Even without an AI policy, your staff are almost certainly using it
Edward Bernays, Sigmund Freud’s nephew, pioneered the use of psychology to shape what the public thought and bought. Today I’m borrowing a page from his playbook and trying a little fear, because AI does pose real threats to your business. Usually talk of AI threats will sound like extracts from a Terminator script, but the ones worth worrying about are duller and far more likely. If your business hasn’t given staff approved AI tools or clear guidelines, some of its confidential information is probably already sitting in personal AI accounts you have no control over.
Edward Bernays, the man who taught advertisers to sell to our fears.
What shadow AI looks like
Shadow AI is the term for staff using AI tools their employer hasn't approved, usually through personal accounts. In practice, it tends to be someone using the free version of ChatGPT on their own phone to draft a tricky reply to a customer or make sense of a spreadsheet.
Accenture surveyed employees in Ireland and the UK in early 2026. Only 34% of Irish employees said they used AI tools provided by their employer, while 30% said they sourced their own. A separate survey of 1,000 Irish workers by Landmark Technologies found that 87% use AI tools for work in some form. Put those together and it's a fair bet that some of the AI use in your business isn't on any list of approved software, assuming there is a list.
Why staff do it
Most people using AI this way aren't trying to get around the rules. Often there are no rules to get around. Microsoft's 2026 Work Trend Index for Ireland found that only 40% of workers felt they'd had enough AI training or guidance, and fewer than half said their employer gave them the tools they needed.
So people do what they've always done with a useful tool the office doesn't provide: they bring their own, the way a previous generation emailed files to their personal Hotmail to finish at home. Microsoft's UK research found that more than 40% of shadow AI users chose their tools because they already used them in their personal lives. Those users also reported saving just under eight hours a week, which goes some way to explaining the enthusiasm.
Where the risk is
So, the scary part. Most of what goes into these tools is harmless. An email asking to move a meeting is not a security incident. The problem is what else goes in. Landmark found that one in 10 Irish employees had entered confidential company data into an unapproved AI tool in the past year, and 11% had sent AI-generated content to a customer without reviewing it.
Personal ChatGPT accounts, including the paid Plus plan, can use what you type to train OpenAI’s models unless the user switches it off in the settings, and very few people go looking in the settings. If that content includes customer names, contact details, or anything more sensitive, your business may be handling personal data in a way GDPR doesn’t allow, without anyone having decided to. Business plans don’t train on your data by default and come with independent security audits and a contract. You’re still trusting the provider to do what it says, but at least it has said it to you in writing.
Then there's the output. AI tools still get things wrong with complete confidence, and an unchecked figure in a customer quote is your problem, not the chatbot's.
Why a ban won't fix it
The instinct is to block ChatGPT on work laptops and send a stern email. That rarely works. Microsoft's UK survey found that 71% of employees had used unapproved AI tools at work, and 51% still did so every week. Fewer than a third were worried about the privacy of the company or customer data they were putting in.
A ban mostly moves AI use from the work laptop to the phone in people's pockets, where you can see even less of it. It also tells staff the business would rather they did things the slow way, which is a hard sell when the fast way is free.
What to do instead
Start by finding out what's already happening. Ask your team which AI tools they use and what they use them for, and make it clear nobody is in trouble. You'll only get honest answers if people believe that part.
Then make a couple of decisions. Pick one tool the business will pay for, on a business account that keeps your data out of model training. Write a short policy, a page is plenty, saying what can and can't go into it. Customer personal data, financial details, and anything covered by a confidentiality agreement are the obvious exclusions. When Deloitte asked in early 2025, 90% of Irish companies had no generative AI policy, so a single page would put you ahead of most.
Source: Deloitte, reported in the Echo, February 2025
Finally, show people how to use the approved tool well. Staff drift back to their own tools if the approved one feels worse, and it will feel worse if nobody has shown them what it can do.
If you do one thing this week, ask your team the question. The answers will tell you more about how your business uses AI than any survey.
The risks are real, but none of them takes long to fix. I suspect Bernays wouldn’t approve of my messaging here. You’d think a decade in news publishing would have taught me more about “if it bleeds, it leads”, but the fix here is less propaganda and more a one-page policy. If you’d like help writing yours, choosing the right tool, or getting your team using it well, I run practical AI workshops for businesses across Ireland. Book a free 20-minute call, and we’ll work out where to start.