Skip to content

Shadow AI policy for worker-built apps

A shadow AI policy covers the apps and agents staff build with AI, not only the chatbots they use. To write one that works, offer an approved alternative first, a time-boxed amnesty to register what already exists, clear data rules, a fast path to approve new tools, and proportionate enforcement, measured with discovery data rather than self-report. This page covers the stance on unsanctioned use; the AI acceptable use policy template covers what's allowed.

Who this is for

IT managers and security leads writing, or replacing, a policy on AI tools staff use without approval. You get the scope, the stance, amnesty and detection rules, an enforcement ladder, metrics and copyable clauses. About 8 minutes.

What should the policy cover?

Unsanctioned AI use means workers using AI tools the business hasn't approved. Most published policies stop at chat tools and the data people paste into them. Workers now build with AI too, so the scope needs five kinds of tool:

  1. Chat and writing tools, including the AI features built into approved SaaS that the approved-tools list doesn't cover for that data class.
  2. AI app builders and low-code tools that generate and host apps from prompts.
  3. Agents and automations: scheduled jobs, workflow-tool flows with AI steps, and agents that act under a person's account or a service identity.
  4. Browser extensions that read pages or send content to an AI service.
  5. MCP servers and connectors that give an AI tool access to company systems.

The policy applies on company and personal accounts alike, whenever company data or company work is involved. A personal account is the case discovery can't see, which is why never-do 3 forbids shared apps on personal accounts.

Why enable first instead of banning?

Because bans hide use instead of stopping it. In Cisco's 2024 privacy survey, 27% of organizations had banned generative AI at least temporarily, yet 48% of the privacy and security professionals it surveyed admitted entering non-public company information into such tools.1 Over half of the workers BCG surveyed in 2025 said they'd use unapproved tools if the business didn't provide them.2 By 2026, vendor surveys put unapproved use at 52% to 66% of office workers (the higher figure from office professionals at large companies in four countries).34 These are surveys, several from vendors, and no controlled study compares bans with enablement. But no evidence points the other way, and US federal policy now requires agencies to write an acceptable-use policy that lets staff use generative AI without undue risk.5

The best-known ban shows the pattern. After staff pasted source code into a public chatbot in 2023, Samsung banned generative AI on company devices.6 In June 2026 the vendor announced that Samsung was deploying its enterprise chat and coding tools to large groups of staff, which reports describe as a sanctioned tool replacing the ban (a vendor announcement, so read it as such).7

Enabling first also protects you. A trade secret stays one only while the owner takes "reasonable measures" to keep it secret.8 An approved, no-training tool can be part of the evidence of those measures; staff pasting secrets into whatever tool they found isn't.

Read unsanctioned use as a desire path: the route people took because the approved one didn't serve them. Each tool you find tells you a job that needs a paved route, and the policy's answer is to pave it safely or offer a better route, not to fence it off (pave the desire paths).

Don't: ban and hope (AP12)

A ban without a sanctioned alternative drives use out of view and leaves you with no logs, no contracts and no owners. Approve one default tool for each common job before you restrict anything, then narrow the exceptions. The pattern and its sources are on failure patterns.

What do the amnesty and detection rules say?

Not legal advice

Not legal advice. This page summarizes laws as of October 2026 for a general audience. It was written with an AI legal-research persona and hasn't been reviewed by a lawyer for your situation. Ask your counsel.

Amnesty. The policy names a fixed window, usually 30 to 60 days, in which anyone can declare unsanctioned tools and apps and register or migrate them. The promise is limited: no discipline for disclosing past unsanctioned use, but no amnesty for intentional data exfiltration, for harassment, or for carrying on after being told to stop. Counsel and HR review that wording before it's published. The terms and a message template are on find the AI-built apps you already have.

Detection. The policy says plainly where IT looks for unsanctioned AI use (expense data, sign-in logs, OAuth grants, network logs, endpoint and browser reports, and platform inventories) and what the data is for: finding apps and owners, deciding which desire paths to pave and support, and removing exposed data or credentials. It isn't used to rank or discipline individuals. Analyzing staff traffic or devices is employee monitoring, which can need prior written notice or a written policy (the notice check, and the state and Canadian rows, including Ontario's written monitoring policy and the provincial private-sector privacy acts). Saying it in the policy is part of giving that notice; it doesn't replace the notices the law requires, and the notice must name the same purposes.

