Nobody planned it. A salesperson pastes a long customer thread into a chatbot to get a summary. It saves twenty minutes, so tomorrow a colleague does the same. Within a month, mail is going to AI tools that IT never approved and cannot see. This is shadow AI, and banning it rarely works.

Why it happens

The tools are free or cheap, they are one browser tab away and the benefit is immediate. The risk is invisible: a message with a customer’s name and price list leaves the mailbox, and no one has a record of it.

Signs it is already happening

• Colleagues quote summaries that nobody wrote.
• Customer replies arrive faster than the team’s usual pace.
• Questions about “that AI thing” reach the service desk.
• Browser tabs with chatbots stay open next to the mail client.

None of these proves anything. They are a reason to ask, and asking is the first step.

Why a ban alone fails

A ban tells people what not to do and offers nothing instead. The work still needs doing, so the habit moves to personal phones and home laptops, where IT sees even less. An approved route is usually the stronger measure.

A practical plan

1. Ask what people useA short, friendly survey works better than an investigation.
2. Offer an approved routeWith AddSync AI, people use their own Claude or ChatGPT under your rules, or the AddSync chat window with the model in an EU region.
3. Set the limitsClose sensitive folders, senders and keywords with data filters.
4. Keep a journalRecord who used which tool and when.
5. Write a one-page policyWhat the AI is for, what it is not for and who to ask.

What the one-page policy should say

• Which AI tools are approved.
• What data must never be pasted into any tool.
• That the assistant suggests and the person decides.
• Who owns questions and incidents.
• How the company checks use.

Example conversation

Example, not a real conversation. The IT lead asks the sales manager what her team does with long threads. She admits they paste them into a chatbot. IT does not scold. It offers a pilot where the same people use their own assistant through AddSync AI, with closed folders and a journal. After two weeks, the team keeps the habit and IT can see how it is used.

Start with a pilot

Pick a team that already uses AI informally, usually sales or support. Connect their mailboxes for 14 days, compare their experience with the old habit and let the journal show how the approved route is used. See the 14-day pilot plan and AI for IT administrators.

Questions and answers

How do I know if staff use shadow AI?

Ask. A short survey is usually enough, and people are often glad to tell you what saves them time.

Should I block AI websites?

Blocking helps in some cases, but offer an approved alternative at the same time.

Will the approved tool be as good?

With option A, people keep the assistant they already know. With option B, they use the AddSync chat window.

Does the journal read mail?

No. It records who used which tool and when, without the text of the mail.

Written by the AddSync team.