Shadow AI in the workplace: your employees are already using AI without telling you

The quarterly report came out faster than usual. The summary is clean, the tone is spot on. What management doesn't know: the analyst had a public conversational AI review it, margin figures included.

This scene is playing out right now in most Quebec businesses. Employees haven't waited for internal policies to adopt AI. The phenomenon has a name: Shadow AI.

According to a Gartner survey of 302 cybersecurity leaders (2025), 69% of organizations suspect or have proof that employees are using prohibited public generative AI tools.

What is Shadow AI in the workplace?

Shadow AI refers to the use of artificial intelligence tools by employees without company approval or oversight. ChatGPT, Gemini, Claude, or Perplexity, used via personal accounts for work tasks, are the most common forms.

Unlike traditional shadow IT, it requires no installation. A browser is all it takes: you paste a document, upload a spreadsheet, or ask for a summary. The action seems harmless. But the data has just left your perimeter.

The distinction between traditional AI and generative AI matters here: Shadow AI almost always involves the latter, which is accessible to everyone without technical skills.

What is the scale of shadow AI in 2026?

Individual AI usage far exceeds what companies report: two-thirds of people use AI regularly, while only one-fifth of Canadian businesses report using it. The gap between these two figures is the shadow zone.

Key figures to keep in mind:

• 75% of knowledge workers use AI at work, and 78% of users bring their own tools, according to the 2024 Microsoft and LinkedIn Work Trend Index (31,000 respondents, 31 countries).
• 66% of people use AI regularly, according to the Trust, attitudes and use of AI study by KPMG and the University of Melbourne (2025), conducted with over 48,000 respondents across 47 countries.
• 69% of organizations suspect or have confirmed the use of prohibited generative AI tools, according to Gartner (2025).
• 19.2% of Canadian businesses were officially using AI in the second quarter of 2026, according to Statistics Canada.
• Only 39% of AI users have received training from their employer, according to Microsoft and LinkedIn (2024).

At PlanAxion, we see the same thing in our ERP mandates and AI workshops: when management asks who is already using AI, half the hands go up, and almost none of those uses had been tracked.

What risks does Shadow AI pose to your business?

Three risks dominate: confidential data leaks, unverified errors entering your deliverables, and regulatory non-compliance. None of these appear on a dashboard until an incident brings them to light.

Data leaks first. A client contract pasted into a free public tool can be stored and reused by the provider. Gartner predicts that by 2030, more than 40% of organizations will experience security or compliance incidents related to shadow AI.

Errors next. According to KPMG and the University of Melbourne (2025), 66% of users rely on AI responses without verifying their accuracy, and 56% admit to having made mistakes at work because of AI.

Compliance, finally. In Quebec, Law 25 governs the disclosure of personal information to third parties, which includes public AI tools. Our article on Law 25 and cloud computing details the required assessment process.

Should you ban ChatGPT and public AI tools at work?

No. An outright ban pushes usage to personal devices, where you lose all visibility. The numbers show it: 69% of organizations observe or suspect the use of tools that are officially banned (Gartner, 2025). The ban already exists; it just doesn't work.

Employee demand is legitimate. They are looking to manage an overflowing workload, and AI helps them do it. Punishing this initiative is effectively punishing productivity, while still keeping the risk.

The approach that works: offer an approved tool, as simple as the ones employees are already using, and clear rules on what can be entered into it. A well-equipped employee has no reason to use their personal account.

Shadow AI is first and foremost a business signal: your employees found value in AI before your official plan was in place.

How can you manage AI usage without stifling momentum?

Four steps are enough to bring AI out of the shadows: an honest inventory of usage, a concise policy, approved tools, and training tied to real-world tasks.

Start with the inventory, without a witch hunt. A declared amnesty (tell us what you use, no one will be blamed) produces a more accurate map of usage in two weeks than any technical audit.

Next, the policy. One page, not thirty: approved tools, categories of data that must never leave the organization (personal information, unpublished financial data, source code), and the rule of human review before any external submission.

Finally, training, focused on the teams' actual tasks. Only 39% of users have received training from their employer (Microsoft and LinkedIn, 2024). It is the cheapest and most profitable lever on the list.

Some identified use cases deserve more than just management: they deserve a real project. That is the role of a structured AI workshop: transforming individual initiatives into prioritized use cases based on the problem, expected value, available data, and required effort. At PlanAxion, this exercise takes place over 4 weeks and the investment varies depending on the scope; it is confirmed during a short exploratory call.

Transparency note: the figures cited come from public surveys (Gartner, Microsoft and LinkedIn, KPMG and the University of Melbourne, Statistics Canada). Scopes and definitions vary from one study to another, and none of these figures describe your specific situation.

What should you take away about shadow AI before your next executive committee meeting?

Your employees are already using AI: the only decision still in your hands is whether that usage will be visible, managed, and profitable. The inventory takes two weeks. The policy fits on one page. The 2026 Canadian figures show that companies that structure this momentum gain a head start over those that ignore it.

Frequently asked questions about Shadow AI

What is Shadow AI?

Shadow AI refers to the use of artificial intelligence tools—most often public chatbots like ChatGPT, Gemini, or Claude—by employees without company approval or oversight. It differs from traditional shadow IT in its simplicity: no software installation is required; a browser and a personal account are enough.

What proportion of employees use AI at work without authorization?

According to Gartner (2025), 69% of organizations suspect or have proof that employees are using prohibited generative AI tools. The 2024 Work Trend Index from Microsoft and LinkedIn already found that 78% of AI users were bringing their own tools to work without waiting for their employer's approval.

Should you ban ChatGPT at work?

A total ban simply pushes usage to personal devices, leaving you with zero visibility. The most effective approach combines an approved tool of comparable simplicity, a one-page policy on restricted data, and training tied to real-world tasks. Bans should be reserved for sensitive data categories, not the tool itself.

What should an enterprise AI usage policy include?

Four elements: a list of approved tools with their corporate accounts, categories of data that must never be submitted to a public tool (personal information, unpublished financial data, source code), a requirement for human review before any external distribution, and a point of contact for proposing new use cases.

Is Shadow AI covered by Law 25 in Quebec?

Law 25 governs the disclosure of personal information to third parties, which includes providers of public AI tools. Submitting personal customer or employee information to a consumer-grade tool without prior assessment exposes the company to penalties. A Privacy Impact Assessment (PIA) is the expected standard.