Maps to: NIST CSF 2.0 ID.AM-02 (inventory of software and services) and NIST AI RMF GOVERN 1.6 (AI inventory) for detection; SOC 2 privacy criterion P1.1 and CC2.3 (notice and communication) for the monitoring notice; NIST AI RMF GOVERN 1.2 and ISO/IEC 42001 A.2.2 for the policy itself. Mapping reuses controls you already have; it isn't certification.

Don't: punish amnesty disclosures

If anything disclosed in good faith during the window leads to discipline, nobody discloses again. Exposures found through the amnesty are handled as incidents and fixed with the builder.

What's a fair enforcement ladder?

Enforcement after the amnesty should be proportionate, predictable and consistent with your disciplinary policy. Most cases are a missing approval, not misconduct, so most of the ladder is help. Discovery data feeds the first three steps only, and never starts step 4 or 5 on its own.

Step Trigger What happens
1. Pave Discovery shows people using an unapproved tool for a job Record it as a desire path. Approve the tool, or tell everyone the approved alternative and the tool request route, in a general message rather than a note to each person found
2. Register or migrate An unregistered app that others use, found by discovery, the amnesty or the help desk Ask the owner to register it or move it to an approved tool by an agreed date; IT helps. It's support, and nothing is recorded against the person
3. Contain An exposure, a floor breach or a never-do (for example, a public link to customer data, or a key in the front end) Close access and remove the exposed data or credentials now, handle it as an incident, fix with the builder
4. Manager and HR The person ignores or refuses a containment request, or carries on after being told to stop A conversation with the manager under the normal disciplinary policy
5. Discipline Deliberate misuse established through the normal HR or incident process, not from discovery data alone: taking data out, harassment, hiding an app after being asked, bypassing controls The normal disciplinary process, with HR and counsel

Apply the same ladder to leaders. In one vendor survey, 81% of office professionals at large companies believed leaders follow different AI rules from everyone else,4 and a policy that exempts executives in practice teaches staff to ignore it.

Don't: enforce a policy you haven't enabled

If the approved path takes weeks, step 1 is a dead end and people stop asking. Publish the median time to approve a tool, and treat a long wait as a defect in the program, not in the people waiting.

Which metrics show it's working?

Measure with discovery data, not self-report (A-005). Report these monthly to the enablement lead:

  • Discovered but unregistered apps: the count, and its trend. It should fall after the amnesty.
  • Traffic to unapproved AI services: distinct users per month from your network or sign-in data, aggregated, never per person.
  • Time to a tool decision: the median days from request to answer.
  • Requests after a decline: people asking for the same capability again, which signals the approved alternative isn't good enough.
  • Desire paths paved: the top jobs found by discovery, and how many now have an approved route. Feed the list to the paved-road backlog.
  • Amnesty declarations: how many apps and tools were declared, and how many of those discovery would have missed.

Which clauses go in a policy on unsanctioned AI use?

These clauses sit beside the acceptable use policy. They don't repeat its allowed-use rules.

Illustrative composite: clauses to adapt

1. Scope. This policy covers AI tools, app builders, agents and automations, browser extensions and MCP servers used for company work or with company data, on any account.

2. Approved first. Use the approved tools for the data class involved. If none fits, request one through the tool request route. We aim to answer within five working days.

3. Amnesty. Until date, you can declare any unapproved tool or app you use. You won't be disciplined for disclosing past unsanctioned use. The amnesty doesn't cover intentional data exfiltration, harassment, or carrying on after you've been told to stop, or other limits agreed with HR and counsel (have counsel review this wording).

4. How we find unsanctioned use. IT reviews expense, sign-in, network, endpoint and platform data to find AI tools and apps and their owners, to decide which approved routes to add, and to remove exposed data or credentials. We use it for those purposes only, under the employee monitoring notice or policy, and not to rank or discipline individuals.

5. What happens if we find it. We follow the published enforcement ladder: pave, register or migrate, contain, then your manager and HR only if you ignore a containment request or misuse data deliberately. Reporting a mistake promptly is never a disciplinary matter.

6. Review. The enablement lead reviews this policy every six months with HR and counsel.

Record the decision

Record the adoption of the policy once, using the decision record template.

