing reviews. Ask who can remove a departing employee, revoke a connection, manage billing, and explain what a subscription is used for.

Review overlapping subscriptions before buying more. Where an existing approved service meets the need, start there rather than adding another tool by default.

A practical response: approve the workflow, not just the tool

I would not start with a long list of AI products or a promise that one platform will solve everything. Start with a small number of useful tasks and define the boundaries clearly.

Understand current use: Ask employees which tools and AI features they use, which account types they have, and what broad categories of information are involved. Do not ask them to reproduce confidential prompts or send customer documents as part of the inventory.
Choose an accountable owner: Give employees a clear person to contact about approval, exceptions, and accidental submissions.
Define permitted information: Explain what can be used, what requires review, and what must not be submitted. Use synthetic examples rather than sensitive business records.
Review accounts and connections: Check ownership, authentication, access removal, permissions, and the actual service arrangement.
Assign human review: Name the reviewer and the checks required before an output reaches a customer or informs a consequential decision.
Set spending boundaries: Identify who can buy tools, who reviews usage, and when a subscription should be renewed or stopped.

Pilot one narrow workflow with a small group before expanding it. Measure whether the reviewed output is useful, how much correction it needs, and whether the boundaries are understandable.

AI governance belongs alongside everyday IT management

Make AI approval part of the same operating discipline used for accounts, devices, permissions, and vendors. Include it in onboarding, offboarding, purchasing, and employee guidance rather than treating it as an isolated policy.

That is the perspective behind our managed IT approach: manage the environment as a whole instead of treating each tool as a separate problem. A layered cybersecurity approach should also inform how you evaluate access and information handling, without assuming that existing security software covers every AI workflow.

Where 48 AI fits

I also founded 48 AI to help businesses adopt AI securely, responsibly, and cost-effectively. If you are considering a managed approach, start by defining the workflow and evaluating the actual controls rather than choosing a platform on its name alone.

The 48 AI guide to shadow AI and governed workflows explains the approach and its current limits: the platform is being developed with invitation-only early access, its initial pilot is planned around text workflows, and that scope excludes company-wide AI discovery, blocking outside AI websites, universal data-loss prevention, document uploads, connectors, and autonomous agents.

Keep that distinction in your evaluation. A managed workspace should be assessed as one part of a control environment, not treated as a replacement for broader IT oversight.

Start with visibility, not panic

You do not need to solve every AI use case at once. Start by asking where AI is already being used, which uses need to pause for review, and which useful workflow you can approve with clear boundaries.

The goal is not to stop employees from finding better ways to work. It is to make those improvements deliberate, accountable, and manageable.

If you need help deciding how AI use fits into your existing IT and security environment, discuss your IT environment with 48 Technologies. We can start with the operating questions before you commit to another subscription.

Shadow AI: When Employees Adopt AI Before Your Business Does