How to manage unauthorised AI use in the workplace

A rising number of employees in the UK have admitted to paying for generative AI tools out of their own pockets. And this isn't so they can create their weekly shopping lists or generate AI images of themselves in the 80s, but instead for work-related tasks.

A recent study found that 1 in 6 generative AI users said they were personally paying for at least one tool to use at work.

Plus, 31% said they were using them without the knowledge or approval of their employer. This is sometimes referred to as Shadow AI, a term used to describe employees using unauthorised AI tools in the workplace.

If workers are happy to fork out for access to AI tools and risk using them without permission, what does this mean for employers who want to manage AI in the workplace?

Why can Shadow AI be a security risk?

Data Protection laws require businesses to handle data securely and lawfully. Data should only be collected for explicit reasons and deleted when no longer needed.

When employees use personal accounts to access AI tools at work, data security could be at risk. While the platform itself may not be dangerous, businesses can lose oversight of sensitive company data and assets once information is uploaded and handled outside approved systems.

What can employers do?

Conduct an AI audit

A good place to start when addressing this issue is to understand what the cause is.

Ask some serious questions to identify the genuine demand for AI technology:

• Why are your employees willing to pay for their own AI tools?

• What type of work is AI being used for?

• How are workers accessing these tools, is it via personal devices or on business-owned computers?

• Are there any security concerns?

By conducting a detailed investigation and your own company-wide AI audit, you will gain a much greater understanding of the need for AI in your workplace.

You may find that some tools are actually useful. Some AI tools help employees save time, while others are misused. With this information, you can determine your next steps.

Will you embrace the adoption of AI or implement tighter controls?

Implement AI HR policies

By outlining your business stance on AI, you're informing employees about the rules.

With an AI in the workplace policy, you can address issues such as access to AI, the authorisation processes for users requesting access, and combine this with personal device guidelines.

By restricting employees from using personal mobile, tablet or desktop devices at work, managing AI use in the workplace becomes much simpler.

Set rules around what data employees can share with AI

To avoid any data security risks, you should also explicitly detail what employees can and cannot upload into AI platforms.

For example, employees should avoid sharing:

• Personal or sensitive information

• Customer or employee data

• Passwords and login details

• Confidential business information

Make these rules clear and document them within your new AI workplace policy.

Create a list of authorised tools for employees

For even greater oversight, you could curate a list of approved tools for your employees. By doing so you can ensure they are only using tools you and your business consider to be safe for work.

Before approving an AI platform, check how it handles your business data. Consider where information is stored, how long it's kept, who can access it, and whether prompts or data may be used to train AI models.

Carrying out these checks can help you identify potential security risks before employees are given access.

Grant access on a case-by-case basis

To limit access to tools and to gain total control over who uses AI and for what, grant access to only those employees who require it. Set up a system for requesting AI access where your IT teams or line managers can approve or deny requests depending on an employee's use case.

Create guidelines for your staff with the support of HR experts

While AI can be incredibly useful for your employees, the practice of shadow AI is risky. Taking control and managing AI use in the workplace is advised to avoid the risks it can and does pose to businesses.

Need a hand creating some guidelines for your staff? Get in touch with the BrightAdvice team for support.