If you asked your team which AI tools they used this week, would their answers match yours?
At plenty of companies, they wouldn’t. In a 2026 survey commissioned by Okta, 90 percent of executives said they were confident they knew which AI tools their employees used. In the same survey, 52 percent of knowledge workers surveyed admitted to using AI tools their employer never approved. That’s a lot of confident people about to be surprised.
Using AI at work without approval has a name: shadow AI. We covered the basics in Protecting Your Business from Shadow AI. This post covers the practical side: how to spot it before it costs you money, and what to do once you find it.
What shadow AI can cost a small business
Most employees using AI on the side mean well. They want to finish a proposal faster or clean up a messy spreadsheet. Trouble starts when that spreadsheet holds client names or payroll details and gets pasted into a consumer AI tool that hasn’t been approved for business use. Depending on the service and the account being used, you may no longer control how that information is stored, retained, or used.
Here’s where the costs come from when nobody notices.
Problems that go unnoticed get more expensive. IBM’s 2026 Cost of a Data Breach Report found the average breach took 247 days to identify and contain. Security incidents involving shadow AI rose to 43 percent, more than double the previous year. IBM’s 2025 report found that organizations that discovered a breach themselves saved about $900,000 compared with those who heard about it from the attacker. Those are big-company numbers, but the lesson scales down: the sooner you find a problem, the cheaper it is to fix.
Florida’s notification clock is short. If a breach gives unauthorized access to certain personal information belonging to Florida residents, businesses generally must notify the people affected as soon as practicable and without unreasonable delay, no later than 30 days after determining that a breach occurred or having reason to believe one occurred, subject to statutory exceptions. Failure to meet Florida’s notification requirements can result in civil penalties beginning at $1,000 per day and reaching as much as $500,000 per breach. Whether a particular AI incident qualifies as a reportable breach is a question for your attorney. Either way, you can’t meet a deadline for something you don’t know happened.
Some costs never show up on an invoice. For a small business, the most painful loss may be a long-time client who leaves after learning their files went into a chatbot, or a confidentiality agreement broken without anyone realizing it.
How to detect shadow AI without being a tech expert
You don’t need special software to get started. Most of these steps take an afternoon.
A word of caution: these steps are a starting point, not a substitute for professional tools designed to detect shadow AI. Properly configured monitoring tools can provide ongoing visibility into AI use that manual checks miss. Start with the steps below, then work with your IT provide to decide what additional monitoring your business needs.
1. Ask your team, and make it safe to answer
The simplest detection tool is a short, no-blame survey. Ask which AI tools people use and what kind of information goes into them. Tell everyone up front that nobody is in trouble. People share more when they aren’t worried about getting written up, and you’ll learn which tasks your team wants help with.
2. Follow the money
Look through company card statements and expense reports for monthly charges from AI services. A $20 subscription is easy to overlook, and it often tells you exactly which tool someone relies on.
3. Watch for AI note takers in meetings
Check the attendee list on video calls. AI note takers usually appear as an extra participant with a name like “Notetaker” or “Meeting Assistant.” AI note takers can record or transcribe a meeting, potentially capturing conversations with clients or other participants who may not realize the tool is running. If one shows up and nobody can explain it, find out whose it is.
4. Ask your IT provider for a connected-apps report
Many AI tools ask permission to connect to company email or files. Microsoft 365 and Google Workspace both keep a list of which outside apps have that access. Your IT provider can pull this report quickly and tell you what each app can reach.
5. Look at browser extensions on company computers
AI extensions that summarize web pages or rewrite emails can often read whatever is on the screen. A quick look at the extensions list on each company computer can turn up tools nobody mentioned in the survey.
6. Don’t overlook remote employees
Remote work can make shadow AI harder to spot, especially when employees use personal computers or personal AI accounts. Company-managed devices give your IT provider much better visibility into installed applications and browser extensions. If employees use personal devices, your survey, expense review, and acceptable use policy become even more important.
What to do once you find it
Finding shadow AI is half the job. Banning AI outright tends to push it further underground. A 2026 TrustedTech study found that nearly one-third of employees would keep using AI tools even if their workplace banned them and discipline was possible.
A better approach is to replace the risky free tools with business-grade options that protect your data, then put the rules in writing with an AI acceptable use policy. When the approved tool works well, the free one loses its appeal. Repeat your review every few months, since new AI tools show up faster than anyone can keep track of them.
Need help finding shadow AI?
Not sure which AI tools your team is using, or what to do about the ones you find? CMIT Solutions of Fort Lauderdale can help you uncover shadow AI using professional detection tools, then replace it with secure options your team will actually want to use. Contact us to get started.
Frequently asked questions
How do I detect shadow AI in my business? Start with a no-blame employee survey and a review of company card statements for AI subscriptions. Then ask your IT provider for a report of outside apps connected to your Microsoft 365 or Google Workspace accounts.
Do I need special software to detect shadow AI? Not to get started. A survey, an expense review, and a connected-apps report will turn up a lot. They depend on what people report and what you happen to check, though, so they will miss things. Professional monitoring tools are the better long-term answer, and they work best alongside a clear policy.
What happens if an employee puts customer data into an AI tool? Depending on the service and account settings, the AI provider may store that information, and you may have less control over how it is retained or used. Depending on the data and circumstances, sharing it could trigger legal obligations, including Florida’s 30-day breach notification rule. Talk with your attorney and IT provider right away.
Should I ban AI tools at work? Bans tend to backfire, since many employees keep using AI anyway. Approving secure tools and setting clear rules usually works better.
Are AI note takers legal in Florida? Florida generally requires all parties to consent before a private communication is recorded or intercepted. An AI note taker that records or transcribes a meeting without the required consent can create legal risk. How the law applies depends on the circumstances, so check with your attorney about your specific situation.
