Grace Ashiru
Your staff are already using AI. Maybe they asked first, or maybe they didn’t. The reality is that many now copy customer details into chatbots, hook shared drives up to AI-powered apps, and feed meeting recordings into tools that spit out summaries in seconds. Nobody can deny the productivity boost, but there’s a question that keeps getting ignored: once those files leave your systems, where do they actually end up?
Gartner ran a survey in 2025 and found that 69% of organisations either suspected or had proof that employees were using banned public generative AI tools. That’s a huge number, and a single company-wide email won’t fix it. Here’s what’s really happening to your data, and where the danger actually lies.
What “Shadow AI” Looks Like in Practice
It sounds like something out of a thriller, but the day-to-day reality is boring. A sales rep drops a client brief into a chatbot to knock out a proposal draft. A developer pastes proprietary code into an AI assistant because it’ll find the bug faster than they will.
These people aren’t trying to cause problems, but that’s the whole issue, because it means almost everyone does it without thinking twice. Deloitte’s GenAI Workforce Survey 2026 backs this up: one in three employees who use generative AI at work do so without their employer knowing, usually because the company never set any rules to begin with.
How to Control Where Sensitive Files Go
Policies are useless if the approved tools are a pain to use. Force your team onto slow, clunky platforms and they’ll go right back to pasting data into whatever loads quickest.
When it comes to file storage and sharing, you want a provider that encrypts your data in a way the provider itself can’t read. End-to-end encrypted cloud storage handles this well, because files get encrypted on the user’s device before they ever hit the server. Even if someone breached the provider, the contents would be unreadable without the user’s encryption keys. On top of that, set clear rules about which types of files should never go near a public AI tool. Client data, financial records, internal strategic documents, and anything covered by GDPR all belong on that list.
What Provider Terms Actually Allow
Free-tier AI tools will almost always reserve the right to use your input data for model training, unless you manually opt out. So a confidential document pasted into a public chatbot could eventually shape the outputs other users see. Enterprise tiers tend to offer better protections, including the ability to exclude your inputs from training altogether.
But here’s the catch: employees rarely know which tier they’re on. And if your company hasn’t approved a list of tools, every single person on your team is making that call by themselves.
Why a Written Policy Alone Won’t Cut It
Banning AI tools entirely is the easiest policy to draft and the hardest to actually enforce. IBM’s Cost of a Data Breach Report revealed that 63% of breached organisations had no AI governance policy at all, or were still putting one together when the breach happened.
A better way to handle it is to work in layers. Approve specific tools for specific jobs, train your staff on what they can and can’t upload, and use technical controls to block everything else. You don’t need to kill off AI usage across the company, but you do need to stop your files from landing somewhere you’ll never be able to retrieve them.
Your Data Strategy Needs to Catch Up With Your AI Strategy
Companies that get this right won’t be the ones who tried to ban AI tools completely. That’s already a lost cause. They’ll be the ones who accepted their teams were using these tools months ago and started building the right infrastructure around that fact. That starts with an audit of which AI services are active today and clear data classification tiers for every department in the business.
You’ll also need to revisit these decisions on a regular basis, because the terms of service you reviewed six months back might not reflect what’s in place now. Treat this as a one-off project and you’ll end up in the exact same spot a year from now, only with more data out in the wild. Build ongoing governance into your operations and you’ll be far better placed to adopt new tools safely, without losing control of the files that matter most.
