How do we find the AI tools our staff are already using?

Practitioners often underestimate the prevalence of "shadow AI" – the use of AI tools by employees without official sanction or awareness from IT and security departments. This typically arises from staff seeking efficiency gains or leveraging readily available public AI services. To address this, organisations must move beyond passive policy statements. Active technical controls are essential, including monitoring network traffic for connections to known AI service domains, analysing DNS queries, and inspecting endpoint processes for unapproved applications. Implementing robust data loss prevention (DLP) solutions is also critical to detect attempts to input sensitive organisational data into external AI models, which poses significant intellectual property and confidentiality risks.

A common mistake is relying solely on technical enforcement without addressing the underlying user behaviour or providing approved alternatives. While technical controls can identify usage, they do not inherently prevent it or educate staff on the risks. Organisations should establish a clear process for evaluating and approving AI tools, making this process transparent and accessible. Furthermore, regular and mandatory staff training on acceptable AI use, data handling policies, and the specific risks associated with unsanctioned tools is vital. This training should explain *why* certain tools are restricted, not just *that* they are restricted, fostering a more informed and compliant workforce. This proactive engagement aligns with ISO 42001's emphasis on competence and awareness.