Shadow AI response plan for regulated firms

Category: Controls · Practical response plan

Our vision is AI work people can bring into the open. The practical challenge starts when a colleague says, “I have already been using this.” A useful response makes it possible to disclose the facts, stops further exposure where necessary, and gives the underlying work a destination. A warning email alone does none of those things.

This plan uses “shadow AI” to mean work-related AI use outside the organisation’s agreed approval path. That includes a personal chat account, an extension inside an approved browser, an assistant added to a meeting, or an automation that sends documents to an external model. These are working definitions for this resource, not legal classifications. The steps below are recommendations to adapt with your security, privacy and employment advisers.

1. Open a reporting door people can actually use

Give staff a named contact and a short form. Ask about the task before asking about the tool. “What were you trying to finish?” produces a more useful answer than “Why did you break the policy?” Explain who receives the disclosure, who can see the record and what happens next. Do not promise immunity that management has not authorised. Separate a candid mistake from deliberate concealment through your established people processes.

Use this intake record without copying sensitive material into it. A document location and a description of the information are usually more useful at this point than another copy of the document. Never ask someone to paste a password or access token into a reporting form. Route any suspected credential exposure to the security team through its established channel.

Intake field	What to record
Work and owner	Task, business team, accountable manager and reason the existing route did not meet the need.
Service and access	Service name, feature, account type, extension or integration, and whether access remains active.
Information involved	Data categories, source-system reference and whether files, recordings or messages were included. Keep content out of this form.
Known activity	Approximate period, people involved, recipients and whether any output was acted on or sent onward. Mark estimates.
Uncertainty	Unknown retention, sharing settings, connectors, training use or downstream copies; person assigned to resolve each.
Immediate action	What has been paused, by whom, and the safe alternative offered while the case is assessed.

2. Contain the exposure without destroying the account of it

Ask the person to pause the affected workflow and stop new uploads while the case is assessed. If an integration can still act, identify who can suspend it and verify the suspension. A meeting assistant may retain access through an invitation or connector after its visible window closes. A shared conversation link may create a separate exposure. List those paths rather than treating logout as a universal remedy.

Do not tell everyone to erase all history immediately. The incident lead should decide what evidence is necessary, where to preserve it and who may access it, alongside any deletion request. Equally, avoid collecting every conversation “just in case”. Preserve a narrowly scoped record through the existing incident process. Record what is unknown, including whether a provider’s deletion action covers backups, shared links or downstream systems.

The Irish Data Protection Commission’s guidance on AI, large language models and data protection advises organisations to understand what personal data an AI product uses, where it goes, and whether a provider retains or reuses it. Those questions belong in the assessment. This plan does not decide whether an event is legally reportable: refer that question promptly to the people responsible for incident and regulatory assessment.

3. Triage the facts, not the colleague’s seniority

Use three practical routes. For public information and unacted-on drafting, record the facts and review the workflow through ordinary approval. For confidential material, personal information, unexplained access or uncertain onward sharing, involve security and privacy specialists. For an integration able to send messages, change records or trigger transactions, assess and contain its authority as well as its data access. A senior user does not make a tool approved; a junior user does not make the event trivial.

Follow the output as well as the input. Was the generated summary copied into a client file? Did somebody rely on it when deciding what to investigate? Was an invented citation circulated? Assign a work owner to check those downstream uses against original sources. Removing an uploaded file does not correct an inaccurate conclusion already used elsewhere. Document corrections in the business record where the work belongs.

4. Worked case: a summary that crossed a boundary

Fully synthetic example: a fictional regulated firm discovers that an analyst used a personal AI account to summarise an internal complaints briefing. The briefing contained case references and narrative details. The analyst removed names but left distinctive circumstances. Nothing in this example describes a real firm, person, incident or Synainesi operation.

Decision	Completed synthetic record
Immediate boundary	Analyst pauses uploads; team manager supplies a manual summary route. Security checks for shared links and connected storage.
Evidence	Case SH-EXAMPLE-A records the service feature, account type and source-document reference. Detailed material stays in a restricted incident file.
Open questions	Privacy lead checks remaining identification context. Security lead checks retention and sharing settings. Provider deletion scope remains unknown.
Downstream review	Complaints owner compares the circulated summary with the briefing and records any corrections in the complaints workflow.
Disposition	No further use of that route for internal briefings. A request for an approved summarisation workflow proceeds separately; the incident assessment remains open.

5. Make the exception route narrower than a blanket waiver

An exception request should name the task, information allowed, service feature, account arrangement and human reviewer. Record prohibited inputs, prohibited actions, an expiry and withdrawal triggers. State who can authorise it and which unresolved questions prevent authorisation. Approval of public-document drafting should not silently become approval to upload an internal investigation file or connect a mailbox.

Give the requester one of three clear answers: approved within a written boundary, held pending specified evidence, or declined with an alternative. For a held request, assign each question to someone who can answer it. For a declined request, explain the blocking risk and what evidence could change the decision. Keep the incident response separate from future workflow approval: a useful business need does not retrospectively authorise past use.

6. Learn without building a surveillance archive

Review recurring unmet needs, confusing rules and delayed decisions. Share anonymised learning examples only after checking whether the details still identify someone. Do not turn incident reports into a ranking of employees by AI activity. If you propose technical discovery measures, assess their purpose, scope and employee impact separately; this plan is not permission to read personal accounts or capture every prompt.

Close a case when its stated actions are complete, not merely when a tool is blocked. A useful closure note identifies the containment evidence, remaining uncertainty, downstream correction, accountable owner and review trigger. If deletion cannot be confirmed, say so. If a safer workflow still needs a decision, keep that request visible. Bringing AI work into the light means giving people a clear boundary and a credible way forward.

General information, not legal advice. Adapt this resource to your organisation, activities and applicable requirements with qualified advisers. Examples and reference identifiers are fully synthetic.