Shadow AI in the Workplace: Legal Risks for UK Businesses and Employers

If your staff are using AI tools without approval, your business may already carry legal risk it has never assessed. Staff may upload confidential data to third-party platforms. Weak internal policies can make misuse hard to manage. As a result, shadow AI has become a practical governance issue for UK employers.

Employees are using AI tools at work, often before the business has approved them or reviewed the supplier terms. Many businesses have not yet decided what information staff may safely upload. This informal use of AI has a name: shadow AI. It can expose UK businesses to legal, contractual and governance risk. The risks arise through confidentiality breaches, data protection failures, intellectual property uncertainty, weak supplier contracts and unclear staff rules.

The immediate issue is practical rather than theoretical. Staff may already use AI tools to summarise documents, draft emails, take meeting notes or review code. Some may screen candidates or generate customer-facing content. The business may not know which tools staff use, what data they enter or what contractual terms apply. If so, it may be carrying risk it has never assessed.

We have written this article for founders, directors, HR teams, operations leads and in-house counsel. It is also for managers responsible for AI governance, staff policies, data protection or client confidentiality.

Key takeaways

• Shadow AI means staff are using AI tools without formal approval, legal review or management oversight.
• The main risks are confidentiality breaches, UK GDPR issues, uncertain IP ownership, inaccurate outputs and weak internal controls.
• Lack of formal approval may not protect the business if employees use AI tools in the course of work.
• UK businesses should identify which AI tools staff use, review higher-risk supplier terms, update staff policies and train employees.
• When using AI with client data, personal data, source code, HR records or customer-facing work, legal review is particularly important.

What is shadow AI?

Shadow AI means using artificial intelligence tools in a business without formal approval, legal review, IT oversight or management control. It is similar to shadow IT, where employees use unauthorised software or cloud tools. However, AI tools can create additional risk because they may process, store, analyse or generate information.

In practice, shadow AI takes several forms. Staff use generative AI chatbots to draft emails, summarise documents, prepare reports, rewrite customer responses or analyse information. The legal risk depends on what staff enter, what the supplier can do with it and how they use outputs.

AI meeting note-takers and transcription tools record and summarise internal meetings, client calls, HR meetings or board discussions. These tools capture confidential information and personal data, sometimes without the business knowing where they store it.

Employees also use AI coding, design and content tools to create code, visuals, written content and customer-facing materials. This raises questions about ownership, accuracy, third-party rights and quality control.

AI features also sit inside everyday tools. Examples include recruitment platforms, CRM systems, office software, search tools and customer service systems. Staff often use them without realising, which makes AI use harder to spot and control.

Shadow AI often starts innocently. A member of staff wants to work faster, improve a draft, summarise a long document or generate ideas. The risk is that staff may share confidential information, personal data or commercially sensitive material with a third-party system. Often nobody has first checked that the business permits this, that it is secure and that a contract protects it.

Why shadow AI is a legal and commercial risk

AI adoption has moved faster than many internal policies and contract review processes. Employees can access powerful tools instantly, often using a work email address, a free account or a low-cost subscription. That creates a gap between what senior management thinks is happening and what staff are actually doing.

The UK’s approach to AI regulation currently relies heavily on existing legal frameworks, regulator guidance and context-specific risk management. No single UK AI law currently gives businesses one simple set of answers for every workplace use of AI. Instead, businesses need to assess AI use through their existing legal obligations. These include data protection, employment law, contract law, confidentiality, intellectual property and any sector-specific regulation. Businesses should also keep this under review as UK data protection and AI-related guidance develops.

For directors and senior managers, the key issue is governance. Clients, regulators, insurers, investors or buyers may ask how the business controls staff AI use. If they do, it will help to show clear policies, supplier review processes, approved-tool records and staff training. A business that only discovers AI use after an incident is in a much weaker position.

This is also a commercial issue. Many customer contracts, investment rounds, tenders, audits and corporate transactions now involve detailed questions. These cover data security, software ownership, third-party tools and operational controls. Unmanaged AI use makes those questions harder to answer with confidence.

The two-contract problem behind shadow AI

Most shadow AI risk comes back to two sets of legal documents. The first is the external supplier contract. The second is the internal staff contract or policy framework.

