Every business I walk into is already using AI, and almost none of them decided to. If you are the owner and you have concerns about AI, I guarantee it is being used in your company. I also guarantee nobody sat down and worked out whether it should be used, how, and what should go into it. We call that shadow AI.
We have had so much feedback from people worried about AI in their business that I did a special edition of Nerds News instead of waiting for our regular Thursday show.
Chapters
- 0:00 What shadow AI is and why this is a special edition
- 2:37 How big it is: PagerDuty, Gartner, Microsoft, IBM
- 6:56 Your best people, not bad guys
- 7:38 What it looks like in a real shop: quotes and pricing
- 9:14 The bookkeeper and your P&L
- 10:43 Blocking it at the firewall doesn’t work
- 11:13 Customer data and your obligations
- 12:02 The three fixes
- 13:21 Free AI policy template
- 15:04 The two-minute test
- 16:28 How ACS runs AI
- 18:34 Where to start this week
What shadow AI is, and why this could not wait
Shadow AI is the AI that gets used without anybody knowing about it, except the people using it. It is AI tools your staff use for company work that the company never approved. Usually it is a personal ChatGPT, Copilot, or Gemini account, on a phone, a computer, or in a browser tab.
What scares me is that the free accounts are very powerful. People can get a lot of work done with them and create a lot of damage at the same time.
So why now? Because AI went from a curiosity to a normal way to work, and that happened in the last 18 months. Most owners have not caught up.
How big it is, and why this is not about bad guys
PagerDuty ran a survey in June of this year, 2026. It found 66% of office workers have used AI tools they believed were not allowed at work, and 88% have put work information into an AI tool. A third of them put in customer data, and a third put in financial or confidential documents. Public AI versus private tools is a big deal, and I will get to why.
Gartner has 68% of employees using unauthorized AI, up from 41% in 2023. They are doing it because they would rather drive than walk.
The Microsoft and LinkedIn Work Trend Index looked at small and medium companies and found that 80% of the people using AI at work there bring their own AI. If you are not providing it, they are bringing it. It might be a free public AI, or they might be paying for it themselves. If it is not configured correctly, whatever goes into it could end up as training data. That is why the difference between public and private matters. Big corporations have this locked down. Small business is where it is worst.
IBM’s 2026 breach report says shadow AI was involved in 43% of incidents, up from 20% the year before. That is better than a 100% increase in a year. Breaches involving it cost about $400,000 more than average.
We are not talking about bad guys. We are talking about your best people doing their best work with the best tools. Why walk when you can drive? Why take a bus when you can take a plane, and not just any plane, Delta quality at discount airline prices, up to and including free?
What it looks like in a real shop
Quote generation is the one I know is happening, because I have talked to people about it. Take a custom manufacturer. Every quote is unique. There are general guidelines around it, but for the most part each one is different. An AI tool can make that faster, better, and more consistent. It is a powerful tool, and you want your employees using it.
The problem is a free tool, or an AI program that is not set up correctly. The pricing, the customer, and the methodology you use to build the quote all get fed into the AI. You are training it on how you do business, and it can turn around and use that same information for your competitors.
Say your bookkeeper uses an AI tool you do not know about. She takes the profit and loss, the asset lists, what you spend on administration or parts, and dumps it into Gemini on her free account. If you want to train your competitors on how your financials work, more power to you. I highly recommend we not do that.
Say you try to stop it at the firewall so nobody can reach ChatGPT. It is just as easy to use a cell phone to get around that. You are not stopping it with a block alone. You need teeth.
Customer data is probably the biggest one. We have a fiduciary responsibility to protect our customers’ information. If our employees feed it into AIs, and the AIs train on it or pull it in for whatever purposes those companies have, we are not doing our job. In some cases it is illegal. If you do defense work or you are in healthcare, you cannot let that information walk out the door.
The three things that fix it
Visibility. You cannot write a rule for tools you do not know about. Your Microsoft 365 sign-in and app consent logs show more than people expect, and that is the first thing the ACS readiness assessment looks at. Where are people signing in? What can we pull from firewalls and browser history so we know what is being used, who is using it, and how?
A policy people physically sign. It lists the approved tools, what data can go into them, that everything going out gets reviewed, and what happens if someone breaks the rules. Have your lawyer look at it. We are providing one for free at acsapp.com/aipolicy, our AI acceptable use policy template. Bring it to your team so nobody is confused.
An approved path. You have to give people the tools, because these tools are going to be good for you, maybe even better for you than for them. Not using AI today is like telling people in 1992 they could not use a word processor and had to use a typewriter. You are hurting your own bottom line because your people cannot be as productive. Shadow AI happens because the approved option is slower or does not exist. Copilot inside Microsoft 365, with the permissions cleaned up and ready, beats a personal ChatGPT, and your data stays in your tenant. Claude and GPT have the right ways to do it too, and so do all the big players.
The two-minute test, and how we run AI at ACS
To see where your company sits today, we have a small, simple tool. Do you have a written policy? Are your permissions set up right, and have you reviewed them? Do you know what AI tools your employees are using today? If you cannot answer all three, you are not behind. You are normal.
The full version is 10 questions and takes a couple of minutes. It scores you and tells you what to do first. We are not collecting anything. It is a free check at acsapp.com/aicheck, our AI readiness self-assessment.
At ACS we run a highly advanced AI setup. We have our own in-house AI on our own hardware, and we use the most advanced models from the biggest companies. We have built dozens of integrations, close to a hundred, between our own software and the vendors we use. We know how to make it so data never leaves the building.
We call our solution Managed Intelligence. The foundation is the policy, shadow AI monitoring, and Copilot or other AI license management. It runs from the assessment through creating and managing agents, training your employees, and building workflows that make them more productive.
So go get your free assessment at acsapp.com/aicheck. Go get your free download of the policy at acsapp.com/aipolicy. Take the test, get the policy, and give it to your team.
Questions about anything here? Schedule a free IT consultation and we will walk through it with you. More episodes are on the Nerds News page, where you can subscribe on Spotify, Apple Podcasts, or YouTube. Managed IT services in Traverse City from Advanced Computer Solutions, 402 S Union Street Suite B, Traverse City, MI 49684, 231-267-TECH (8324).