Shadow AI is any use of AI at work that the business never approved: a personal chat account, an AI-built shortcut around a process, a tool someone set up on their own. In a company without an IT department, there's no team whose job is to look for it, so finding it and deciding what happens next falls to the owner.

Should a small business ban shadow AI?

I'd look before banning anything. In my view a workaround is worth reading as a sign that someone found the official process slow or awkward and tried to build something better with AI. Look at what they built, ask what it risks for the company and its clients, and then decide whether it becomes the official way of working or gets stopped.

What risk questions should I ask about an AI workaround?

Start with the ones John Matoso asked on Coffee Brief Ep 3: what are the implications, what are the risks, and how are we putting our clients at risk. If the answers are clean, the workaround is a candidate for your official process. If client material is exposed, it stops until that is fixed.

Do I need security software to deal with shadow AI in a small business?

I wouldn't start there. I think a 5 to 50 person company can handle the first round with a conversation, a written list, and a decision on each item. The first job is the owner looking at what people actually built.

What if a workaround is better than our official process?

Then make it the official process. Write down how it works, name who owns it, and tell the team it is now the standard. The person who built it found a better way of working, and bringing it into the open lets the whole team use it.

Shadow AI in a Small Business With No IT Department: What to Do This Week

Shadow AI is your staff using AI in ways the business never signed off on. In a small business with no IT department, that lands on the owner. Don’t start with a ban. This week, look at what people built, ask what it risks for you and your clients, then make each one official or stop it.

What does shadow AI look like when there’s no IT team?

It looks like someone on your team quietly doing part of their job differently, with AI, and not mentioning it. With no IT team, the person who has to notice is you.

The worry is fair. Work you’re responsible for may be going somewhere you never agreed to, and if a client asks, you’re the one who answers. I’ve written about that side in Your Company Is Running on AI Vendors You Never Approved.

I’d still start by looking, because what I expect you’ll find is people trying to do their jobs better.

Is an AI workaround always a problem?

No. I read a workaround as a possible sign that one of your processes isn’t working for the people using it.

On Coffee Brief Ep 3, John Matoso, a change consultant who works on the people side of rollouts, told me about something he watched in a workplace. Staff were encouraged to use AI to search an internal knowledge base. Right away, some of them said, “I don’t like how this works,” and went looking for a workaround.

John’s job is usually to eliminate workarounds. He found this fascinating for two reasons. It creates a problem. And, in his words, “that energy and that creativity might actually be informing us of something.”

He asked whether you sanction the people who found a better method or celebrate them. Then he put it this way:

“You called it a workaround, but the workaround might actually be the solution.” (Coffee Brief Ep 3)

Somebody on your team may be doing the same thing: they didn’t like how a task worked and used AI to build a way around it, which tells you something about that task.

What should I do about shadow AI this week?

Look first, ask the risk questions second, decide third. That order is mine, built around John’s questions, and I’d use the same order on a 10 or 20 person team.

Look at what they built. Ask the person to show you on their screen. Ask what they didn’t like about the old way. Ask the way you’d ask about any good idea someone brought you.
Ask the risk questions. John’s were plain: “What are the implications? What are the risks?” And then the one I’d weight most in a service business, “how are we putting our clients at risk”. Write the answers down next to each workaround.
Make it official or shut it down. If the answers are clean and it works better, it becomes the process. Write down how it works and who owns it. If it puts client material at risk, it stops, and you fix the complaint that made someone build it.
Tell the team what you decided. One message covering what’s now official, what stopped, and why.

How do I decide what to keep and what to stop?

Run every workaround through the same three columns. The rows below are illustrations, not cases from a specific company.

Workaround you find	Risk question to ask	Keep or stop
AI rewrites a clunky internal checklist into something people actually follow	What are the implications if this becomes the version everyone uses?	Keep. Make it the official checklist and name an owner.
AI drafts replies to routine client emails	How are we putting our clients at risk? What goes into the prompt?	Keep only once client names and confidential details stay out of it.
A client contract gets pasted in to summarize it	What are the risks if that text is stored or reused?	Stop until you’ve set up a way you’re comfortable with.
AI searches your own notes faster than your shared drive does	What does this tell us about the shared drive?	Keep, and fix the drive.

The last column is your call, and it’s fine for different workarounds to land differently.

What if the answer is to shut it down?

Then shut it down, and tell the person which risk question it failed.

Fix what they were working around, too. Something annoyed a capable person enough that they built an alternative, and that complaint is still sitting in your process.

John made a related point earlier in the same conversation: spending money on policies you may not even be able to enforce gets costly, and that funding is better put toward the kind of experimentation we’d been talking about. In a small business, I’d spend that effort on asking his questions about real work your team has already built.

If nobody brings you anything to look at, I wrote about one reason that happens in Your Team Is Hiding It, and Your No Is Why.

Where do I start?

Pick the person on your team who seems to have gotten faster lately. Ask them to show you how. Run it through John’s questions and decide by Friday: official or stopped.

If you’d like a second set of eyes on what you find, book a free 30-minute call and we’ll go through your list together.

For the strategy side of AI in your company, I write about that at davidchung.ai.