I had a coffee recently with a friend who sits on the management team of a small business. I asked how they were getting on with AI, whether anyone was using it, what the appetite was like.
The response was a shrug. "We haven't really done anything yet."
So I asked a follow-up: "Do you know if your staff are using ChatGPT?"
The answer came back immediately: "I hope not."
That response stuck with me. Because "I hope not" isn't a policy. It's not a position. It's a gap. And it's exactly where most small businesses are with AI right now, whether they realise it or not.
If you're a business owner who feels like you haven't started your AI adoption journey yet, this is worth fifteen minutes of your time. The journey has probably already begun. You just haven't been in the room for it.
This is shadow AI. It's already in your business.
Shadow AI is any AI tool being used in your business without formal approval or oversight. It's not dramatic. It's a team member drafting emails in ChatGPT. Someone summarising meeting notes with an AI tool. A junior member of staff using a writing assistant they found online. None of it malicious. All of it unmanaged.
There are usually two reasons it stays hidden. The first: staff worry they'll be judged for it, seen as cutting corners or not doing the real work. The second: they've already been blocked by IT and found their own route around it through personal subscriptions, their own devices or home connections.
Neither is a people problem. Both point to the same gap: no clear direction from the business on what's acceptable.
One thing worth noting on IT providers: your MSP's job is security and infrastructure, not deciding which tools your team uses to do their jobs. That decision is yours. If tools have been restricted without your instruction, and your team doesn't understand why, the predictable outcome is workarounds you can't see. If you don't know exactly what's been blocked, that's a conversation worth having.
Why it matters before you go any further
Here's the part that surprises most business owners. When your team pastes customer information into ChatGPT to draft a response, that data goes to OpenAI's servers. Under UK GDPR, you're the data controller, meaning you're legally responsible for what happens to that data whether you approved it or not.
Did your customer consent to their data being processed by OpenAI? Almost certainly not. Do you have a data processing agreement in place with OpenAI? Probably not. That's a potential GDPR breach from one well-intentioned team member trying to write a better email. GDPR fines start at 2% of turnover. This isn't theoretical.
Beyond compliance, AI outputs that go out without review carry errors. I've seen businesses send AI-generated client responses that were factually wrong. Those clients didn't come back.
So before you think about rolling out AI tools more formally, before you start evaluating platforms, running pilots or briefing your team on new workflows, getting visibility on what's already happening is step one.
The starting point is simpler than you think
The root cause of almost every shadow AI situation isn't careless staff or malicious intent. It's the absence of any guidance at all. Most employees want to do the right thing. They just don't know what that is, because nobody has told them.
You don't need a lengthy policy document. You need something short and clear that answers three questions for your team: which tools are approved, what data must never go into any AI system, and who reviews anything before it reaches a client or goes public. That's the foundation. Everything else builds on top of it: the adoption strategy, the tool selection, the efficiency gains.
Start there. Have the conversation. Find out what's already running in your business. That fifteen minutes is the most useful thing you can do right now.