Every business we assess has staff using AI tools that were never approved. Not out of defiance. Somebody had a deadline, a free tool was one tab away, and it worked.
Why blocking it rarely works
A firewall rule moves the behaviour to a phone. The person who was pasting a contract into a browser now photographs it instead, and you have lost the visibility you had. Prohibition without a sanctioned alternative produces worse outcomes than a clear policy and a tool people are allowed to use.
What is actually at risk
- Client data pasted into a consumer tool with no data processing agreement behind it
- Draft financials and board material that were never meant to leave the tenancy
- Code and configuration, including the occasional embedded credential
- Personal information, which under PIPEDA is your responsibility wherever it ends up
A workable position
Name the tools people may use and make sure one of them is genuinely good enough for the everyday work. Write the rule about data, not about tools, because the tools change every quarter and the categories of data do not. Then ask, without blame, what people are already using. The answers are more useful than any policy you write in isolation.
Shadow AI is a governance problem wearing a technology costume. It is solved the same way shadow IT was: give people a supported route that is easier than the unsupported one.