Set team rules for AI tools and company data

Shadow AI is staff use of AI tools the organization has not approved or cannot see, such as personal accounts on consumer chat assistants or a meeting note-taker someone signed up for.

People use these tools because they save time. A ban removes the visible path, not the need: use moves to personal accounts and devices, where the organization cannot see or delete what went in, and people stop asking questions.

What works better is an approved tool for common tasks, short rules written as tasks, a fast exception path, training, and a review date (NIST's Generative AI Profile suggests acceptable use policies and approved provider lists). A ban can still fit one data class or one tool: say exactly what it covers.

Pasted text and uploaded files go to the provider's servers. A model call does not remember earlier chats by itself (LLM Foundations Easy), but the service keeps copies: chat history, abuse-check logs, uploaded files, shared links, exports, and memory features.

Depending on the terms, chats may also be used to improve future models. Under most terms, deleting a chat stops future use; it does not undo use already made.

Who holds the account controls these copies: on a personal account, the person under the provider's consumer terms; on a contracted account, the organization's contract and admins.

Outputs carry data too: a summary of a client letter is still client data.

Use three to five classes that staff can remember. If the organization already has one for email and file sharing, reuse it rather than invent a second scheme for AI.

A file takes the class of its most sensitive item: one bank account number makes a whole letter that sensitive. Content nobody has checked counts as the highest class it could contain until a person checks it.

Two kinds of data need extra care:

• Special categories of personal data, such as health information (GDPR Article 9).
• Data you hold for a client, whose contract may limit who else handles it. Under GDPR Article 28(2), a processor (who handles personal data for someone else) needs the controller's (who decides why and how it is processed) prior written authorization to engage another processor. Check with counsel how this applies.

Ask the same questions of every tool:

Read the contract or business terms, not the marketing page: one provider can offer consumer and business plans with different terms (Sources has a dated example). Training use and retention are separate questions; a tool can promise no training and still keep copies.

Then place each tool in a tier: not approved (no contract with the organization), approved with limits (contracted and reviewed for named classes), or system of record (existing software that already holds the data, with any AI feature reviewed along with it). Re-check any new feature or connector in an approved tool.

For each class, decide which tiers it may enter and write down why. IT, the data protection officer, and counsel confirm the terms; the lead turns them into team rules.

Give the tool only what the task needs: the paragraph, not the whole file; the totals, not the customer list. GDPR Article 5(1)(c) calls this data minimisation: personal data must be "adequate, relevant and limited to what is necessary".

Redaction means removing identifiers before upload, then checking the copy you actually upload. It often misses:

• scanned pages, where the text is part of an image;
• headers, footers, file properties, and attachments;
• hidden spreadsheet columns or tabs;
• the tool's output, which can repeat what went in.

Removing a name is not anonymization: other details can still single out a person or a client, so the data keeps its class (Responsible AI Easy covers this for one system).

Write rules as tasks staff recognize, on one page: "You may turn your own notes into a checklist in the approved assistant." Every "not allowed" names what to do instead: an existing system, a template, or a person to ask.

People stay accountable for outputs. The tool can be fluent and wrong, so check every figure and statement before it reaches a client.

An exception path says who to ask and what to send (task, data, tool, reason), who decides and how fast, and that the decision is recorded, limited to that task, and revisited at the next policy review.

The rules cover contractors and temporary staff too, as NIST's Generative AI Profile suggests for acceptable use policies.

New rules usually uncover past use. A no-blame reporting window turns hidden risk into known facts; disciplining the first person who reports stops all reports.

For each report, collect the tool and plan, the data and how much, the dates, the training setting, and any shared links.

Escalate the same day to whoever decides on data protection, usually the data protection officer (DPO) or counsel. Unauthorized disclosure of personal data can be a personal data breach (GDPR Article 4(12)), and deadlines can be short. Under GDPR Article 33, a controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people; a processor tells its controller without undue delay. The lead does not decide whether a case is reportable.

Then delete chats and turn off training settings as directed. That stops future use; it cannot undo use already made.

Training. Short, role-based, and before the rules start: what the tools get wrong, the classes with the team's own examples, redaction, checking outputs, and how to report a mistake or an exposure. Record who attended.

EU AI Act Article 4, as of November 2026. Article 4 (AI literacy) has applied since 2 February 2025. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since July 2026, replaced its text: providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff and others using AI systems on their behalf, suited to their knowledge and the context of use. No specific level or certificate is required (Commission Q&A), and national authorities enforce it from 2 August 2026. An organization whose staff use AI tools for its work is generally a deployer; check with counsel how it applies.

Checks. Match the effort to the harm: an approved tool's usage log, a repeated anonymous survey, and spot checks of a few tasks with the person who did them. Add technical blocks only where harm is highest. Reading staff chats is employee monitoring, with its own legal and trust issues: agree it with HR and the DPO first.

Review. A fixed date, a named owner, and triggers for an earlier review: a new tool or feature, a change in terms, a check result, an incident, or a client instruction.

Use the firm's classes and the two tools' terms to decide where each task may run, then reveal.

Work through the first day after a report, then reveal.