Shadow AI in a UK small business: why staff use their own accounts, and what to do in a week.
By Zain Masroor · 9 October 2026 · 10 min read
Shadow AI is staff using AI tools the firm has not approved, almost always personal ChatGPT, Claude or Gemini accounts, for work. It is the default state in most UK SMEs: CIPD found a majority of organisations allow generative AI at work while fewer than a third had developed a policy, and the consumer plans of the main assistants use conversations for training unless the individual opts out. Blocking fails, because the tools are useful and the block moves use to phones. The fix takes a week: business plans for everyone, a one-page policy with examples of what may and may not go in, two or three shared templates so the sanctioned tool is the easier one, a ninety-minute session per team, and the expensed personal subscriptions cancelled.
What it is and why it is everywhere
The ONS found 35 per cent of UK businesses with ten or more staff using at least one AI technology in June 2026; the CIPD found in 2025 that a majority of organisations allowed generative AI for work tasks and that only 31 per cent had developed a formal policy in the previous year. Between those numbers sits shadow AI: staff who have found that a chat assistant makes the boring half of the job faster and are using it on a personal account because nobody gave them a work one. The tools are good, the incentive is real, and the firm’s only contribution has been silence.
What it exposes
On the consumer plans of ChatGPT and Claude, conversations are used to train the models unless the user changes a setting, and retention sits with the individual, not the firm. So a client’s contract, a candidate’s CV, a patient’s letter or a supplier’s pricing pasted in for a quick summary is in a third party’s training data, on a personal account, with no data processing agreement, and the firm cannot answer a client who asks whether their data was used to train an AI model. It is also outside every control the firm has: no audit trail, no retention, no policy, and a leaver who keeps the history. None of that is the employee’s fault. It is the predictable result of not providing the tool.
Why blocking fails
Firms that block the assistants on the network discover three things. The use moves to phones, where the firm can see even less. The staff who were most productive with the tools are the ones most annoyed. And the block signals that the firm does not understand the work, which is the wrong message from a leadership team that will need the same staff to adopt the tools it eventually buys. The ICO’s guidance and the CIPD’s recommendation both point the same way: govern the use rather than pretend it is not happening.
The one-week plan
Five steps, one week, in this order.
What to measure a month later
Active seats in the last seven days from the admin console; the number of staff still on personal accounts, which should be zero and rarely is; and the first process where the sanctioned tool has measurably replaced the personal one. Our change-management guide sets out the six levers that decide adoption and the mistakes that undo it, and the rollout plan puts the whole month in order.
Common questions
What is shadow AI?
Staff using AI tools the firm has not approved for work, usually personal ChatGPT, Claude or Gemini accounts. It is the default state in most UK SMEs because the tools are useful and the firm has not provided them.
Is shadow AI a data protection problem?
Yes. Consumer plans use conversations for training unless the user opts out, there is no data processing agreement, the firm cannot see or control retention, and a client who asks whether their data trained a model cannot be answered.
Should we block ChatGPT on our network?
No. Use moves to phones, the most productive staff are the most annoyed, and the firm loses the credibility it needs for its own rollout. Provide business plans and a policy instead.
How quickly can shadow AI be fixed?
In a week: business plans bought and connected to single sign-on, a policy with examples, shared templates, a session per team, and the expensed personal subscriptions cancelled.
What does it cost to fix?
About £15 to £19 a seat a month on Claude Team or ChatGPT Business, or £16.10 for Copilot Business, plus a training session from £1,200. The personal subscriptions being cancelled offset part of it.
How do we know it worked?
Active seats in the admin console, nobody left on a personal account, and one process measurably moved to the sanctioned tool within a month.
Want the week run for you?
We set up the plans, adopt the policy, build the templates on your own documents and run the sessions, at a fixed price. Most firms are done inside five working days.