Ask most small business owners if AI is being used in their business, and the honest answer is usually "not really, we haven't gotten into that yet." Then you find out the VA has been pasting customer messages into ChatGPT to draft replies for months, the bookkeeper ran last quarter's sales numbers through an AI spreadsheet tool to save time, and somebody's phone has three different AI chat apps installed that nobody asked about. Nobody hid this on purpose. It just never came up.
That gap — between the AI you know is running in your business and the AI that's actually running in your business — has a name: shadow AI. It's not staff going behind your back. It's staff solving their own workload problem with whatever free tool got the job done fastest, without it ever occurring to them that it was something to ask permission for.
It's worth understanding what this actually looks like day to day, because "ban AI tools" isn't the answer, and neither is ignoring it.
What Shadow AI Actually Looks Like in a Small Business
Customer replies drafted outside your systems
A VA or support person copies a customer's message — name, order number, sometimes an address or payment reference — into ChatGPT or a similar tool to get a quick draft reply, then pastes the answer back into Messenger or email. Faster for them, but that customer's information just left whatever system you actually control and landed on a third-party server you never agreed to.
"Free AI tools" installed without a second thought
Browser extensions that "summarize your emails," phone apps that "translate customer messages," AI note-taking tools bolted onto a video call — most ask for broad permissions during setup, and most staff tap "allow" without reading it, the same way anyone does. Each one is a small, real access point into whatever it's connected to.
Spreadsheets and numbers run through AI for a shortcut
Sales totals, supplier lists, sometimes even payroll figures, pasted into an AI tool to "clean this up" or "make a summary" faster than doing it by hand. Convenient in the moment — and now sitting somewhere outside your business with no record of it ever having left.
None of this is staff being careless on purpose. It's someone with a task to finish, a free tool that clearly helps, and no reason to think twice — because nobody ever framed this as a decision that needed thinking about.
Where It Gets Genuinely Hard
A small business doesn't have an IT department watching network traffic, and you're not going to install monitoring software on your VA's personal phone. Realistically, you can't see most of this happening, and you can't fully stop someone determined to use a tool that makes their day easier.
Banning AI tools outright usually just pushes the same behavior further out of sight — people don't stop finding shortcuts, they just stop mentioning them. And plenty of AI tools genuinely do save time; the goal isn't zero AI use, it's knowing where customer and business data is actually going.
The Honest Model
You don't need a security policy document nobody will read. You need one short conversation with anyone who touches customer data — staff, VA, freelancer, contractor — that covers three things: which tools are fine to use for this work, what should never get pasted into an AI tool (full names with order details, payment references, anything a customer would be upset to see land somewhere else), and a simple "just ask me first" default for anything new. That's it. It fits on half a page, and it works better than a policy nobody reads because someone actually said it out loud.
This isn't about distrust. It's the same reason a shop has a policy for handling cash, even with staff you trust completely — not because you expect a problem, but because a clear default means nobody has to guess.
Closing
Shadow AI isn't a future risk to plan for eventually — for most small businesses with even one other person helping out, some version of it is probably already happening quietly in the background. The fix isn't surveillance or a ban. It's one plain conversation about what's fine, what isn't, and asking first when in doubt.
If you're setting up systems for your business and want customer data handled the right way from the start, that's the part I can help with.
Further reading
- Using AI Well: The Habits That Actually Matter — czerwin.net
- AI Tools That Actually Save Filipino Business Owners Time — czerwin.net