Shadow AI in regulated firms
Shadow AI is the AI nobody bought and nobody governs: the summariser built into your document software, the drafting assistant in your inbox, the tool a compliance analyst adopted because it was free.
Why boards miss it
None of it shows up in procurement. It ships inside products the firm already bought, so it is invisible to the IT budget and the vendor register. The chief compliance officer does not see it. The board does not know it exists. And a regulator finding it first is not a good look.
The uncomfortable facts firms rarely check: several mainstream productivity tools process document content through external models by default, and settings are often "opt out" rather than "opt in". For a firm handling client money or client identities, that is a genuine data-handling issue, not an IT preference.
The questions to ask this week
- Which of our current software subscriptions include an AI feature?
- Is that feature enabled by default, and for which users?
- Does the vendor's terms allow them to use our content to train models?
- Who decided this was acceptable?
If the answer to the fourth question is "no one" - the feature is shadow AI. Not because it is malicious, but because it is ungoverned.
Closing the gap without banning everything
- Produce an inventory of AI features already enabled. This is the single most valuable artefact.
- Classify each: safe / needs review / off.
- Write a one-page policy: what data may go to which tools, who approves exceptions.
- Issue the approved-tools list, and train staff on why it exists - fear of discipline creates hiding, not compliance.
What a regulator would look for
An inventory of AI in use, a named owner for it, and evidence the firm has reviewed the data flows. None of that requires buying anything. It requires someone asking the questions - usually for the first time.
Further method. This topic is covered in more depth by Fuzzelogic's guide on shadow AI - employees using AI without approval, and firm-wide by their Crown Dependencies AI readiness survey, which scores the exact gaps above.