Shadow AI Tools
A photograph of a whiteboard is a document, and it left the building.
What Is Shadow AI Tools?
Nobody in this exercise does anything reckless. A colleague recommends a tool that saves twenty minutes, it is free, it is one tap away in the app store, and it does exactly what it promises. The cost is that a photograph carries everything legible in it, and a free consumer plan says plainly what it does with an upload. You work through what actually left the company, check the tool against the approved list, and file the request for review that should have happened fifteen seconds earlier.
What You'll Learn in Shadow AI Tools
- Treat a photograph as a document, because an AI tool reads everything legible in it including the names and dates nobody meant to hand over
- Read what a free consumer plan says about uploads: training on what you send, long retention, and an explicit line about business information
- Check a tool against the organisation's approved list before the upload rather than after, since the check takes seconds and only works beforehand
- Understand that a tool absent from the list is unreviewed rather than allowed, and that the two are not the same thing
- Say so when company material has already gone in, because a review that does not know about the upload cannot tell anyone what to do about it
- Recognise that uninstalling an app ends the next upload and does nothing about the one already made
Shadow AI Tools — Training Steps
-
Standup Just Finished
You run product at Ardquist Furniture, and the Q4 board behind your desk is where the quarter actually lives. Standup finished ten minutes ago and the board has the morning's decisions on it. Your phone buzzes. It is Dev from the design studio.
-
What Is On The Board
Before you photograph anything, it is worth reading what is actually written up there: Halvorsen Home, pilot 14 Nov. A retail customer by name and the day they go live. Ardquist has announced neither. 3 stores, oak and walnut lines. How large the deal is and which products it covers. Pricing locked, legal signed. The deal is done and still unannounced, which is the version of it a competitor would most like to have. Brightmere Living, launch 2 Dec. A second unannounced customer, and a bigger one: the full range across 11 stores. Exclusivity 6 months. A commercial term that was agreed in private. Blockers, veneer supply and a photography slot in week 44. Where the plan is fragile, and when. DO NOT SHARE outside product team. Somebody has already decided who this board is for. Every line of it is legible, and all of it fits in one photograph.
-
Free, And One Tap Away
Dev is right that it saves twenty minutes. The Play Store has it, it costs nothing, and nobody has to approve anything.
-
The Listing
Five million downloads, four and a half stars, and a page of people saying it saved them time. None of that is a security review.
-
Installed
It installs in seconds, the way a free consumer app is meant to.
-
Snap It. Sort It.
Jotlens opens on an empty chat with a camera button. This is the moment the exercise is about, and it does not feel like a decision at all.
-
Photograph The Board
You point the phone at the Q4 board and take the picture.
-
Turn This Into Notes
The photograph is in the chat. Now you ask for what Dev promised.
-
It Works
It is fast and it is accurate, which is the problem. Every name and every date came through exactly as written.
-
The Free Plan
There is a small grey pill in the corner of the app that says what free pays for.
Security Framework Coverage
CIS Controls
- CIS 14.4 Train Workforce on Data Handling Best Practices
- CIS 2 Inventory and Control of Software Assets
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- ID.AM Asset Management
GDPR
- Art. 5 Principles relating to processing of personal data
- Art. 28 Processor
EU AI Act
- Art. 4 AI literacy