Shadow AI: legal teams face a visibility gap

Artificial intelligence may be at work within your company, even without approval. An employee uses a personal account to summarise a meeting, translate a document or draft an email: routine tasks that can expose corporate information to tools outside the organisation’s control. This is the so called “shadow AI” – the use of unapproved or unmonitored artificial intelligence tools – which presents legal departments with a visibility challenge before they can even address governance.

The issue is explored in an article by Tara Lawler and Matthew Hamilton, lawyers at Morgan Lewis, published on 7 October in Reuters’ Legal Industry section.

The authors cite two studies to illustrate the scale of the phenomenon. According to the one realized by Akamai, a cloud computing and cybersecurity company, 47% of workplace interactions with AI chatbots take place through unmonitored personal accounts. Meanwhile, the survey commissioned by PagerDuty among 1,250 office professionals at large companies in the United States, the United Kingdom, Australia and Japan found that 66% had used AI tools at work despite believing that company policies did not permit it. The latter finding specifically reflects the survey sample and employees’ reported understanding of their employers’ rules.

To address the issue, Lawler and Hamilton propose assessing how AI is actually being used: which tools employees rely on, for what tasks and with what data. The authors recommend a non-punitive approach, supported by risk classification, approved tools that are practical to use and training tailored to employees’ roles.

For legal departments, this means working with IT, security and compliance teams to understand what data is being shared and what safeguards apply. Summarising a public document and uploading a confidential contract do not expose a company to the same risks. Terms of service also matter: companies need to know whether data is retained, for how long and whether it may be used to train AI models.

The point raised by the Morgan Lewis lawyers is the gap between formal procedures and everyday behaviour. AI governance – increasingly falling to general counsel and their teams – must also account for tools that bypass procurement and approval processes. According to Lawler and Hamilton, understanding these uses should be the first step towards establishing rules that employees can apply in their daily work.