Skip to content
AImori
EN
Free for Chrome
Menu

Shadow AI in small businesses: when employees bring their own AI

Shadow AI means employees use AI services such as ChatGPT, Gemini or Claude for work without the company having chosen, checked or governed them – often with personal accounts. It is usually well meant: people want to get things done faster. The risk arises when company and customer data end up in services the company has no contract with and no control over.

What studies show

  • Widespread: in the 2024 Work Trend Index by Microsoft and LinkedIn (31,000 respondents in 31 countries), 75% of knowledge workers said they use AI at work. 78% of AI users bring their own AI tools.
  • Personal accounts: according to a Cyberhaven analysis (2024), most ChatGPT use at work ran through personal rather than corporate accounts.
  • Swiss SMEs: in AXA's 2025 SME labour market study, about a third of the SMEs surveyed already use AI and another good third are testing it. Only about a third of the SMEs using AI have clear data protection guidelines for it.

The figures come from surveys and analyses by individual organisations and are not directly comparable. But the direction is clear: AI is being used whether or not the company governs it.

Why a ban rarely helps

A blanket AI ban often just moves usage to personal phones or browsers – where the company sees nothing at all. It works better to enable AI use and make it safe.

Four steps to governed AI use

  1. Take stock: ask your team openly which AI services they use and for what. No blame.
  2. Choose allowed services: pick one or two services with a business account and a contract. Clarify where data is processed.
  3. Clear rules: one page is enough. What may go in, and what never (customer data, bank details, social security numbers, passwords, health data)? More in the guide May employees enter customer data into ChatGPT? – or start with the free AI policy template.
  4. Catch mistakes: rules are easily forgotten under pressure. AImori checks input on AI sites locally in the browser and warns before sending. Via policy it also steers users to the allowed services: on other known AI sites, a notice or block page appears with a button to the approved tool. Via Intune or Group Policy, the extension reaches every workstation quickly, without servers or user accounts.

Free for small businesses and IT partners. AImori sends no content to IT or third parties: the check runs in the browser. Rollout for companies · How to get AImori

Read next: IBAN, social security numbers & co.: what never belongs in AI tools · Data loss prevention (DLP) for AI tools

Sources

Information as of 14 October 2026.

Free for Chrome