Illustrative composite

Title: Adopt an enable-first policy on unsanctioned AI use · Status: accepted · Date: YYYY-MM-DD · Owner: enablement lead (a role) · Approved by: HR lead and counsel

Context. Discovery shows AI tools and builder apps in use that we never approved.

Decision. Approve a default tool for each common job, run a 45-day amnesty, then apply the five-step enforcement ladder. Detection data is used only to find apps and owners, choose which desire paths to pave, and remove exposed data or credentials; it never starts discipline on its own.

Alternatives considered. A ban on all unapproved AI tools (rejected: bans hide use, AP12). No policy, rely on the acceptable use policy alone (rejected: it says nothing about amnesty, detection or enforcement).

Consequences. We report discovered versus registered apps and the time to a tool decision monthly.

Review by: six months from the date above.

Questions to ask your counsel

  1. Can we promise no discipline for amnesty disclosures, and what limits should the promise state?
  2. Does our employee monitoring notice or written policy cover the detection this policy describes, and name its purposes, in each state and province where we have staff?
  3. Is the enforcement ladder consistent with our disciplinary policy and employment contracts?
  4. Could employee use of public AI tools have undermined trade-secret status or privilege for anything we care about, and what should we do about what the amnesty reveals?

Assumptions and evidence

  • A-003 (High for use; Medium for the unapproved share, from vendor surveys): we expect most would-be builders to use AI tools already, many of them unapproved; test this with your own network or sign-in data before the policy launches.
  • A-004 (Medium): we expect a ban without an approved alternative to hide use rather than stop it; test this by comparing unsanctioned traffic before and after you approve a default tool.
  • A-005 (Medium): we expect self-reported use to undercount; test this by comparing amnesty declarations with discovery counts.

Evidence: surveys (several from vendors), one company's ban and its later replacement by a sanctioned tool (the latter a vendor announcement), US federal policy and trade-secret statute; no controlled study comparing bans with enablement. Facts on this page are as of October 2026.

  1. Cisco, 2024 Data Privacy Benchmark Study release: 27% of organizations had banned generative AI at least temporarily; 48% of the privacy and security professionals surveyed had entered non-public company information, Jan 2024. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m01/organizations-ban-use-of-generative-ai-over-data-privacy-security-cisco-study.html [vendor], accessed 2026-10-21. ↩

  2. BCG, "AI at Work 2025: Momentum Builds, but Gaps Remain", Jun 2025. https://www.bcg.com/publications/2025/ai-at-work-momentum-builds-but-gaps-remain [survey], accessed 2026-10-21. ↩

  3. The Register, report on an Okta survey (fieldwork March 2026): 52% of knowledge workers used unauthorized AI tools, 27 May 2026. https://www.theregister.com/ai-ml/2026/05/27/bosses-blinded-by-confidence-about-shadow-ai-use-by-workers/5247275 [vendor], accessed 2026-10-21. ↩

  4. PagerDuty, press release on a Wakefield Research survey of 1,250 office professionals at companies with $500M or more in revenue in Australia, Japan, the UK and the US: 66% used AI tools they believed weren't permitted; 81% believe leaders follow different AI rules, 11 Jun 2026. https://s206.q4cdn.com/635206389/files/doc_news/PagerDuty-Report-Finds-Two-Thirds-66-of-Office-Professionals-Have-Used-Unauthorized-AI-Tools-at-Work-2026.pdf [vendor], accessed 2026-10-21. ↩↩

  5. US Office of Management and Budget, Memorandum M-25-21 (generative AI acceptable-use policy requirement), 3 Apr 2025. https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf [primary], accessed 2026-10-21. ↩

  6. Bloomberg, "Samsung Bans Staff's AI Use After Spotting ChatGPT Data Leak", 2 May 2023. https://www.bloomberg.com/news/articles/2023-05-02/samsung-bans-chatgpt-and-other-generative-ai-use-by-staff-after-leak [news], accessed 2026-10-21. ↩

  7. OpenAI, announcement of an enterprise chat and coding-agent deployment at Samsung Electronics, Jun 2026. https://openai.com/index/samsung-electronics-chatgpt-codex-deployment [vendor], accessed 2026-10-21. ↩

  8. 18 U.S.C. §1839(3), definition of "trade secret" (reasonable measures to keep it secret), Defend Trade Secrets Act. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section1839&num=0&edition=prelim [statute], accessed 2026-10-21. ↩