The external supplier contract

1. The external supplier contract governs the tool itself. Every AI tool has terms. These may be online terms of service, SaaS terms, enterprise terms, data processing terms or acceptable use rules.

If staff sign up informally, no one may have reviewed those terms. The employee may have clicked “accept” using a work email address. They may then have uploaded business documents and started using outputs in live work. That can create uncertainty over data use, confidentiality, ownership of outputs, liability, termination and governing law. It can also leave doubt over whether the tool is suitable for business use at all.

For higher-risk tools, the business should review the supplier terms before staff use them for sensitive work. That includes client work, personal data, confidential information, software development, HR processes and business-critical functions. The review should look in particular at data use and training rights, confidentiality, security and international transfers. It should also cover IP ownership, liability caps, indemnities, termination and deletion. For more detail, see AI Tools at Work: What to Check in the Terms Before Your Business Signs Up.

The internal staff contract and policy framework

2. The internal staff contract and policy framework governs your people. This includes employment contracts, consultancy agreements, confidentiality obligations, disciplinary rules and IT policies. It also covers staff handbooks, data protection policies and any AI acceptable use policy. If those documents are silent on AI, the employer may struggle to show that staff broke a clear rule.

General confidentiality and IT provisions may help. However, they often do not explain what staff may do with prompts, uploads, outputs or meeting recordings. The same applies to customer data, candidate information, source code and client documents. This creates an enforcement gap. The business may be responsible to clients, customers, regulators or counterparties. Yet it may lack clear internal rules that allow it to prevent, control or discipline risky AI use.

Why lack of formal approval may not protect the business

A common misconception is that never officially approving the AI tool protects the business. Lack of approval may be relevant, but it will rarely be the whole answer.

An employee may use an AI tool in the course of their work. If so, the business may still face legal and commercial consequences. For example, it may have breached a client confidentiality obligation if staff uploaded client documents to an unapproved tool. It may have breached data protection law by processing personal data without appropriate safeguards. Or it may have used AI-generated material in customer deliverables without checking it was accurate, original or safe to use.

From an employment perspective, the absence of authorisation may be difficult to rely on. That is the case if the business had no policy, gave no training or tolerated similar behaviour. The same applies if it encouraged staff to use AI without explaining the limits. The employer’s position is far stronger where it can point to clear rules and staff training. Evidence that employees knew what the business prohibited also helps.

Clients, insurers, investors and acquirers may also look beyond formal approval. Instead, they may ask what controls the business had in place to prevent unauthorised use. A clear AI policy, supplier review process and approved-tool register put a business in a stronger position. Discovering AI use only after a problem arises puts it in a weaker one.

The main legal risks created by shadow AI

Shadow AI can affect several areas of law at once. The risk profile depends on the tool, the data, the use case, the supplier terms and the business sector.

Confidentiality and data protection

1. Confidentiality and client information is often the first exposure. Employees may upload documents to summarise or analyse them. These might include client contracts, board papers, investor decks, pricing schedules, customer complaints, HR files or legal documents. The business may owe confidentiality duties to a client, customer, investor, employee or counterparty. If so, using an AI tool may amount to disclosure to a third-party supplier. Whether the business may do that depends on the relevant contract, privacy notice and supplier terms. This matters most for professional services firms, agencies, consultancies, software developers, financial services businesses and companies handling sensitive commercial information.
2. Data protection and UK GDPR apply wherever the business handles personal data. That covers customer support, call transcription, employee monitoring, HR notes and meeting summaries. It also covers performance reviews, CRM data and recruitment records. The business needs to consider lawful basis, transparency, data minimisation, security, retention, processor terms and international transfers. It should also consider whether it needs a data protection impact assessment.

The risk increases with special category data. Examples include health information, racial or ethnic origin, biometric data and trade union membership. AI tools make this harder to control. Staff may paste personal data into systems without understanding where it goes or how long the system keeps it. They may also not know whether the supplier uses it to improve the tool.

Intellectual property and accuracy

3. Intellectual property and output risk arise because AI can create material that looks polished and ready to use. Yet that material may not be legally safe for commercial use. Businesses need to consider who owns AI-generated outputs and whether supplier terms restrict commercial use. They should also consider whether the tool could generate similar outputs for other users. Another question is whether an output may reproduce third-party material.

