AI Policy for Employees: How to Handle Shadow AI at Work Without Banning It
Most of your team is probably already using AI tools you never approved. Here is how to write a practical AI policy for employees, reduce shadow AI risk and replace risky habits with tools that work.
If you run a company, there is a good chance your employees are already using AI at work: pasting emails into ChatGPT, summarising contracts, drafting offers. The question is no longer whether they use it, but whether you know how, with which data, and under which rules. An AI policy for employees is the short, practical document that answers those questions before a data leak does. This guide explains what shadow AI is, what the evidence says about how common it is, and how to write a policy people will actually follow.
What is shadow AI?
Shadow AI is the use of AI tools at work that the company has not approved, configured or even noticed: personal ChatGPT accounts, browser extensions, free transcription apps, AI features switched on inside other software. It is the same pattern as “shadow IT” a decade ago, with one important difference: the input is not a file on a shared drive but whatever a person chooses to type or paste, including customer data and internal documents.
Shadow AI rarely comes from bad intent. It comes from people trying to do a good job faster, with a tool that is open in another tab and a company that has not offered an alternative.
How common is it? What the data says
A 2026 survey by Wakefield Research for PagerDuty of 1,250 office professionals in Australia, Japan, the UK and the US (companies with at least $500 million in annual revenue, non-technical roles) found:
- 66% of workers who had used AI at work did so even though they believed it was not permitted by company policy.
- 43% had entered work correspondence into public AI tools, and 34% had entered customer data.
- 31% had entered financial information or confidential documents or strategies.
- Smaller companies (under 1,500 employees) reported more customer-data entry than larger ones: 40% versus 27%.
These are large-company, non-technical respondents in four countries, so treat the numbers as an indicator, not a forecast for your business. The direction is still clear: where there is no approved option, people improvise.
Why banning AI tools usually backfires
A blanket ban feels safe and rarely works. Employees move to personal phones and home laptops, where you have no visibility at all, and the same survey found 39% of respondents would rather use AI without telling anyone. A ban also throws away the real benefit: faster drafting, summaries and research. The better question is not “how do we stop this?” but “how do we make the safe way the easy way?”
What to put in an AI policy for employees
A useful policy fits on two pages and is written in plain language. It should cover seven things.
1. Approved tools and accounts
List the tools staff may use and how: company accounts only, with the right plan and settings (for example, business plans that exclude your inputs from model training, as the vendor’s current terms state). Say who to ask when someone wants to try a new tool.
2. Data classification: what can never be pasted
Use three simple levels. Green: public or generic content, fine anywhere approved. Amber: internal material, allowed only in approved company tools. Red: customer personal data, credentials, contracts under NDA, financial and health records, source code with secrets: never in any external AI tool unless a specific system has been approved for it.
3. Human review
AI output is a draft. Anything sent to a client, published or used in a decision needs a named person who checked it. AI can state wrong things with confidence, so the person who sends it owns it.
4. Customer-facing and automated use
Chatbots, auto-replies and agents that act on systems carry different risks from personal drafting help. They need an owner, testing and limits on what they can do. See our guide to AI agent security for the controls that matter.
5. Transparency
Decide when you tell clients or colleagues that AI was involved, and follow any contractual or legal duty to disclose it.
6. Incident reporting without blame
If someone pastes the wrong thing into the wrong tool, you want to hear within hours, not months. Make reporting easy and free of punishment for honest mistakes.
7. Training and review
One hour of practical training with real examples beats a PDF nobody opens. Review the policy every quarter; tools change quickly. For EU-linked businesses, the EU AI Act also expects staff AI literacy, so check what applies to you in our EU AI Act compliance guide. This is general information, not legal advice.
A simple example: a 25-person services company
Take a consultancy where the account managers use a free AI assistant to summarise client calls and rewrite proposals. The owner discovers it by accident when a proposal contains a client’s internal figures. Instead of banning the tool, the company does four things in a month: it buys business accounts for the team, writes a two-page policy with the green/amber/red rule, connects an internal assistant to its own proposal templates so people stop pasting them elsewhere, and runs a 60-minute workshop. Usage does not fall; it moves into tools the company can see and control.
When a policy is not enough: give people a safe tool
A policy tells people what not to do. It works best when paired with something they can do. Depending on your data and risk, that can be:
| Option | Best for | Trade-off |
|---|---|---|
| Business plans of mainstream AI tools | General drafting and research with amber data | Data still goes to a third-party vendor; read the terms |
| Internal AI knowledge base over your documents | Staff questions about policies, products, procedures, with sources | Needs good source documents and access control |
| Private or self-hosted model | Red data, regulated sectors, strict client contracts | Higher setup and running cost; not needed by everyone |
Frequently asked questions
Do we need an AI policy if we are a small company?
Yes, and the smaller the company the shorter it can be. If anyone on your team can open a browser, they can paste company data into an AI tool. A one-page policy with approved tools and a “never paste” list already removes most of the risk.
Should we ban ChatGPT and similar tools?
Usually not. Bans push usage out of sight. Approve specific tools and accounts, set data rules and offer a safe internal alternative instead.
Can an AI policy stop data leaks completely?
No. A policy reduces risk through clear rules, training and approved tools. For high-sensitivity data, add technical controls such as access limits, logging and, where justified, a private model.
Who should own the AI policy?
One named person, often the owner, operations lead or whoever handles IT or compliance, with input from legal and a few heavy users. Ownership matters more than seniority.
How often should we update it?
Review it at least quarterly and whenever you adopt a new tool or a regulation changes.
Turn the policy into a working system
Shkulaku designs and builds the tools that make an AI policy practical: internal AI assistants that answer from your own documents with sources, private AI setups for sensitive data, and workflow automation with human approval built in. If you would like help moving your team from shadow AI to AI you can see and control, contact us for a short consultation and tell us how your team uses AI today. You can also see our AI agents and RAG systems service.
I take on a small number of projects at a time. Tell me what you are building and I will tell you honestly whether I am the right person for it.
Get in touch →Keep reading
Si ta testosh një agjent AI para publikimit: udhëzues praktik për biznese
Një agjent AI që duket i shkëlqyer në demo mund të dështojë me klientët realë. Ja si ta testosh dhe vlerësosh para se ta lësh të prekë procese reale.
How to Test an AI Agent Before Launch: A Practical Evaluation Guide for Businesses
An AI agent that looks great in a demo can still fail on real customers. Here is a practical, business-friendly way to evaluate and test an AI agent before you let it touch real workflows.
Politika e përdorimit të AI në kompani: si ta menaxhosh “shadow AI” pa e ndaluar
Ekipi yt ka shumë gjasa që e përdor AI-n tashmë, pa miratim. Ja si ta shkruash një politikë të thjeshtë përdorimi, ta ulësh rrezikun e “shadow AI” dhe t’u japësh punonjësve mjete të sigurta.