A workplace ban can prohibit employees from using ChatGPT, but it cannot guarantee they stop. Microsoft’s 2023 study warned that people may work around bans by turning to less-known, potentially less-secure AI tools; a 2025 survey reported that some employees keep workplace AI use secret. Neither finding proves that bans always create shadow AI. They do show why organizations need a workable, visible way to use AI safely—not just a rule against it.
What is shadow AI?
Shadow AI is the use of generative AI tools for work without the organization’s knowledge, approval, or governance. It may include an employee entering work material into a public chatbot, using an unapproved AI feature inside another service, or moving to a different tool after an approved one is blocked. The defining problem is not that every AI use is harmful; it is that the organization may not know what is being used, for what task, or with what data.
As an Amazon Associate I earn from qualifying purchases.
Why a ban may hide use instead of stopping it
In its December 2023 study commissioned by Microsoft, ISMG reported that 38% of business leaders and 48% of cybersecurity leaders expected their organizations to continue banning workplace generative AI. The same survey found that 73% of business leaders and 78% of cybersecurity professionals intended to take a walled-garden or own-AI approach. These are respondents’ reported intentions in that study, not a measure of current policy across all employers.
Recommended Free Tools
The report’s expert analysis cautioned that a ban could reproduce the shadow IT problem if employees circumvented the rules and switched to less-known, potentially less-secure AI variants. That is a warning about a plausible outcome, not proof that bans cause shadow AI in every workplace.
#1 Best Overall
More recent survey reporting offers a signal that concealed use exists. Axios reported in May 2025 that Ivanti found 42% of office workers used generative AI tools at work; one in three of those users said they kept that use secret. The second figure applies only to the users in the survey, not to all office workers. It is survey reporting, not a census or a universal rate.
What employers should weigh
A ban and governed access have different trade-offs. The choice is not simply “safe” versus “unsafe”: outcomes depend on the policy, the tools and their data terms, how access is configured, and what employees actually do.
Rank #2
| Question | Blanket ban | Governed access |
|---|---|---|
| Visibility into actual use | May limit authorized use, but does not establish that employees stop or avoid other tools. | Can make approved use more visible; it does not, by itself, reveal every unapproved use. |
| Sensitive-data protection | States a prohibition, but its effectiveness depends on compliance and enforcement. | Can pair permitted use with data rules and access controls, but no single control guarantees that information will not be exposed. |
| Employee friction and usefulness | Can prevent use for legitimate tasks as well as risky ones. | Provides a route for permitted tasks, though restrictions may still add friction. |
| Clarity about tasks | A simple prohibition can be easy to state but may leave workers without guidance on adjacent AI features or exceptions. | Can distinguish permitted tasks and data from prohibited ones, if the policy is specific and understood. |
| Keeping policy current | A ban still needs review as tools and workplace uses change. | Requires ongoing review of approved tools, configurations, and rules as they change. |
This comparison describes practical trade-offs, not a published ranking or a guarantee that one approach works for every organization.
What the risks are—and what they are not
Organizations should assess risks tied to particular tools and uses rather than assume every AI service handles data the same way or that every prompt creates a leak. The cited sources identify several areas to examine:
- Sensitive information: Employees may submit material that should not be shared with a given service. Microsoft’s 2023 study found that 80% of business leaders and 82% of cybersecurity professionals cited staff leakage of sensitive data as a top concern. These are reported concerns, not observed leak rates.
- Inaccurate output: AI-generated answers may be wrong or incomplete, so important results need appropriate verification.
- Compliance and licensing: The organization may need to assess whether a use fits its legal, regulatory, contractual, and licensing obligations.
- Tool sprawl: Uncoordinated tools can make it harder to understand what employees use and which rules or safeguards apply.
The specific exposure depends on the service’s data terms, the organization’s configuration, identity and access controls, the information involved, employee practices, and review obligations. A paid account alone does not establish that a use is safe.
How to create a safer route for workplace AI
- Set task and data boundaries. Explain which work tasks are permitted, which are prohibited, and what kinds of information employees must not enter into tools unless the organization has approved that use. Make the rules understandable to people doing the work.
- Provide an approved route. Identify which tools or AI features employees may use for which tasks, and where to ask when a use is unclear. Approval should specify the service and its permitted configuration, rather than treating all AI products as interchangeable.
- Match controls to the use. Consider data classification, identity and access controls, and the service’s data terms. Restrict access or data flows where needed, and make clear that controls reduce risk rather than eliminate it.
- Involve employees. Ask what work they are trying to accomplish and where existing processes are creating pressure to use unofficial tools. A policy that ignores practical needs may be harder to follow.
- Review and update. Revisit approved tools, configurations, and rules as services and workplace uses change. Make a clear channel for reporting new tools or uncertain cases.
Use a risk framework without treating it as a certification
NIST’s AI Risk Management Framework is voluntary. Its Generative AI Profile, released July 26, 2024, helps organizations identify generative AI risks and consider risk-management actions; it is a framework for organizing risk work, not a turnkey policy, certification, or legal requirement. NIST says the framework is being revised. Read NIST’s AI Risk Management Framework.
For a sense of the implementation challenge in government, the U.S. Government Accountability Office reviewed inventories from 11 selected federal agencies and reported that their generative AI use cases rose from 32 in 2023 to 282 in 2024. GAO also documented policy, resource, and rapid-change challenges. Those figures describe the selected agencies’ inventories, not all federal agencies, private-sector workplaces, or shadow use. Read GAO’s report on generative AI use and management at federal agencies.
Microsoft has described granular access controls for AI applications as part of its vendor guidance. That may help organizations consider how to manage access, but it is not independent evidence that a particular product or control prevents leakage or shadow AI. Read Microsoft Security’s guidance on AI security and governance.
What the evidence can—and cannot—show
The available evidence combines industry surveys, a review of selected federal agency inventories, voluntary standards guidance, and vendor or consultancy perspectives. It does not establish a controlled causal result that bans create shadow AI, a universal rate of secret workplace use, or one best policy for every geography and sector. Treat survey percentages as findings from the stated populations, and assess local legal and operational requirements before setting workplace rules.
For additional context, see the ISMG study commissioned by Microsoft, Axios’s report on Ivanti’s workplace survey, and KPMG’s 2025 discussion of shadow AI.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
