Shadow AI is the use of AI tools at work without the company's knowledge or approval: an employee pastes a client email into a free chatbot, runs a spreadsheet through a browser extension, or uses a personal AI account to draft a proposal. The practical way to manage it is not a ban. Give people approved tools that actually do the job, write a short policy that says what data may go where, and train staff so the safe route is also the easy route.
What shadow AI looks like in a normal office
Shadow AI rarely starts with bad intent. It starts with someone trying to finish work faster. Common examples:
- Using a personal AI account on a work laptop because the company has not provided one.
- Pasting meeting notes, contracts or customer details into a public tool to summarise them.
- Installing AI browser extensions or note-taking apps that join meetings without IT being told.
- Using AI features hidden inside other software without checking where the data goes.
- Forwarding company files to a personal email so they can be processed at home.
The common thread is that the company cannot see the tool, cannot judge its settings and cannot answer a basic question: where did our data go?
Why shadow AI is a real business risk
The risk is not that AI is dangerous in itself. It is the lack of visibility and control.
- Data exposure. Customer, employee or commercial information may be entered into a tool whose terms, retention and training settings nobody has reviewed.
- Inconsistent quality. Different people using different tools produce different standards, and nobody checks the output the same way.
- Compliance questions. If personal data is involved, your obligations under Malaysia's PDPA may be engaged. This is general information, not legal advice; confirm specifics with your legal or compliance team.
- No accountability. When something goes wrong, there is no record of what was used, by whom, for what.
- Hidden cost. Several teams may be paying for overlapping tools on expense claims.
For a closer look at one of these, see can you put customer data into Claude?
Why banning AI tools usually fails
A blanket ban feels safe, but it tends to push the behaviour out of sight. If AI saves someone an hour a day, they will keep using it on a personal phone or home laptop, and now the company has even less visibility. A ban also signals that the company does not want to learn, which costs you the productivity gains your competitors are collecting.
Bans make sense for narrow cases, such as blocking a specific tool for a specific data type. As a company-wide strategy, they usually turn shadow AI into hidden AI.
A practical approach: approve, define, train, review
- Find out what is already happening. Ask staff, without blame, which tools they use and for what. An honest survey beats guessing, and amnesty gets better answers than enforcement.
- Approve a small set of tools. Choose tools that meet your security and data requirements, and make them easy to get. If the approved option is slower than the personal one, people will drift back.
- Classify your data. Decide in plain terms which categories of information may never be entered into AI tools, which may be used only in approved tools, and which are unrestricted.
- Write a short policy. One or two pages, in language staff understand. Our guide to what a company AI usage policy should include lists the sections worth covering.
- Train people. A policy nobody understands will not be followed. Staff need worked examples: what is fine, what is not, and what to do when unsure.
- Create a fast route for new requests. If staff find a useful tool, they should know who to ask and get an answer in days, not months.
- Review regularly. AI tools change quickly, so revisit the approved list and the policy on a set schedule.
Who should own it
Shadow AI sits between IT, legal or compliance, HR and the business units, so it needs a named owner and a small cross-functional group rather than a single department. Leadership should sponsor it visibly, because staff follow what managers do. Managers, in turn, should be able to explain the policy to their teams in a few sentences.
Signs your shadow AI problem is growing
- Staff are unsure whether a given tool is allowed.
- The policy exists but few people have read it.
- Approved tools are rarely used, while AI-generated work still appears.
- IT discovers new AI apps or extensions after the fact.
If several of these ring true, the fix is usually clearer guidance and better tools, not stricter punishment.
Where training fits in
Training turns policy into habit. Staff who know how to use an approved assistant well have less reason to look elsewhere. Agmo Academy, the training arm of Agmo Holdings Berhad and part of Agmo Studio, a Select Partner of the Anthropic Claude Partner Network, runs hands-on programmes for teams. See AI training in Malaysia or in-house corporate training if you want a session built around your own policy and tools.