Skip to content
By Michael Rooney, CTO
Just this week, I was sitting with the management team of a client, discussing AI strategy. As part of the conversation, I asked a simple question.
“Who here uses AI tools?”
Nearly every hand in the room went up. Then I asked a follow-up question“Who uses them for work?”
There was a brief pause and a few nervous smiles as staff decided whether to disclose the truth. More hands were raised.
The interesting part wasn’t that employees were using AI. Whether they sit in junior or senior positions, we all know that is happening. The interesting part was that the leadership team seemed genuinely surprised by the scale of it.
That’s the reality of Shadow AI.
For many organisations, AI adoption is no longer something that will happen in the future. It’s already happening every day, often without formal approval, governance or oversight.
Employees are using ChatGPT, Claude, Gemini, Copilot, NotebookLLM, Grammarly and dozens of other AI-powered services to write emails, create presentations, analyse data, summarise documents and solve problems.
They’re doing it with the best of intentions; they want to be more productive and extract better business outcomes from their working day. But that’s where the real risk starts.
We’re Seeing The Unwelcome Return Of Shadow IT, Just In A Different Form
Anyone who has worked in technology for a while will recognise what’s happening.
Twenty years ago, IT departments were dealing with Shadow IT. Employees were using unauthorised personal email accounts, Dropbox, WeTransfer and unapproved SaaS applications to get work done faster.
Shadow AI is the modern version of the same problem, but with potentially much bigger consequences.
When someone uploads a confidential spreadsheet to an AI platform, they are not just sharing a file.
They may be sharing payroll information, customer records, commercial data, intellectual property or sensitive business knowledge.
The challenge is that most employees don’t see it that way.
They see a useful tool that can save them thirty minutes.
That’s what makes Shadow AI so difficult to manage. It doesn’t arrive through malice. It arrives through convenience.
Employee
Confidential file
Unassessed Al platform
The Risk Isn’t AI
The risk is not AI in itself. The risk is uncontrolled AI.
I’ve seen people use AI to rewrite disciplinary letters, review board meeting minutes, improve tender responses, analyse customer databases and examine financial spreadsheets.
Is that automatically bad?
No.
Is that automatically safe?
No.
Context matters.
The questions organisations should be asking are:
What tool is being used?
Is it a consumer version or an enterprise version?
Where is the data going?
Is the data retained?
Can it be used to train models?
Is there an audit trail?
Is there a data processing agreement in place?
Can the organisation apply governance controls?
The Data Privacy Issue Is More Serious Than Most Companies Realise
One of the things that concerns me most is that many organisations are focused on AI productivity gains without first understanding the data governance implications.
I’ve seen examples where employees upload:
HR information
Customer databases
Financial Reports
Security configurations
Source code
Tender documentation
The employee is usually trying to solve a genuine business problem. The issue is that they may be exposing sensitive information to a platform that the organisation has never assessed or approved.
In many cases, the manager sitting ten feet away has no idea it is happening. That’s why I believe many organisations are underestimating their exposure.
When I speak to leadership teams, I often find they’re discussing future AI projects while Shadow AI is already active across the business.
Governance has not caught up with reality.
Banning AI Is Not A Strategy
Some organisations are responding by trying to ban AI outright. This is neither realistic nor a practical course of action. AI is already embedded in the way people work. It’s on corporate devices, personal phones, home computers and increasingly inside the applications employees use every day.
You can block websites. You can restrict access on company devices. You cannot eliminate AI from the workplace. Patterns of technology adoption have proven time and time again that bans rarely change behaviour. They simply drive the banned activity underground.
On the other hand, organisations that ignore the issue altogether are leaving themselves exposed.
The answer isn’t prohibition. It’s governance.
Ban it
Drives use underground. Visibility disappears, risk doesn’t.
Govern it
Keeps use visible, adds approval, audit and clear boundaries.
The Companies Getting This Right Are Taking A Different Approach
Organisations we work with have stopped asking which AI tool they should buy. Instead, they’re asking a much more important question:
“What outcome are we trying to achieve?”
That changes the conversation.
The reality is that different AI tools excel at different tasks. One tool might be excellent for presentation creation. Another might be stronger at research. A third might be better suited to process automation.
Too many organisations start with technology selection. They buy licences first and ask questions later.
The better approach is to identify the business challenge, define the outcome and then determine which tools are appropriate and how they should be governed.
The technology should serve the objective, not the other way around.
What Companies Should Do Right Now
The good news is that organisations don’t need to solve everything overnight. But they do need to start.
Based on the conversations we’re having with clients, there are five immediate actions every management team should consider.
Understand
Policy
Training
Protect data
Human review
Before introducing new AI tools, understand what employees are currently using. The answer might surprise you.
Run workshops. Ask questions.
Create an environment where people can talk openly about the tools they’re using and the problems they’re trying to solve.
Many organisations discover that staff have already identified opportunities for organisational improvement that leadership teams haven’t considered.
Visibility has to come first.
An AI policy should not be a twenty-page document full of legal language that nobody reads.
It should clearly explain:
- Approved tools
- Prohibited activities
- Acceptable use cases
- Data handling requirements
- Approval processes
- Incident reporting procedures
Employees need clarity.
If people don’t know where the boundaries are, they will create their own.
In my view, training is almost more important than the policy itself.
A policy can sit unnoticed on an intranet. But training changes behaviour.
Employees need practical examples of safe and unsafe AI usage.
For example, uploading a payroll spreadsheet and asking AI to identify anomalies introduces unnecessary risk.
Describing the business problem and asking AI to generate a formula to identify duplicate payroll entries for example is a completely different scenario. The distinction matters.
Good governance comes from informed employees, not restrictive documents.
Every organisation should know where its most sensitive information resides.
That includes:
- Customer information
- Financial records
- Employee data
- Contracts
- Intellectual property
- Credentials
- Source code
Once identified, that data should be classified and protected.
Modern data protection tools can help organisations monitor, block or warn when sensitive information is being shared inappropriately.
You can’t protect what you can’t see.
AI can accelerate work dramatically. It can also make mistakes.
That’s why human oversight remains critical.
Whether it’s finance, legal, HR or operations, subject matter experts still need to validate AI outputs before decisions are made.
The organisations seeing the greatest success are treating AI as an augmentation tool, not an autonomous decision-maker. Human judgement remains essential.
The Bigger Opportunity Is Still Ahead
With all the discussion around risk, it’s important not to lose sight of the opportunity. The biggest gains from AI won’t come from generating better emails. They’ll come from removing operational bottlenecks.
Think about the repetitive processes that consume hours every month:
Invoice reconciliation
Reporting
Data extraction
Document processing
Customer enquiries
Workflow administration
These are the areas where businesses can unlock significant value.
The organisations that move fastest won’t necessarily be the largest.
They’ll be the organisations that combine governance, data control and a clear understanding of where AI can make a measurable impact.
That’s where the real transformation happens.
The Clock Is Ticking
Many leadership teams still see AI as a future challenge. It isn’t. It’s a current reality.
Employees are already using these tools. Sensitive information has already been entered into systems that many organisations know little about. Shadow AI is already operating inside countless businesses across Ireland and beyond.
That doesn’t mean organisations should panic. It means they should act. Put guardrails in place.
Understand where your data lives.
Educate your people.
Create clear policies.
Start with business outcomes.
Because the companies that succeed over the next few years won’t be the ones that ban AI, and they won’t be the ones that ignore it.
They’ll be the ones that govern it properly. The risk isn’t artificial intelligence. The risk is allowing it to operate in the shadows.
Book an AI governance consultation
Talk to one of DNA’s governance experts.