What shadow AI looks like
- Pasting customer emails or contracts into a public chatbot to summarise them.
- Using free AI transcription or note-taking tools in client meetings.
- Browser extensions that read page content to “help” write replies.
- AI features switched on by default in software you already use.
Why it matters
Privacy: entering personal information into an external tool is a use or disclosure under the Privacy Act, and the tool’s provider may retain or use it. The Office of the Australian Information Commissioner (OAIC) recommends, as a matter of best practice, that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools.
Confidentiality and IP: commercially sensitive information, client data under NDA or unreleased product details can leave your control.
Accuracy: generative AI can produce confident but wrong answers (“hallucinations”). Unchecked outputs can end up in advice, reports or customer communications.
Accountability: if nobody knows a tool is being used, nobody is checking it, and if it influences decisions about people, it may also be relevant to the new automated decision transparency rules.
A practical response in six steps
- Find out what’s being used. A short, anonymous staff survey together with a look at network and SaaS logs usually reveals more than expected.
- Offer approved alternatives. Business or enterprise versions of AI tools often provide better controls over data retention and model training.
- Set clear rules. A one-page AI acceptable-use policy covering what data can and can’t be entered, and what needs human review.
- Record approved uses. Add them to your AI register with an owner for each.
- Train people. Short, practical examples work better than long policy documents.
- Review regularly. AI features change quickly; review tools and settings at least every six months.
Where to find authoritative guidance
Refer to the OAIC, the Federal Register of Legislation, and the Australian Department of Industry. New to the terminology? See our AI governance glossary. This article is general information, not legal advice.