Imagine that Per in the sales department spent an afternoon cleaning up the customer list. There were duplicate entries, errors in email addresses, and old newsletter sign-ups. Then he realized that the chatbot he pays for privately could do much of the work in a few minutes. He uploaded the Excel file and got a tidy list back.
At the next department meeting, he proudly shared how much time he saved. Only then came the question no one had asked: What actually happened to the customer data when the file was uploaded?
The list contained names, email addresses, and information about consent. The company had not assessed the service, clarified the terms, or approved that this information could be shared there. Per tried to solve a work task. Even so, the company now has a new data flow that no one had taken responsibility for.
This is shadow AI in practice. The term covers the use of AI services and agents that happens without the company having the necessary overview or approval. It can be a private chatbot, a program on a work device, or a tool that continues working on its own. For a manager, the central question is how to take care of people’s initiative while gaining control over what information they give away.
The customer list is still the company’s responsibility
When the company decides why and how customer data will be used, it is normally the company that is the controller under privacy regulations. The manager is responsible for organizing the work and ensuring that this is followed up. A private subscription held by an employee does not shift this responsibility to the employee or the chatbot provider.
Before an external provider may process personal data, the roles and the basis for sharing must be clarified. If the provider processes the data on behalf of the company, the relationship must be governed by a data processing agreement. If the provider uses the data for its own purposes, this must be assessed separately. A payment on a private credit card clarifies none of these questions.
It is therefore relevant to distinguish between a private subscription and a service the company has assessed and adopted under agreed terms. Microsoft documents, for example, that Copilot and Copilot Chat for organizations are covered by enterprise terms and the data processing agreement, and that prompts, responses, and data from Microsoft Graph are not used to train foundation models. At the same time, web search has its own terms, and agents can have other terms that must be checked. The product name is therefore not enough to decide what you can use it for.
The same consideration follows when you build your own agents. In Foundry Agent Service, Microsoft documents protections around the data the service processes, while external tools and data sources may have their own terms. You must understand the entire path the information takes, even when the starting point is a service you already trust.
Before you set limits, you must understand the need
I would start by asking what employees actually use AI for. Which tasks take too long? Where do they find help on their own? In Per’s example, the need is quite concrete: He wants to clean up a list without spending half the workday on it. If the leadership’s answer is only a ban, the task remains unsolved.
The conversation should be followed by a technical mapping. Defender for Cloud Apps can provide an overview of AI services in use and support their risk assessment. Services can be marked as sanctioned or unsanctioned. That gives a better basis for prioritization than a general feeling that “people are probably using ChatGPT.”
Microsoft Entra Global Secure Access can supplement this with insights from network traffic flowing through the solution. Then you can see usage patterns and traffic to known AI services. Such an overview still does not, by itself, tell whether Per sent a customer list or asked for help with a public ad copy. Which service was used and what data were shared are two different questions.
When you have both the overview and the employees’ explanation, it becomes easier to choose a few services that actually meet the need. An approval must then state what tasks the service can be used for and what information can be entered. A tool approved for writing an ad is not necessarily approved for the customer list.
The rules must work when someone is about to share
A list of approved tools helps little if the rest can still be used freely with the same data. Services you assess as unacceptable must be blockable through the controls you have on devices and networks. Marking as “unsanctioned” in Defender for Cloud Apps must be followed by configured enforcement, and you must verify that the block actually kicks in. A rule in the admin portal is only useful when it works in day-to-day operations.
An approved service can also receive information it should not have. Here, Microsoft Purview DLP—rules intended to prevent unwanted data sharing—can provide extra protection. Endpoint DLP can control specific actions involving sensitive information on devices enrolled in the solution. Protection in the browser, referred to as Browser Data Security in Microsoft’s guidance, can in supported scenarios detect or stop sensitive text before it is sent to an AI service in Edge.
For Per, that can mean he gets a warning or is blocked when he tries to upload the customer list or paste its content. The rule meets him in the actual work situation. A brief explanation of why the sharing is stopped, together with an approved alternative, makes it easier to do the right thing next time.
Sensitivity labels with encryption can additionally limit who can open the documents. An external service that does not have the right to decrypt the file also cannot read the encrypted content. But if an authorized user copies out readable text and shares it further, you cannot expect file encryption to protect the new copy. That is precisely why labeling, access control, and control over sharing must be seen in context.
The protection must also fit how people work. Support in Endpoint DLP varies between operating systems, browsers, and actions. Private devices and traffic outside managed solutions can create gaps in coverage. There, network-based controls can be a supplement, but you must clarify what they actually see and can stop. Ask whoever operates the solution to demonstrate the relevant ways of working before you consider them protected.
License and product status are part of that assessment. The Shadow AI overview for agents in the Microsoft 365 admin center is, for example, in preview and requires, among other things, Microsoft 365 E5, Defender for Endpoint, Intune-registered Windows devices, and enrollment in the Frontier preview. The overview applies to supported agents, and discovery does not mean that all the same agents can be blocked there. This is a specific tool with limited coverage, not a ready-made solution to all shadow AI.
You must be able to find out what happened
Even with good rules, you need a plan for what slips through. If Per has already uploaded the file, someone must be able to find out what it contained, which service received it, and what options you have to limit further use and get data deleted. That work becomes difficult if the entire history lies in a private account the company does not have access to.
For supported AI solutions, Microsoft Purview can help with logging, retention, and investigation of interactions. eDiscovery is the functionality that makes it possible to locate, preserve, and review relevant information during investigations and legal processes. Data Security Posture Management, abbreviated DSPM, can provide an overview of AI activity and risks related to sensitive data. What you actually gain insight into depends on the solution, license, and configuration. You cannot expect Purview to automatically have a copy of everything done in a private chatbot.
An unwanted sharing must also be assessed as a possible privacy incident. What must be reported to the Data Protection Authority, and whether the affected individuals should be notified, depends on a concrete assessment of the incident and the risk. It is not given that all mistakes should lead to notifications to all customers. But the company must be able to investigate, assess, and document what happened. Therefore, clarify in advance who collects the facts, who assesses the privacy questions, and who makes the decisions.
Start where the consequences are greatest
For a smaller company, I would start with the tasks where incorrect sharing can do the most damage. Customer lists, information about employees, health information, financial matters, and trade secrets deserve more attention than a draft of a public job ad. That gives a manageable starting point for both the mapping and the first rules.
Then I would choose a few approved ways of working and make them easy to understand. The agreements must clarify what the provider can use the data for, whether they can be used for model training, how they are stored, and what happens when they are to be deleted. Employees need concrete examples of what they can share, what must be removed or anonymized first, and what should not go into the service. Try this on a common work task, and also practice what you do when someone says: “I think I uploaded something I shouldn’t have.”
This costs time, and technical protection may require both new licenses and work on setup and operations. At the same time, you should factor in the time spent investigating an incident, bringing in legal help, and handling questions from customers. A private monthly subscription looks cheap when you only look at the price. It says little about the total cost to the company.
Honestly?
I believe shadow AI must be taken seriously as a leadership responsibility. Per’s initiative can be valuable: He has found a task that can be solved better. The company should then use that as a starting point to give him a responsible way to get the job done.
As a manager, you should be able to explain which AI services you use, what information they receive, and who follows up when something goes wrong. When those answers are missing, it is time to get control of the use. The work should start before the next customer list is uploaded.