When Staff Were Already Using AI: The Shadow AI Wake-Up

The situation

An education sector not-for-profit supporting adult learners ran an anonymous pulse survey to understand how staff were using technology. The results were uncomfortable. Eleven of eighteen staff reported using personal-account AI tools for work purposes. Three had pasted student names and contact details into a free public AI tool when drafting communications.

No one had told them not to. There was no policy.

What they did

The organisation responded without blame. Management framed the survey results internally as a system failure, not a staff failure: people use the tools available to them to do their jobs. The problem was not staff behaviour — it was the absence of guidance.

Within four weeks, the organisation had: a list of approved AI tools that staff could use for work (with specific guidance on what data could go in), a use register where staff logged what tools they were using and for what purpose, and a mandatory thirty-minute training module for all staff covering AI basics, data privacy, and the organisation's approved-tools list.

The anonymous pulse survey tool — which had surfaced the problem in the first place — was flagged on the organisation's intranet as a way for staff to raise future AI concerns without identifying themselves. Other organisations looking to run a similar check can use the AITAI Shadow AI Pulse Survey.

What it cost

The approved-tools list and use register were maintained in a shared spreadsheet — no cost. The training module was developed internally with approximately half a day of staff time. The anonymous pulse survey used a free-tier tool.

What the board did

The CEO reported the survey findings to the board at the next meeting and presented the response plan. The board endorsed the no-blame approach and approved the policy framework. They asked to see the results of the next pulse survey in six months.

The outcome

Staff who previously avoided AI tools now use approved ones confidently. The use register shows healthy, spread AI tool use across teams. No further incidents of sensitive data in public AI tools have been identified since the policy was implemented. Staff now self-report questions and edge cases — a sign that the no-blame culture is holding.

Lessons for directors

• Shadow AI — staff using unapproved AI tools without telling anyone — is a policy failure, not a staff failure. The response is an approved-tools framework and clear guidance, not sanctions.
• Running an anonymous pulse survey before you have a policy in place is a low-cost, high-value governance action. You cannot govern what you cannot see.
• The no-blame response matters. Organisations that create a culture of safe reporting get earlier warning of AI-related risks than those that wait for incidents to surface formally.