For technology companies especially, this can become a due diligence issue. Investors and buyers may ask whether the business can prove ownership and control of its software, content and commercial assets. The answer may depend on the supplier terms, the level of human involvement and the type of output. It may also depend on whether the output reproduces or closely imitates any third-party material.

4. Accuracy and professional standards matter because AI tools can produce confident but inaccurate outputs. Staff may use AI to generate legal, financial, technical, HR, regulated or customer-facing content. An inaccurate statement could then cause contractual loss, customer complaints, regulatory issues, reputational damage or professional negligence exposure. The higher the stakes, the more important it becomes for a person to check the output before anyone uses it.

Employment and regulatory risk

5. Employment and disciplinary control depends on having clear internal rules. An employee might upload sensitive information to an unapproved tool or use AI to make decisions about customers or candidates. They might also rely on inaccurate output. The business may then need to investigate and potentially act. Its position is far stronger where it has a policy, training and evidence the employee knew what the business prohibited.
6. Regulatory and sector-specific risk affects businesses in financial services, legal services, healthcare, education, recruitment and insurance. These businesses may face additional expectations around governance, record-keeping, fairness, explainability, outsourcing and human oversight. A regulated business should be especially cautious about staff using AI for client communications, advice or suitability checks. The same caution applies to claims handling and regulated decision-making.

Is your business already using AI tools with client documents, employee data, customer information, source code or confidential commercial material? If so, we can help provide a focused AI legal risk review and practical recommendations to reduce exposure.

Common workplace examples of shadow AI

Shadow AI usually appears through everyday workarounds rather than formal transformation projects. Staff may invite AI meeting note-takers into meetings to record and summarise discussions. These tools can capture personal data, client instructions, HR issues, legal advice or board matters. The business should therefore know when staff may use them and whether staff must tell attendees. It should also know where the tool stores transcripts and how long it keeps them.

Generative AI document summaries are one of the most common and risky forms. Staff may not see pasting a contract or employee record into a tool as sharing information with a third party. AI in sales and marketing can produce adverts, product descriptions and customer responses containing inaccuracies, unsupported claims or copied wording. Approval before publication therefore matters. AI coding assistants can raise questions about code provenance, open source material, security and ownership. Software businesses should therefore manage them through both supplier review and development policies.

Recruitment use deserves particular care because it can affect individuals directly and may involve automated or partly automated decision-making. Some employers use AI to make or materially influence hiring decisions. They should consider transparency, fairness, human oversight and discrimination risk. They should also consider any UK GDPR safeguards that may apply to significant automated decisions. If employers ignore those safeguards, AI-driven shortlisting or scoring can lead to unlawful discrimination and data protection breaches. It can also lead to challenges to the fairness of the process. That increases the risk of claims, reputational damage and regulatory scrutiny. We address this in detail in our related article, Using AI to Hire? The Legal Risks UK Employers Need to Manage.

What an AI acceptable use policy should do

An AI acceptable use policy should be practical, specific and enforceable. Vague wording about using AI “responsibly” is unlikely to give staff enough guidance or give the employer enough protection.

A good policy states which tools staff may use, which they must not use and which need prior approval. An internal register should ideally support this. It shows who owns each tool, what staff may use it for and when someone last reviewed it. The policy explains clearly what staff must not put into unapproved tools. Examples include client confidential information, personal data, special category data, source code and trade secrets. Others include financial records, board papers, legal advice and non-public commercial information. The policy should also explain when staff may use anonymised or redacted information instead.

The policy makes clear that staff must check AI-generated outputs before use, matching the level of checking to the risk. It should also make clear that employees remain responsible for work they produce with AI assistance. Where the business serves clients, the policy should address whether staff may use AI in client work. It should also cover whether the business needs to disclose this or obtain client consent, and what quality control applies. Finally, the policy should state that the business may deal with any breach under its disciplinary process. Training should accompany the policy, since staff comply more readily when they understand the reasons behind the rules.

