Why shadow AI without an AI strategy puts your SME at risk. Earlier this month I shared a short video on shadow AI. It got a lot of reaction.
People recognised what I described in their own businesses. Quiet use of ChatGPT and other tools in the background. No policy. No guidance. No clear sense of where information goes.
Others wanted more detail. They asked for practical examples of where this goes wrong, especially for smaller organisations.
This post answers those questions.
What is Shadow AI and what are the risks?
First, a simple explanation of shadow AI. Then the main risks. Then four realistic SME scenarios. Along the way I highlight a common misunderstanding about ChatGPT data settings that gives many employers a false sense of security.
These scenarios reflect real issues raised by regulators, advisers and insurers.
Shadow AI means staff using AI tools outside any agreed company process.
Common patterns of misuse
- People sign up with personal email addresses.
- They use public versions of tools instead of business accounts.
- They paste client emails, contracts, spreadsheets or HR notes into prompts.
- No one senior has approved this use or assessed the risk.
At first, the benefits feel obvious. Drafts appear in seconds. Admin shrinks. Work feels lighter.
Problems surface later, when a client, regulator, insurer, board member or new hire asks hard questions about data and risk.
Why shadow AI is dangerous without an AI strategy
Curiosity about AI helps. Silent, unmanaged use does not.
Risk grows in the gap where no AI strategy or policy exists.
Here are the key dangers.
- Data protection and GDPR breaches
Public AI tools process text through external servers. Once staff feed in names, emails, case notes or interview records, that information becomes personal data in another organisation’s hands.
Without an AI strategy, the business has no clear view of:
- Who supplies the AI tool.
- Where data is stored.
- How long data stays there.
- Whether data trains future models.
- Whether any lawful basis exists for this processing.
One subject access request or one client complaint can expose years of casual AI use. At that point the business might need to treat earlier behaviour as a personal data breach and speak to the ICO.
- Loss of confidentiality and intellectual property
Staff often paste highly sensitive material into prompts. Bid responses. Legal analysis. Pricing models. Product plans. Source code.
If that flows into a public tool with no contract, no confidentiality clause and no real control, the business loses protection if there is a leak, an attack, or careless reuse of prompts.
Professional services and technology firms face particular exposure here. Client trust and trade secrets sit at the centre of their value.
- Unreliable output driving poor decisions
AI tools produce fluent text. Fluency does not equal accuracy.
Without guidance, staff start to treat the tool as an authority. Text moves straight from a prompt into client advice, HR decisions or risk reports. Checking fades under time pressure.
Quality drops over time. Risk rises fastest where decisions touch law, finance, health, safety or regulation. Complaints and claims follow.
- Security gaps
Unapproved tools often link to personal cloud storage or weak passwords.
Staff save prompts and files in consumer accounts, on home devices, or in unmanaged browser extensions. Security teams do not even see this activity, so plans develop hidden gaps.
An AI strategy would direct staff toward secure accounts, strong authentication and approved integrations. Without that framework, security drifts.
- Loss of trust with clients and staff
Clients expect clarity on how you handle personal data and sensitive information. Staff expect clarity on what is allowed.
Once people uncover silent AI use, trust erodes. Even where no serious incident has happened yet, the sense of “experiments with my data” damages relationships.
Callout example
Here’s a common mistake with ChatGPT data settings.
Someone says:
“I went into Settings, opened Data Controls and switched off the ‘Improve the model for everyone’ option. So our chats are now safe.”
This is a misunderstanding.
That toggle does one thing. It stops those chats being used to improve OpenAI models for everyone.
- Does not stop data flowing to OpenAI.
- It does not control how long data is kept.
- It does not give your business any audit trail of what staff put into prompts.
In many SMEs, different staff use their own ChatGPT accounts with different settings. No one has a central view.
So a well meaning employee changes a personal privacy preference, feels safe, and continues to paste client emails, CVs or internal documents into ChatGPT. Leadership hears “we switched off training” and relaxes.
The real governance and data protection gaps remain.
An AI strategy treats this toggle as one small control, not as a safety net. You still need clear rules on which tools to use, what to paste, what to avoid and how to train people.
Turning off ‘Improve the model for everyone’ in ChatGPT helps, but does not replace an AI policy or data protection controls.
Four realistic SME examples
Example 1: Regional law firm using ChatGPT for drafting
A regional law firm with around 50 staff wants to speed up emails and document drafting. A few solicitors open personal ChatGPT accounts and start pasting unredacted client information into prompts.
