Managing shadow AI in your team

How managers can recognise staff use of unapproved AI tools, why banning alone fails and how to offer safe alternatives and clear guidance.

What shadow AI is

Shadow AI means staff using AI tools for work without approval or outside the rules. An officer pastes a long report into a free chatbot on their phone to get a summary. An assistant uses an AI app to translate a citizen's letter. A section officer drafts replies with a personal account.

Most people doing this are not careless. They are trying to keep up with heavy workloads. The tools are free, fast and easy. The risk is that official or personal information leaves the office without anyone knowing. See data leakage.

Why it matters to you as a manager

Data protection. Citizens' details, draft decisions or sensitive files may end up on servers outside your control.
Accuracy. Unchecked AI output can contain invented facts or rules that reach files and letters.
Accountability. If something goes wrong, no record shows what the tool did.
Fairness. Some staff get help others do not. No one is learning together.

Recognising it

You will rarely see it directly. Look for signs such as:

drafts that arrive much faster than usual, in a noticeably different style
polished English or Urdu from staff who normally struggle with it
references or rules in drafts that no one can trace
staff photographing documents with personal phones
colleagues talking about "asking the app"

None of these proves anything on its own. Use them as a reason to have a conversation, not to accuse.

Why banning alone fails

A ban without alternatives usually pushes use out of sight. Staff still face the same workload, so they keep using the tools, only more quietly. You then lose the chance to guide them. Problems surface only after harm is done.

Bans also send the message that the office is not interested in better ways of working. That discourages staff from raising good ideas or reporting mistakes.

Some restrictions are still necessary. Classified material and citizens' personal data must never go into unapproved tools. The point is that a rule works better when it comes with a safe way to get the job done.

What to do instead

Talk openly. Ask your team which tools they use and for what. Make it clear you want to understand, not to punish past use.
Find out what problems they are solving. Long reports? Translation? Drafting replies? This tells you where help is needed.
Check what is approved. Ask your IT or information security focal person which tools, if any, are approved for official data. Follow any departmental instructions on AI.
Offer safe alternatives. Where an approved tool exists, help staff get access. Where none exists, agree which low-risk tasks may use public tools with no sensitive data.
Set simple written rules. One page is enough: what may never be entered, what tasks are allowed, how outputs must be checked and what to record on file.
Train people. Short, practical sessions on safe prompting and checking outputs reduce risk more than warnings.
Make it safe to report mistakes. If someone has pasted something they should not have, you need to hear about it quickly.
Review regularly. Tools and rules change. Revisit your guidance every few months.

A sample team rule

You may use [approved tool] for drafting and summarising non-sensitive material. Never enter classified documents, CNIC numbers, addresses or other personal details into any public AI tool. Check every output before use. Note on file when AI helped with official work.

Warning signs that your approach is not working

Staff deny using AI but drafts suggest otherwise
No one has ever reported a mistake
Your written rules have not been updated since they were issued
Requests for approved tools go unanswered for months