A staff member wants to summarize a spreadsheet before a meeting. The approved tool is unfamiliar, so they open another assistant in a personal account and upload the file. Nothing visibly breaks. The summary is useful. The organization may still have lost control of where the information went.
Shadow AI is often an ordinary workflow problem: people need a faster way to work and do not know which route is approved. A useful policy gives them a decision they can make before uploading, plus a practical alternative when the answer is unclear.
Start with the task and the information, not whether the tool has an impressive brand name or a “private” button.
Check the Account, Data, and Destination
A personal account and an organization-managed account can have different contracts, administrative controls, and handling terms. Verify the exact service and account type approved for the work. Do not infer approval from a paid subscription or a familiar sign-in screen.
The NIST Generative AI Profile discusses privacy and information security risks associated with generative AI. Your organization’s data rules should translate those broad concerns into specific permitted uses.
| Before uploading, ask | If you cannot confirm |
|---|---|
| Is this exact service and account approved? | Use the approved route or request review |
| Am I authorized to share this information for this purpose? | Ask the data owner |
| Does the file contain personal, customer, legal, financial, or security-sensitive information? | Apply its handling requirements before proceeding |
| Do retention, deletion, and support access meet our requirements? | Have the service owner verify the terms and settings |
| Will connectors or extensions receive access? | Review their permissions separately |
| Where will the output go, and who will verify it? | Define review and storage before creating it |
A “no training” statement answers one question. It does not by itself resolve retention, access, contractual restrictions, regional processing, or the handling of connected services.
Use Less Information for the Same Job
Often the model does not need the original file. If you need a spreadsheet formula, provide invented column names and synthetic values. If you need an outline, describe the document’s purpose without customer details. If you need editing help, use an approved excerpt after reviewing it for sensitive information.
Removing a person’s name may not be enough. Dates, rare events, account references, locations, and combinations of details can still identify someone. Redaction must follow the organization’s process, and some information should remain entirely within an approved environment.
Do not paste passwords, API keys, session cookies, recovery codes, or private keys into a general assistant. Use the established secret-management and support process instead.
Treat Connectors as Access Decisions
Connecting an assistant to email or files is more consequential than pasting one paragraph. Identify what it can read, which identity it uses, whether it can write or send, and how access ends.
For example, Microsoft’s Copilot data privacy and security guidance explains that organizational information is surfaced according to existing user permissions. That makes correct underlying permissions important. An approved assistant is not a substitute for reviewing overshared folders.
Review the actual product and tenant configuration before relying on a feature. Different AI services and connected tools have different boundaries, and product controls can change.
Give Employees a Safe Request Path
Copy this request when the approved route is unclear:
I want help with this task:
The information types involved are:
The data owner is:
The proposed AI service and account type are:
The minimum input needed is:
The expected output and intended audience are:
Connectors, extensions, or write actions requested:
Human review and storage plan:
Can we use an approved tool, a synthetic example, or a smaller
redacted input? Please confirm the permitted approach before upload.Avoid attaching the sensitive file to the request unless the request channel is approved for it. A short description is often enough for initial triage.
If information has already gone to an unapproved service, report through the established incident or privacy channel. Preserve the service, account, timing, and information category. Do not hide the event or assume deletion of a chat establishes removal from every system.
Make the Approved Route Easier to Follow
Publish a short list of approved services, allowed data categories, prohibited uses, and contact owners. Provide examples from real work without exposing sensitive records. Review recurring requests to identify where the organization needs a better supported workflow.
Explore the AI Hub and Private AI readiness for the broader planning questions.
Book an AI data-boundary conversation. Bring one recurring task and the information your staff currently needs to handle.