Have you ever pasted a work document into ChatGPT to fix the wording, without asking anyone if that was allowed? You are far from alone. That quiet habit now has a name, shadow AI, and it has become one of the fastest growing security worries inside companies.

This guide explains what shadow AI is in simple words, why employers are nervous about it, and how you can keep using AI at work without putting your job or your company’s data at risk.

What is shadow AI?

Shadow AI means using AI tools at work that your employer has not approved or cannot see. The name comes from “shadow IT,” an older term for unapproved apps and software that employees install on their own.

A few everyday examples:

• Pasting a customer email into a free chatbot to draft a reply
• Uploading a work spreadsheet to an AI tool to analyse it
• Using a personal ChatGPT, Gemini, or Claude account for office tasks
• Letting an AI note taker join meetings without approval

None of this feels like breaking rules. Most people are just trying to work faster. That is exactly why shadow AI has spread so quickly.

How common is it?

Very. Verizon’s 2026 Data Breach Investigations Report found that 45 percent of professionals now use AI at work regularly, and 67 percent of those people access it through personal accounts their IT team never approved.

Security company Netskope reports the same pattern in its 2026 Cloud and Threat Report: 47 percent of workplace AI users rely on personal accounts, and the number of incidents where sensitive data was sent to AI apps doubled in one year.

Why is shadow AI risky?

The problem is not the AI itself. The problem is where the data goes.

When you paste company information into a personal AI account, it leaves your company’s systems and lands somewhere your employer cannot see, protect, or delete. Depending on the tool and your settings, it may be stored on outside servers or even used to train future models.

Netskope’s data shows what actually leaks. The top three types were source code (42 percent of violations), regulated data such as personal and health information (32 percent), and company intellectual property (16 percent). Verizon found that 28 percent of data-loss incidents involved someone pasting source code into an AI tool.

From my own work around websites and cybersecurity, this is the part people underestimate. A single pasted contract or customer list is invisible the moment it leaves. There is no alarm, no warning, nothing to undo. If that data ever surfaces somewhere it should not, the company may never even trace how it got out.

What you should never paste into a chatbot at work

A simple rule: if you would not email it to a stranger, do not paste it into a personal AI account. That includes:

• Customer names, emails, and account details
• Contracts, financial figures, and internal reports
• Source code, passwords, and API keys
• Health records or anything covered by privacy law
• Anything marked confidential or internal only

Tip: Before you paste anything into an AI tool at work, ask one question. Would I be comfortable if this text appeared outside the company? If the answer is no, strip out the sensitive details first or do not paste it at all.

Why company AI accounts are different

There is a real difference between personal and business AI accounts. On OpenAI’s business and enterprise plans, for example, your inputs are not used to train models by default, and admins control how long data is kept. Free personal accounts work differently, and training settings are often on unless you turn them off.

So if your company offers an official AI tool, use that one for work tasks. It exists precisely so you get the productivity boost without the data risk. We covered the personal side of these settings in our guide on how to use AI safely and protect your privacy, and how chatbots store what you tell them in how AI memory works.

How to use AI at work without the risk

You do not need to stop using AI. You need to use it in the open. A few habits make the difference:

• Ask what your company’s AI policy is. If there is none, ask your manager what is acceptable.
• Use the company-approved AI account for work content, not your personal one.
• Remove names, numbers, and identifying details before pasting text into any chatbot.
• Be careful with AI meeting tools too. Our guide on AI meeting assistants explains how recording and consent should work.
• If you find a tool that really helps, suggest it to IT instead of hiding it. Many companies approve useful tools once they can review them.

If you are new to all of this, our beginner explainer on what AI actually is is a good place to start.

Common Questions

Is shadow AI illegal?
Usually not illegal, but it can break your employment contract, company policy, or data protection law depending on what you share. The consequences land on both you and your employer, so it is worth taking seriously.

Can my employer see if I use a personal chatbot?
Often yes, at least partly. Many companies monitor network traffic and can see which AI services are being accessed from work devices, even if they cannot read your exact prompts.

What if my company has no AI policy at all?
That is common. Ask before assuming. A short message to your manager or IT team protects you, and it often pushes the company to finally write clear rules.

Final takeaway

Shadow AI is not about bad people doing bad things. It is about helpful tools being used in the dark. The fix is simple: keep sensitive data out of personal AI accounts, use approved tools where they exist, and ask when you are not sure. You get the best of AI, and nobody gets a nasty surprise.