Staff AI Use & Shadow AI Policy Compliance Check

Why this matters

“Shadow AI” is when employees use AI tools such as chatbots, transcription apps, or writing and coding assistants that the business has not approved or assessed. If staff paste customer details, employee records, contracts or commercially sensitive information into a public AI service, that can amount to a personal data breach or an unlawful disclosure under the UK GDPR and the Data Protection Act 2018. The business, as controller, remains responsible for the security of personal data under Article 32, for having a lawful basis and transparency under Articles 5, 6, 13 and 14, and for having a written contract with any processor under Article 28.

The risks go beyond data protection. Confidentiality clauses in client contracts, trade secrets, professional duties and the ICO’s guidance on AI and data protection all point to the same expectation: businesses should know which AI tools are being used, what goes into them, and who checks what comes out. AI-generated output can be inaccurate, biased or infringe third-party copyright under the Copyright, Designs and Patents Act 1988. A clear, short staff AI policy, an approved tools list and basic training are inexpensive ways to reduce regulatory, contractual and reputational exposure.

What you'll need

• A rough list of AI tools your staff use, including free and personal accounts
• Your current data protection, IT acceptable use and confidentiality policies
• Knowledge of whether any client contracts restrict use of third-party or AI tools
• Details of any AI features built into software you already pay for (e.g. meeting transcription)

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.