Shadow AI is a procurement failure, not a discipline problem

Picture a hypothetical analyst at 9:40 p.m. She’s the best one on the team. Tomorrow’s board report is due at eight. The approved tools can’t summarize a 90-page vendor contract, so she opens the AI subscription she pays for herself, pastes in the contract, and gets a clean summary in two minutes. She hits the deadline. Her manager is pleased.

Nobody in IT knows the contract left the building. Nobody knows what the tool’s terms say about keeping it. And if someone found out, the most likely response would be a memo reminding staff that unapproved AI tools are banned.

That memo would treat her as the problem. She isn’t. She is the symptom.

01One in three is not a few bad apples

Deloitte UK surveyed 25,000 workers between May and June 2026, the largest study of its kind in a single country. 63% said they had used generative AI for work. Of those users, 31% said they use it without their employer’s knowledge.¹

That alone should end the idea that shadow AI is a discipline issue. When roughly a third of the people using a technology are doing it out of sight, you don’t have a few rule-breakers. You have a supply problem.

02Your staff are already paying for it

Here’s the number that stopped us. 17% of GenAI users pay for at least one GenAI tool for work themselves. Deloitte estimates UK workers spend £958 million a year of their own money on these tools.¹

Read that as a buyer would. Close to a billion pounds of demand that never reached a purchasing desk. Every one of those subscriptions is a requisition your organization didn’t receive, for a tool nobody vetted, under terms nobody read, holding data nobody tracked.

The rest of the survey fills in the picture:

• 46% of GenAI users are using free tools at work. Free tools often come with the loosest data terms.
• 50% of GenAI users have had no training.
• 65% report a lack of convincing leadership on how GenAI should be used in their organization.
• 24% of UK workers now use GenAI tools every day for work.¹

Untrained people, using free tools daily, without clear direction, out of sight. That is not a behavior problem. It is a gap in what the organization supplies.

03Bans move the risk. They don’t remove it.

People reach for their own tools when the approved route is slower than the deadline. If the sanctioned option takes a quarter to arrive, or doesn’t exist, a ban just pushes the work onto personal laptops and phones, where you can see even less.

And the risk is real. Think about what crosses into an unvetted tool on a busy week: draft contracts, customer complaints with names attached, salary spreadsheets, internal forecasts, code. Once it’s there, you don’t control how long it’s kept or what it’s used for.

So who gets hurt? The customer whose details went into a free chatbot. The organization that learns about it in a breach report. And the analyst, who was trying to do good work and will be the one disciplined for it.

The uncomfortable question is this: if one in three of your AI users are hiding it, what is your buying process telling them?

04Every shadow tool is a purchase request

Flip the framing and the fixes get practical. Shadow AI is a list of needs your procurement process failed to hear. Treat it like one.

• Ask before you audit. Run a short, anonymous survey: what AI tools do you use for work, for what, and why those? People will tell you more in a week than a network scan will in a month, as long as the first message isn’t a threat.
• Supply one good option, fast. A single approved tool with business-grade data terms, available within weeks, removes most of the reason to go around you. Fast and decent beats perfect and late.
• Build a fast lane for small buys. A $20-a-month tool shouldn’t go through the same process as an ERP system. Set a light review for low-risk tools under a spending limit, with a turnaround measured in days.
• Write one data rule people can remember. Not a twelve-page policy. A single sentence: which kinds of data never go into any AI tool, approved or not.
• Train, then trust. When half your users have had no training, start there. Short and practical beats long and legal.

05Make the right way the fast way

You won’t get shadow AI to zero, and chasing zero will make things worse. A better target: people bring new tools to you because that’s the quickest way to get them. When the approved route is faster than the workaround, most people take it without being told.

Back to 9:40 p.m. In the version worth building, she opens an approved tool her employer pays for. She knows the contract can go in because the data rule says so. Her manager is still pleased. The difference is that the organization knows, too.

06What to do Monday

1. Send a five-question, no-blame survey asking which AI tools people use for work and why.
2. Ask finance one question: how many AI subscriptions are showing up on expense claims? It’s a quick proxy for what people are buying themselves.
3. Set a deadline for one approved tool, with a date measured in weeks, not quarters, and put a name next to it.

Then retire the memo. It wasn’t working anyway.