Your team could expose client data without clicking a phishing email. All it takes is pasting it into the wrong AI tool.
Your team could expose client data without clicking a phishing email.
All it takes is pasting it into the wrong AI tool.
There is usually no bad intent. Someone uses an app they already know from home. Nobody has given them an approved alternative. Or nobody has explained what is safe to upload and what is not. They get their answer, close the tab, and carry on. You may never know it happened.
That quiet gap is what people call Shadow AI. For Hull and East Yorkshire SMEs handling client information, it is a real business risk.
What Shadow AI actually looks like
Shadow AI is not a dramatic hack. It is everyday workarounds:
- Dropping a client spreadsheet into a free chatbot to clean it up
- Pasting email threads into an AI summariser
- Using a consumer AI app on a personal phone to rewrite a proposal
- Letting an unapproved meeting bot join a Teams call and record it
None of that needs a malware click. The data leaves because someone was trying to get the job done faster.
Why it matters for UK SMEs
Public AI tools often use what you type to improve their models, unless you are on a properly contracted business plan with the right settings. Once client names, contracts, passwords, or bank details are in that prompt, you have lost control of where that information sits.
That can mean breach of client confidentiality or contracts; UK GDPR headaches if personal data was involved; harder Cyber Essentials or insurer conversations if you cannot show you control tools; and trust damage that is difficult to repair.
What good looks like
You do not need to ban AI. You need clear rules and a short list of approved tools.
1. Write an AI Acceptable Use Policy staff can actually read
2. Approve tools (for example Microsoft Copilot in your tenant) and say what is banned
3. Classify data before anyone pastes it - public, internal, restricted
4. Make reporting easy when someone makes a mistake
5. Train briefly so people know AI is a junior assistant, not a safe vault
Free template to get started
We have put together a free AI Acceptable Use Policy template for UK SMEs. It covers approved tools, what staff can and cannot paste, and how to report a mistake fast.
Get the template: https://go.selectgroup.co.uk/ai-policy
Watch: Shadow AI in under two minutes
Watch the 60-second video: https://youtu.be/81_Z6fupB04
Want a deeper check?
If you would rather we review how AI is used across your team, ask about our Human Risk Report or book a short Shadow AI chat with Select Group.
Select Group - IT support for Hull and East Yorkshire businesses
01482 586 550 · [email protected] · selectgroup.co.uk
Share this post: