What shadow AI means
Here, shadow AI means AI tools used outside agreed business rules. It may involve a personal chat account, browser extension or unnoticed AI feature in existing software. Start by asking what work colleagues want to complete. This reveals where support is missing and which uses need a decision.
Start the conversation with the task
Explain the purpose of the conversation: “We want to understand where AI helps you and agree a reliable way of working.” Collect tasks and obstacles, not complete personal chat histories or confidential source documents. Agree with the responsible person which data must not be entered while a decision is pending.
- Which task do you want to make easier, and what should the finished result look like?
- Which tool, account or additional feature do you use?
- What do you enter: public text, internal information or details about people?
- What works well, and what do you have to correct in the result?
- Which approved alternative do you know about, and what prevents you from using it?
Keep a short record rather than a collection of chats
Use these fields for each recurring need. The following fictional entry deliberately contains no original correspondence.
- Task and intended result: obtain a German draft translation of supplier emails written in English.
- Current approach: a personal chat account; the responsible person has not yet assessed this use.
- Content involved: names and contact details, internal order information; these categories are sufficient for the record.
- Benefit and rework: a first translation draft helps; item numbers, quantities and dates need checking against the original.
- Open question and owner: which content may be entered into which company account? The team lead obtains a decision from the person responsible for AI tools and data.
Turn the need into a permitted workflow
Add the decision to the record: permitted with a named tool and defined data scope, pending with a person responsible for resolving it, or unsuitable for this purpose with an alternative workflow. Naming an account is not enough: colleagues need to know what they may enter, who checks the output and whom to ask when unsure.
For the fictional translation task, a limited approval could read: “Use the approved company account only to translate public supplier text. Internal order emails stay in the existing translation process until a separate decision is made. The person handling the task checks every draft against the original; questions go to the team lead.” This is one possible company decision, not blanket approval for supplier emails.
AI can help produce a first draft. If checking it takes more work than translating it directly, or the necessary data use cannot be approved, choose a different approach for this task.
Handle possible disclosures separately
A possible disclosure needs its own process: stop further input, notify the responsible contact and record the known circumstances. Responsible specialists assess any further action or notification requirements for the individual case. Do not expect staff to make the legal assessment themselves. An accessible contact helps identify problems early.
Try the agreed workflow in everyday work
Test a typical task with the team using content approved for that purpose. Can colleagues open the account, recognise permitted inputs and check the result? Does the workflow also work under time pressure? If every use requires lengthy individual approval, decide which recurring tasks can be approved in advance.
Budget for setup, familiarisation and support alongside any licences. Record who will collect feedback and when you will review the workflow together. Add recurring obstacles to the same record.