Getting ahead of shadow AI: what management should do

A proportionate plan is usually better than a blanket ban that staff ignore. The first step is discovery. Ask teams which AI tools they use, what for, what information they input and whether they use any outputs externally.

Do not frame this as a blame exercise. If staff fear discipline for admitting AI use, the business will not get an accurate picture. From there, the business should separate low-risk uses from high-risk ones. Low-risk uses include internal brainstorming. High-risk uses include uploading client files, processing candidate data or generating code. This lets legal, IT and management attention go where the risk is greatest.

Before approving higher-risk tools, the business should review their supplier terms. The review should cover data use, training rights, confidentiality, security, international transfers, IP ownership, liability, termination and deletion. The business should then integrate AI rules with its wider framework. That means updating employment contracts, staff handbooks, IT and data protection policies, confidentiality clauses and disciplinary rules. The AI policy should not sit in isolation. Training should use real examples from the business. Managers should know how to handle requests for new tools and what to do if they discover unauthorised use.

Responding to shadow AI: what to do if you discover it

If you have already discovered staff using unapproved AI tools, the response should be calm and structured. Start by identifying what has happened. Which tools did staff use, who used them and for what? Did they involve personal data, confidential information, client documents, source code or commercially sensitive material? Check too whether anyone used outputs externally in customer communications, published content, advice or decision-making.

Preserve relevant evidence such as prompts, outputs, account details, uploaded files, meeting transcripts, supplier terms and internal approvals. Avoid deleting anything before considering whether you need it for investigation, compliance, insurance or contractual purposes. This matters particularly where there may have been a data or confidentiality breach.

Then assess whether you need to take urgent remedial steps. Depending on the facts, these may include contacting the supplier, restricting access, deleting data or informing clients. They may also include assessing a data breach, notifying insurers or taking employment action. The response should be proportionate, and the business should document its reasoning.

Finally, treat it as a prompt to improve governance. Shadow AI is often a sign that staff want better tools and clearer processes. A good response gives them a safe, approved route rather than pushing the behaviour underground.

How the Jonathan Lea Network can help with shadow AI

JLN can help UK businesses take a practical, legally controlled approach to AI adoption. Depending on your position, we can assist with:

• AI legal risk review: identifying where your business uses AI. We then pinpoint which use cases create the highest legal, contractual or governance risk.
• AI acceptable use policy: preparing clear staff rules on approved tools, prohibited uploads, human review, client work and disciplinary consequences.
• AI supplier contract review: reviewing terms of service, SaaS terms, data processing agreements and enterprise terms. We check data use, model training, confidentiality, IP ownership, liability and international transfers.
• Employment contract and handbook updates: making sure workplace AI rules are enforceable and aligned with disciplinary procedures.
• Data protection support: advising on UK GDPR, DPIAs, privacy notices, processor terms, data retention and international transfers.

Related shadow AI articles

• Using AI to Hire? Legal Risks for UK Employers Using AI Recruitment Tools – how AI screening, scoring and ranking tools affect discrimination, data protection, automated decision-making safeguards and the defensibility of recruitment decisions.

Frequently Asked Questions: Shadow AI

Contact Us

We provide most enquiries with an indicative scope of work and fee estimate, based on the information you share. We aim to respond within one working day.

In the same email you will be invited to arrange a 20-minute complimentary, no-obligation video consultation, should the proposed scope of work and fee estimate be of interest. This initial discussion is designed to better understand your requirements, refine the scope and ensure our approach is fully aligned with your objectives, at the end of which we will email you a definitive formal fee estimate to consider and approve.

Where you would prefer to receive initial advice and guidance from the outset, or where a short introductory call would not be the most appropriate starting point, we may instead recommend a 2.5-hour fixed-fee appointment, starting from £700 + VAT. This enables us to review the information you provide, discuss your situation with you and provide considered, tailored advice at an early stage.

To make an enquiry, please email us at wewillhelp@jonathanlea.net, complete our contact form, or call us on 01444 708640.

VAT is charged at 20%.

This article is intended for general information only, applies to the law at the time of publication, is not specific to the facts of your case and is not intended to be a replacement for legal advice. It is recommended that specific professional advice is sought before relying on any of the information given. © Jonathan Lea Limited.