The AI your team alreadyuses — and you don't knowabout

There is a good chance someone on your team is using an AI you never approved. Not secretly, in the sense of hiding it — it just never occurred to anyone to mention it.

And here is the part that is usually told wrong: that person is trying to do the job better.

They took a tedious task — summarizing an hour-long meeting, rewriting a difficult email, organizing a messy spreadsheet — and found a way to get it done in five minutes. They did it on their own initiative, during working hours, to deliver faster.

Nobody does this out of rebellion. They do it because the problem was right in front of them and the solution was one sign-up away.

The problem isn't what they wanted to do. It is what went along with it.

How it starts

The path is always similar.

Tuesday, end of the day, someone needs to deliver a meeting summary. They open a free AI in the browser, paste the whole transcript, get the summary, deliver it. It worked.

The following week they do it again, without thinking. The following month it is already how they work. In three months, three different people do the same thing, each with a different tool, each on a personal account.

Notice that at no point was there a decision. There was no meeting, no denied request, no broken rule. There was a task and a way out.

That is why asking “who authorized this?” leads nowhere. Nobody authorized it because nobody realized it was something that needed authorization.

What leaves the company along with it

Here the subject changes tone, and it isn't about the tool being good or bad.

That Tuesday, the pasted transcript wasn't just any text. It was a meeting with a customer's name, a negotiated amount, a complaint about a supplier and, probably, comments about people on the team itself.

That now sits in a personal account, on a service the company didn't choose, under terms nobody read, in a history the company doesn't control and can't delete.

Multiply that by three people and three months.

And there is the operational detail almost nobody considers: when that person leaves the company, the history goes with them. It isn't only a risk of exposure. Part of the knowledge of how the work gets done now lives in an account that isn't yours.

None of this requires bad faith to cause problems. Time passing is enough.

Banning it is the answer that makes things worse

The intuitive reaction is to block it. Send out a memo, list what isn't allowed, block it on the network.

That usually makes two things worse at once.

The task is still tedious. Blocking the tool doesn't give back the time it saved. The person still has an hour of transcript to summarize at six in the evening. The problem that led them there wasn't solved — solving it just became forbidden.

And the use doesn't stop, it disappears. It moves to the personal phone, on mobile data, out of sight. Before, you had a visible problem you could discuss. Now you have the same problem, plus silence.

Blocking works when there is an official path that solves the problem just as well or better. Without that path, blocking isn't a security policy. It is a way of not looking.

Where this argument stops holding

Two caveats, and the first contradicts the conciliatory tone of everything so far.

Some data is non-negotiable. If you handle health information, third-party financial data or documents under contractual confidentiality, the conversation isn't “let's understand the need.” There are obligations there that don't depend on internal convenience, and the answer is no — with an alternative path, but no.

And if the company has three people, this may be bureaucracy. A survey, an official list and a request process make sense when there are more people than memory. In an operation of two or three people who talk every day, the same result comes out of a ten-minute conversation. Setting up a process there is spending energy on forms instead of on the problem.

The rule of thumb is simple: if you can say off the top of your head what each person uses and with what data, you don't need a process yet. The day you can't, you do.

The technical name for this is shadow IT, and the term is bad because it suggests shadows, something hidden, bad intent.

In practice it is almost always the opposite: competent people solving a real problem in the fastest way available.

The productive question isn't “who used it without authorization.” It is why the official path was slower than the shortcut — and what would happen if it stopped being so.

As long as asking takes longer than solving, there will always be a list you don't know about.