GoldcoteGOLDCOTE
Invest
Guide · Shadow AI

A simple shadow-AI policy for small businesses

Your team is already using AI. The question is whether it happens in tools and accounts you know about, with data rules everyone understands.

Updated September 2026

In short

Shadow AI is staff using AI tools the company has not approved, often by pasting company or client data into personal accounts. Banning AI rarely works; people use it anyway. A better policy fits on one page: a list of approved tools, clear rules for which data may go where, company accounts only, AI agents with their own limited access and a human approval for changes, a review step before AI output reaches clients, and a named person to ask.

Why banning AI does not work

AI saves people real time, so a ban mostly moves the use out of sight: into personal accounts, personal phones and browser extensions nobody reviewed. You lose visibility without reducing the risk.

A short policy that approves good tools and sets data rules does the opposite. People get a safe way to work fast, and the company knows where its data goes.

The one-page policy

Copy this structure and fill it in. Keep it to one page so people actually read it.

  • Approved tools: name them, with the plan you pay for. Anything else needs a quick request.
  • Data rules: public and internal information may go to approved tools; client-confidential, personal or regulated data only to tools approved for it, or not at all.
  • Accounts: company accounts only. No company data in personal AI accounts.
  • AI agents: agents get their own limited access, never a person’s password. Keys are kept in a vault, not in files.
  • Changes need a person: anything that moves money, deletes data or contacts a customer waits for a human approval.
  • Review before it leaves: AI-written content is checked by a person before it reaches a client.
  • Records: agent access is logged, and logs are kept for a set period.
  • Questions: one named person answers “can I use this?” within a day.
  • Review date: the policy is revisited every six months.

Rolling it out in a week

Day 1: ask people which AI tools they use, without blame. Day 2: pick the approved list and buy business plans where needed. Day 3: set up agent access properly (vault, per-agent grants, approvals). Day 4: share the one-page policy and walk through it in fifteen minutes. Day 5: move any company data out of personal accounts.

Checklist

Policy checklist

  • There is a written list of approved AI tools and plans.
  • Everyone knows which kinds of data may go into which tools.
  • No company data lives in personal AI accounts.
  • AI agents have their own limited access, and changes wait for a person.
  • Someone is named to answer questions, and the policy has a review date.

Giving the team a sanctioned way to use agents

A policy works best when the safe way is also the easy way. The MoltenRock apps give a team’s Macs a sanctioned setup for agents: keys in a vault, per-agent grants, approvals and a log.

Questions

What counts as shadow AI?

Any AI tool used for work that the company has not approved, including chat assistants in personal accounts, browser extensions and agents connected to company systems with someone’s own password.

Should we block ChatGPT and similar tools?

Usually not. Approve a business plan of the tools people find useful, set the data rules, and block only what cannot meet them.

Does the policy need a lawyer?

A one-page internal policy usually does not. If you handle regulated data, have your adviser check the data rules section.

How do we handle AI agents, not just chat tools?

Treat agents like a new kind of user: their own limited access, no shared passwords, a person approving changes, and a log.

More guides