Your team already uses AI. Here is how to find where your data is going

The short answer

If your team uses a computer, they are almost certainly using AI already. Some of it was approved. A lot of it probably wasn't. That unapproved use is what people call shadow AI, and the risk isn't the tools themselves. The risk is that nobody knows which tools are in use, which accounts they sit on, or what company data has gone into them.

You can find out without buying software and without reading anyone's files. It takes a short survey, a look at your accounts and settings, and an honest conversation with staff. The rest of this post walks through how.

Why this matters more in a regulated firm

In most businesses, an employee pasting a draft into a free chatbot is a small problem. In a regulated firm it can be a bigger one.

A biotech team may be pasting protocol text, quality records or unpublished data. A clinic may have someone summarising patient notes. A law firm may have a junior drafting from client documents. An accounting firm may have tax return details going into a tool on a personal plan.

The question in each case is the same. Where did that data go, under what terms, and could you show what happened if someone asked? If the answer is "we don't know", that is the gap worth closing.

Where shadow AI usually hides

It is rarely one dramatic tool. It tends to show up in a few ordinary places.

Personal accounts on public chatbots. Staff sign up with a personal email because it is quicker than asking IT. On some consumer plans, conversations can be used to improve the vendor's models unless a setting is switched off. The business has no admin view of what was shared.

AI features switched on inside tools you already pay for. Email, document, meeting and CRM platforms keep adding AI features. Some are on by default. Your data may already be flowing through them under terms nobody on your side has read.

Meeting notetakers and browser extensions. These are easy to install, often free, and can capture whole conversations or whatever is on screen. They are one of the most common surprises.

Plan mismatches. A firm may have a business account for one tool while half the team uses the free version of the same tool. From the outside it looks approved. It isn't.

How to find where your data is going

You don't need a big project to get a first picture. This is the order I would do it in.

1. Ask people, without blame

Send a short, anonymous survey. Which AI tools do you use for work? Personal or company account? What kind of work do you use it for? Have you ever pasted in client, patient or confidential data?

Make it clear nobody is in trouble. If people think they will be punished, they will under-report and you will be working from a false picture. Most staff are using AI because they want to do their jobs better. Treat it that way.

2. Check the accounts and settings you control

Go through the admin panels for your email, documents, video calls and any business AI subscriptions. Look for which AI features are switched on, who has access, and what the data and retention settings say. Note anything that was turned on by default.

3. Look at sign-ins and installed apps

Most business identity and email platforms show which third-party apps staff have connected with their work accounts. That list is often the quickest way to spot notetakers, extensions and AI tools nobody mentioned. If you have device management, check installed extensions too.

4. Map the data, not just the tools

For each tool, write down what kind of data goes into it. Public marketing copy is one thing. Patient information, client files, quality records or tax data are something else. A tool that is fine for the first can be a real problem for the second.

5. Check the terms for the risky ones

For any tool touching sensitive data, find out which plan it is on and what the vendor's terms say about training, retention and access. Where patient data is involved, check whether a Business Associate Agreement is in place and whether the plan you are on is actually covered by it. Your counsel or compliance lead should make the final call on what your obligations require.

6. Rank what to close first

You will end up with a list. Don't try to fix everything at once. Start with sensitive data going into personal or unapproved accounts. Then the default-on features. Then the policy and training gaps.

What not to do

Banning AI outright tends to push it further out of sight. People keep using it on their phones and personal laptops, and you lose what little visibility you had.

Buying a monitoring tool before you know what you are looking for is another common mistake. Get the picture first, then decide what controls you need.

And don't treat this as a once-off. New AI features ship every month. The picture you take today will drift.

What a good result looks like

At the end of this exercise you should be able to answer a few plain questions. Which AI tools are in use, and on which accounts? What data goes into each one? Which of those are acceptable, and which need to change? Who owns the decision?

If you can answer those, you are in a far better position than most firms. If you can't, that is a useful thing to know too.

How we do this at Assets Digital

This is exactly what our [AI Safety Check](/ai-safety-check) does. Over 10 days we find every AI tool your team uses, what data goes into it, and which risks to close first. We don't need to read patient, client or quality records to do it. You get a plain-English findings report and a ranked list of fixes, and you keep it whether or not you work with us afterwards.

If you want help closing the gaps, that is what Safe AI Setup is for. If you want it kept locked down as tools and rules change, that is Managed Safe AI.

FAQ

What is shadow AI?

Shadow AI is any AI tool or feature staff use for work without the business approving it or knowing about it. It includes personal chatbot accounts, browser extensions, meeting notetakers and AI features switched on inside existing software.

How do I find out what AI tools my staff are using?

Combine an anonymous staff survey with a review of your admin settings, connected third-party apps and installed extensions. The survey tells you what people use. The settings tell you what they didn't mention.

Is it safe for staff to use free AI tools with company data?

It depends on the tool, the plan and the data. Some consumer plans can use conversations to improve the vendor's models unless a setting is changed, and the business has no admin control. For patient, client or confidential data, use only tools on plans your firm has approved.

Should we just ban AI?

Usually not. Bans tend to drive use onto personal devices where you can't see it. Approving a small set of tools, with clear rules on what data can go in, is easier to enforce.

How long does it take to get a clear picture?

A basic picture can come together in a couple of weeks if someone owns it. Our AI Safety Check takes 10 days.

---

*This post is general information, not legal advice. Assets Digital is not a law firm and does not certify compliance. Your counsel, compliance or quality lead decides what your rules require.*