They edit letters. They summarise long email threads. They ask for alternative versions of advice.
Months later, a large client reviews the firm’s approach to data protection. During checks, the firm uncovers widespread use of public AI tools with no policy, no DPIA and no vendor assessment.
Partners seek legal advice and decide this behaviour meets the threshold for a personal data breach. The firm informs affected clients and considers whether to notify the ICO.
This leads to cost, disruption and awkward conversations with clients and the professional indemnity insurer.
Root cause. No AI strategy. No policy. No training. Individual staff filled the gap with improvised solutions.
Example 2: Virtual assistant business handling client data
A UK virtual assistant business has three staff. The team manages inboxes, mailing lists and diaries for coaches and consultants.
The owner encourages use of AI for efficiency. No written guidance covers client data.
Assistants paste full client email threads into prompts. They upload spreadsheets with subscriber names and addresses. They share parts of contracts for rewording.
Before contract renewal, a client asks for a review of data handling. They spot references to AI in notes and ask where their data went and which tools processed those details.
The business holds no log of prompts, no record of accounts in use and no AI clauses in contracts. The client loses confidence and moves to another supplier. The business then faces detailed questions on data location and retention and needs legal support.
Again, the problem sits in governance. No AI strategy. Not a list of approved tools. There has been no training on redaction or anonymisation.
Example 3: Recruitment agency using AI for interviews
A recruitment agency with around 20 staff records video interviews on laptops. One consultant signs up for an AI transcription and summary tool, then feeds transcripts into ChatGPT for shortlists and client summaries.
Candidate names, work history, salary expectations and health comments appear in those files. Data sits in consumer accounts with basic passwords.
A laptop goes missing. During internal review, leaders discover that no one assessed the AI vendors or carried out a DPIA for this process.
Candidates learn that AI tools processed their data without clear information or choice. Some raise concerns about fairness and profiling. Employer clients question compliance with GDPR and discrimination law.
The agency freezes AI use, calls lawyers, and rushes policy, DPIAs and secure accounts into place. Recruitment work slows at a busy time and revenue drops.
Structured governance would have reduced risk. With an AI strategy in place, the agency would have:
- Defined where AI supports hiring and where human review remains central.
- Chosen vendors with suitable contracts and security.
- Completed a DPIA for high risk processing.
- Trained staff on what belongs in prompts and what stays out.
Example 4: Ecommerce SME adding an AI chatbot
A small ecommerce brand adds a low cost AI chatbot to the website. The goal is faster responses on delivery, returns and sizing. The integration goes live after a short test.
The chatbot collects names, email addresses, order numbers and free text questions. Some customers share health details, financial worries or family context in those messages.
A customer then submits a subject access request and asks for all data, including chatbot records.
The business discovers that no one knows where chatbot data lives, how long it remains, or how to delete entries. The privacy notice on the site says nothing about AI.
During review, staff realise that some data qualifies as sensitive under GDPR. The business now needs legal advice, a revised privacy notice, stricter configuration and a retention policy for chatbot transcripts. Chatbot use pauses while this work happens.
Again, the story started with a reasonable goal, faster service, but lacked structure around risk. An AI strategy would have forced careful thought before launch rather than under pressure.
What an AI strategy adds
An AI strategy for an SME does not need complex language or a thick manual. A simple framework already changes behaviour and lowers risk.
Key elements
- Clear principles. Where AI supports the business, and where human judgement remains central.
- Approved tools. A short list of AI services that meet agreed security and legal standards.
- Red lines. Data types that never enter public tools.
- Processes. DPIAs and vendor checks for higher risk use, such as HR, recruitment and large volumes of personal data.
- Training. Plain guidance so staff know what is allowed, what creates risk and where to ask questions.
- Review. Regular checks on AI activity, incidents and new opportunities.
This approach moves AI from private experiments to a managed part of day to day operations. Risk falls. Value rises. Staff feel more confident experimenting inside clear boundaries.
How is your business placed?
If these examples feel close to your own experience, you are not the only one. Many SMEs sit in a similar position. Quiet AI use. Little structure. Growing concern.
I work with small and medium sized businesses to build practical AI strategies that fit real life, not theory, and that link directly to day to day marketing and operations.
If you want to:
- Reduce risk from shadow AI.
- Set clear rules for safe and productive AI use.
- Identify where AI supports your marketing and wider business.
then let us talk.
