Shadow AI means AI tools your staff use that nobody approved or recorded. You can't govern what you can't see. Start here.
- - Ask. A short, no-blame survey: which AI tools do you use at work, and for what? Say clearly that you want to know, not to punish.
- Check sign-in logs. If you use single sign-on, look for AI services. Look at browser extensions on work machines too.
- Check subscriptions. Expense claims and card statements show tools people pay for themselves.
- Check meetings. Note-taking bots joining calls are common.
- Check your existing software. Many products now ship with AI features. Find out which are switched on.
- Check where files go. Look for client documents being sent to personal email or uploaded to outside services.
What to do with what you find. For each tool, decide: approve it, restrict it, or retire it. Then record the decision in your AI use register. Don't just ban everything. People will find a way round it.
Technical controls beat policies. APRA's April 2026 letter noted that firms often relied on policy and after-the-fact checks, not controls that stop the problem. Where you can, block what you don't approve.
(APRA letter)