If your organization doesn't have an approved AI tool, that doesn't mean your organization isn't using AI.
It means staff are using whatever's free and fast: personal chatbot accounts, browser extensions, an app someone found. No oversight, no data agreements, and sometimes client information in the prompt.
That's shadow AI. It doesn't show up in any risk register, because officially, it isn't happening.
The uncomfortable part: banning AI outright tends to make this worse, not better. The pressure that drives staff to these tools (documentation burden, report deadlines, too few hours) doesn't go away. The usage just goes quiet.
The organizations in the strongest position aren't the ones with the strictest bans. They're the ones that gave staff a sanctioned option, set clear rules about what can and can't go into it, and made it safe to ask "can I use AI for this?" out loud.
If you're not sure whether shadow AI is happening in your organization, that might be your answer.
What this means for health organizations
The biggest risk in shadow AI is client information going into tools with no data agreement. A sanctioned tool with clear rules, plus a safe way for staff to ask questions, usually reduces that risk more than a ban does.
