You can’t govern what you can’t see: shadow AI, explained

AI is already in your business. The question is whether you can see it.

Most firms we speak to have a rough sense that people are using AI tools. Fewer can say which tools, who uses them, or what information goes into them. That gap has a name: shadow AI.

What shadow AI actually is

Shadow AI is any AI tool or feature used for work without the business knowing about it, approving it, or setting any rules for it. It is the AI version of "shadow IT", the spreadsheet or app that a team adopts because it helps them get the job done.

It usually looks ordinary:

• A consultant pastes a client email into a free chatbot to draft a reply.
• A finance assistant uploads a spreadsheet to an AI tool to summarise it.
• A team switches on the new AI feature inside software you already pay for.
• Someone installs a browser extension that "helps write better emails".

None of this is malicious. In most cases, people are trying to work faster and do a better job.

Why it happens

• The tools are easy to reach. Many are free, need no installation and work in a browser.
• AI is arriving inside existing software. Features appear in tools you already use, often switched on by default.
• There are no clear rules. If people don’t know what’s allowed, they make their own judgement.
• The benefits are real. People use AI because it saves them time.

Where the risk sits

AI isn’t the risk. Lack of control is. When the business can’t see AI use, a few specific things become hard to manage:

• Data. Client, personal or commercially sensitive information may be entered into tools with unclear terms about storage or training.
• Accuracy. AI output can be wrong in confident-sounding ways. Without guidance, it may be used without a check.
• Consistency. Different teams use different tools in different ways, so quality varies.
• Scrutiny. When a client, insurer or auditor asks "how do you use AI?", it is hard to give a clear answer.

Why banning it rarely works

The instinct can be to block AI tools. In practice, bans tend to push use further out of sight, onto personal phones and home laptops, where you have even less visibility. They also give up the productivity gains your people have found.

You don’t need to stop AI. You need to be in control of it.

Calm first steps

1. Find out what’s in use. Ask people directly, check software and expense records, and look at which AI features are enabled in tools you already own.
2. Make it safe to say. Frame this as understanding, not catching people out. You’ll get better answers.
3. Sort by risk. Not every tool matters equally. Focus first on anything handling client or personal data.
4. Set simple rules. A short, clear policy on what’s approved, what’s not, and what never goes into an AI tool.
5. Keep looking. New tools and features arrive every month. Visibility is a habit, not a one-off.

How TURMA helps

TURMA Snapshot is designed for exactly this first step. It turns scattered, unseen AI use into a clear, scored picture of what’s actually running in your business, with a recommended next step. From there, TURMA Assured helps you put the right controls in place and keep them current.

You can’t govern what you can’t see. The good news is that seeing it is the easy part.