Shadow AI = staff using AI tools at work without approval or oversight. Usually well-intentioned. Often invisible. Sometimes a compliance breach in the making.
In 2023, Samsung employees pasted confidential source code into ChatGPT. The company banned consumer AI tools shortly after.
In healthcare, the same instinct can put PHIPA and PIPEDA compliance at risk; with no audit trail to track it.
Banning AI rarely works. People route around it. The better play:
- Assume staff are already using AI
- Offer sanctioned tools with proper data controls
- Make the safe option the convenient one
What this means for health organizations
Privacy obligations follow client information wherever it goes, including into an AI tool someone found online. A sanctioned tool with an audit trail is much easier to defend than a ban nobody can enforce.
