Shadow AI in the workplace is employees using AI tools their organisation has not approved, usually through personal accounts, and it is now mainstream: in a 2026 Okta survey, 52% of knowledge workers admitted to using AI tools without approval. Most do it because the approved route is slower or less useful, not because they want to break the rules. The answer is not a ban. It is a people and policy programme: approve good tools quickly, guide people with clear rules, train everyone, and monitor with a light, no-blame touch.
This guide covers the human side: why people use unapproved AI, why bans fail, and what managers, HR, IT and security each need to do. For the technical side, including discovery methods, prompt-level DLP and AI incident response, read our companion guide, Shadow AI: how to find it and stop company data leaking into ChatGPT.
The gap between what leaders think and what employees do
Okta’s “AI Agents at Work 2026” research surveyed 292 executives and 492 knowledge workers across the US, UK, Australia, Canada, Japan, France and Germany in March 2026. Its findings on employee AI use are striking:
- 52% of employees admitted to using AI tools without approval, often through personal accounts.
- 90% of executives were confident in their organisation’s visibility into AI tools, and 95% were confident employees were using AI responsibly.
- 65% of executives believed their AI usage policies were “very clear”, but 57% of knowledge workers found policies unclear, hard to find or non-existent.
- Among employees using unapproved tools, 54% shared internal messages and emails, 45% shared HR-related information and 39% shared confidential company documents.
- Use of unapproved AI varied widely by country, from 67% of workers in the US to 31% in France.
This is not new behaviour. Microsoft and LinkedIn’s 2024 Work Trend Index, based on a survey of 31,000 people in 31 countries, found that 78% of AI users were bringing their own AI tools to work, and only 39% of users had received AI training from their company. The habit formed early, and in many organisations training and policy have not caught up.
Why people use unapproved AI
The same Okta survey asked employees why they used unapproved tools. The answers point to friction and culture, not ignorance:
- 80% said it was easier to use their own accounts.
- 78% said their team already used the tool and considered it normal.
- 57% said the approval process was too slow or difficult.
- 49% said the approved tools did not meet their needs.
- Only 6% cited not knowing that approval was required.
In other words, most people know there is a rule. They break it because the sanctioned path is harder than the shortcut, and because everyone around them is taking the shortcut too. That has a practical consequence: another reminder email about the policy will barely move the numbers. Changing the experience will.
Why bans fail
When leaders discover shadow AI, the first instinct is often to block it. Blocking specific unsafe tools is sensible. A blanket ban, with no good alternative, tends to backfire:
- The work moves out of sight. People switch to personal phones and home laptops, where you have no visibility and no controls.
- Honesty stops. If admitting AI use gets someone into trouble, they stop admitting it, and you lose the information you need to manage risk.
- The demand does not go away. The underlying job, drafting, summarising or analysing faster, still needs doing.
- Your best people get frustrated. The employees most eager to use AI are often the ones you most want to keep.
A better question than “how do we stop this?” is “how do we make the safe way the easiest way?”
The approve, guide, train, monitor framework
1. Approve: give people something better than the shortcut
- Provide at least one approved, enterprise-grade AI assistant that covers the most common tasks, with single sign-on and contractual data protection.
- Publish a short list of approved, restricted and blocked tools, and keep it current.
- Create a fast track for new tool requests, with a target decision time measured in days, not months.
- Ask teams which tools they already rely on, and approve the safe ones rather than forcing a switch.
2. Guide: write rules people can follow
- Keep the AI acceptable use policy short enough to read in five minutes, written in plain language.
- Define clear data red lines with examples: customer personal data, employee records, credentials, unreleased financials and client confidential material.
- Put the policy where people work: the intranet home page, the AI tool’s landing page and onboarding packs.
- Give people a named contact or channel for “can I use AI for this?” questions.
3. Train: build judgement, not just awareness
- Train every employee on which tools are approved, what data never goes into a prompt and how to check AI output before using it.
- Add role-specific training for teams that handle sensitive data, such as HR, finance, legal, sales and customer support.
- Show people how to get real value from the approved tools, so they have a reason to switch.
- Explain how to report a mistake, and make clear that early reporting will be treated fairly.
