Your Team Is Already Using AI. You Just Don't Know Which One.

A finance manager pastes a quarterly forecast into a free chatbot to clean up the formatting. A marketing coordinator runs customer feedback through a personal Claude account because the company-approved tool can't read PDFs. An engineer asks ChatGPT to debug a snippet from production code.

None of them think they're doing anything wrong. They're trying to finish work.

That's shadow AI. And by every recent count, it's already inside your organisation.

The number is bigger than you think

78% of workers using AI on the job report using tools their employer didn't provide, according to a July 2025 WalkMe survey of 1,000 working adults. Microsoft's 2024 Work Trend Index put the BYOAI (Bring Your Own AI) figure at the same 78%, climbing to 80% at small and medium-sized firms.

These aren't junior staff messing around. They're people across every department reaching for tools that make their jobs faster.

The instinct from leadership is usually the same: write a policy, restrict the tools, run a compliance training. Then everyone nods, closes the deck, and quietly keeps using ChatGPT on their phone.

Why bans don't work

Shadow AI is what happens when official tools can't keep up with daily work.

People aren't using personal chatbot accounts because they're rebellious. They're using them because the sanctioned alternative is missing, slow, or doesn't do what they need. When IBM's 2025 Cost of a Data Breach Report looked at this, it found that 97% of organisations that suffered an AI-related breach lacked proper AI access controls. The breaches weren't from clever attackers. They were from employees using whatever was available.

Bans push the usage underground. They don't reduce it.

The healthcare sector ran a useful experiment on this. When one health system rolled out sanctioned AI tools alongside training, unauthorised AI use dropped by 89%. The behaviour didn't disappear. It moved into tools the security team could actually see.

Shadow AI is demand signal

Here's the part most leaders miss. When an employee opens a personal AI account on their own time and pays $30 a month out of pocket to do their job better, that's not a security failure. That's a procurement signal.

They've already done the evaluation work. They've identified the workflow that's broken. They've found a tool that fixes it. The only thing missing is sanction.

At Kursol we treat this signal the way a good ops team treats a shadow IT spreadsheet: as evidence that someone, somewhere, has a clearer view of the work than the people approving the tools. The right move is to ask which workflow they're trying to fix, not to ask why they didn't follow process.

This is the same logic behind why we build AI that augments teams rather than replacing them. When people pick up AI on their own initiative, they're showing you exactly where their work needs help. Suppressing that signal costs you twice: once in surfaced risk, and again in the productivity you never capture.

The real cost of doing nothing

If you'd rather frame this as a risk story, the numbers cooperate.

IBM's 2025 report found that breaches involving shadow AI added an average of USD $670,000 to the cost of an incident — $4.63M versus $3.96M for breaches without a shadow AI component. One in five breached organisations had a shadow AI link.

Only 37% of organisations have AI governance policies in place at all. The other 63% are running on hope.

For Australian SMEs the local rules matter too. The Privacy Act amendments passed in late 2024 are now in force, with new statutory tort and automated decision-making transparency rules. If your team is putting customer data into a personal chatbot, you've already touched APP 6 and APP 11. Add the EU AI Act enforcement powers that begin on 2 August 2026 and any AU business with European customers sits inside two regulatory regimes at once.

Doing nothing isn't neutral. It's just a slower way of getting caught.

What actually works

A workable response has three moves, in order.

1. Find out what people are already using. Not by threatening them. By asking. Run a no-blame survey. Tell people the goal is to fund the tools they need, not to discipline anyone. You'll get honest answers because the alternative — continuing to hide — costs them effort.

2. Sanction the most-used tools first. Pay for the enterprise version of whatever 60% of your team is already on personally. Configure data retention. Turn on SSO. The hard work is policy and contract, not technology. Most of the popular consumer tools have a Teams or Enterprise tier that solves the data-handling problem cleanly.

3. Build the missing pieces. The workflows that don't have a clean off-the-shelf tool — that's where custom matters. A sales team that wants AI inside their CRM. An ops team that needs AI grounded in internal SOPs. This is where augmentation gets real, and where shadow AI is loudest because the gap is biggest.

A good policy comes after the tools, not before. Policies written without knowing what people actually use are theatre.

Position before you regulate

Shadow AI tells you two things. First, that AI is already part of how your business runs. Second, that the people doing the work have a clearer picture of what helps than the people writing the policy.

Stop treating that as a problem to suppress. Start treating it as a roadmap.

The organisations that win the next eighteen months will be the ones whose employees never had to hide what they were already doing.

FAQ

Is shadow AI illegal in Australia?

Using consumer AI tools at work isn't illegal in itself. The risk sits in what data goes into them. If employees paste customer records or anything covered by the Privacy Act into a personal account, the organisation carries the liability. The recent Privacy Act amendments tighten this further around automated decision-making transparency. Australian SMEs selling into the EU also need to factor in the EU AI Act enforcement powers from August 2026.

How do I find out what AI tools my team is actually using?

Ask, don't audit. Send a short anonymous survey framed as "we want to fund the tools you need." Threats produce silence. Permission produces a list. Pair that with SaaS spend reviews and a look at OAuth grants in your Google Workspace or Microsoft 365 admin console.

Should we just ban personal AI accounts at work?

Bans don't reduce usage, they hide it. Organisations that provide sanctioned alternatives see unauthorised use drop by close to 90%. Organisations that issue bans without alternatives see usage continue at almost the same rate, just on personal devices. Provide the tool, then write the policy.