Staff AI Use & Shadow AI Policy Compliance Check

“Shadow AI” is when employees use AI tools such as chatbots, transcription apps, or writing and coding assistants that the business has not approved or assessed. If staff paste customer details, employee records, contracts or commercially sensitive information into a public AI service, that can amount to a personal data breach or an unlawful disclosure under the UK GDPR and the Data Protection Act 2018. The business, as controller, remains responsible for the security of personal data under Article 32, for having a lawful basis and transparency under Articles 5, 6, 13 and 14, and for having a written contract with any processor under Article 28.

The risks go beyond data protection. Confidentiality clauses in client contracts, trade secrets, professional duties and the ICO’s guidance on AI and data protection all point to the same expectation: businesses should know which AI tools are being used, what goes into them, and who checks what comes out. AI-generated output can be inaccurate, biased or infringe third-party copyright under the Copyright, Designs and Patents Act 1988. A clear, short staff AI policy, an approved tools list and basic training are inexpensive ways to reduce regulatory, contractual and reputational exposure.

This check reviews how staff use AI tools in your business and highlights the policy, contract and data protection gaps most likely to cause a leak or complaint, with practical fixes ranked by priority.