4. Monitor: measure, then adjust
- Track the share of AI use going through approved tools, and the number of unapproved tools in use.
- Run a short anonymous survey every quarter on which tools people use and why.
- Tell employees what is monitored and why, in line with your privacy obligations.
- Treat rising unapproved use as a signal that the approved tools or process need fixing, not only as a compliance failure.
| Step | Main goal | Sign it is working |
|---|---|---|
| Approve | A sanctioned tool for every common use case | Fewer tool requests stuck in review; approved tool usage rising |
| Guide | Rules people understand and can find | Employees can name the data red lines without looking them up |
| Train | Safe, confident use across the workforce | Training completion by team; fewer sensitive data warnings over time |
| Monitor | An honest, current picture of AI use | Survey answers that match telemetry; unapproved tools in use falling |
How managers should talk about shadow AI
Line managers are where policy meets daily work, and they are often the first to notice someone using an unapproved tool. A good conversation is curious, not punitive:
- Start with the task. “What were you using it for, and what did it save you?” This tells you what need the approved tools are missing.
- Check the data. “What did you put into it?” If sensitive data was involved, follow your incident process calmly and quickly.
- Point to the approved route. Show the person the sanctioned tool that does the same job, or help them raise a request for the one they prefer.
- Feed it back. Pass the use case to IT or the AI governance team so the approved toolset improves.
Managers should avoid public criticism, vague threats and “just don’t use AI” instructions. Those responses drive the behaviour underground. Some organisations also run a short amnesty, inviting teams to declare the AI tools they use without consequences, so the inventory starts from the truth.
What HR, IT and security each own
Shadow AI sits between functions, which is why it often belongs to no one. Agree ownership explicitly:
| Function | Owns |
|---|---|
| HR | Policy communication, training in onboarding and annual cycles, manager guidance, and fair handling of policy breaches |
| IT | Approved tool provisioning, the tool request process, licences, single sign-on and user support |
| Security | Tool risk assessments, data red lines, monitoring and DLP, and AI incident response |
| Legal and privacy | Vendor data terms, employee monitoring notices and data protection obligations |
| Business leaders | Identifying high-value use cases and making sure their teams have approved tools that meet them |
Platforms such as AccuroAI’s workforce AI governance can give IT and security the visibility side of this picture. Our Safe AI at Work session covers the workforce training layer for every employee, and GenAI for Teams helps business teams get real value from the tools you have approved.
Frequently asked questions
What is shadow AI in the workplace?
Shadow AI in the workplace is any use of AI tools, AI features or AI agents for work without the organisation’s approval or oversight. Common examples are personal chatbot accounts, AI browser extensions, AI meeting note-takers and AI features switched on inside existing software.
How common is shadow AI?
Very common. In a 2026 Okta survey of 492 knowledge workers in seven countries, 52% admitted to using AI tools without approval. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of AI users were bringing their own AI tools to work.
Should we discipline employees who use unapproved AI?
For most first-time cases, no. Treat it as a coaching conversation and a signal that the approved tools need work. Reserve disciplinary action for deliberate or repeated breaches of clear data rules, handled consistently through HR.
Is an AI acceptable use policy enough?
No. A policy sets the rules, but in the Okta survey 57% of knowledge workers found their organisation’s AI policies unclear, hard to find or non-existent. You also need approved tools that meet people’s needs, training that builds judgement, and monitoring that tells you whether it is working.
Who should own shadow AI?
Ownership should be shared but explicit. HR typically owns communication and training, IT owns approved tools and the request process, and security owns risk assessment, monitoring and incident response. A named executive sponsor helps keep the three aligned.
Turn shadow AI into safe, approved AI
Product Innovation Academy helps enterprises worldwide build an AI-ready workforce, with AI Security & Governance programmes delivered in partnership with AccuroAI. We can combine leadership briefings, company-wide safe AI training and team upskilling into one plan built around your tools and policies. Request a proposal to get started.
Sources
- Okta, “AI Agents at Work 2026: Securing the agentic enterprise”, 27 May 2026. okta.com
- Microsoft, “Microsoft and LinkedIn release the 2024 Work Trend Index on the state of AI at work”, 8 May 2024. news.microsoft.com