Shadow AI is the use of AI tools for work without the organization's approval, and the most common form is simple: someone pastes a contract, a claim or a spreadsheet into a free public AI service to get a summary. It happens because AI is useful, and it is a risk because the document, with every name, account number and confidential term in it, has now left the organization under terms nobody there agreed to. The answer is not to stop people using AI on documents. It is to give them a way to do it that keeps the sensitive data inside.
Key Takeaways
- Shadow AI is widespread: in a 2026 survey, 88% of office professionals said they had shared work-related information with public AI tools.
- Bans rarely work on their own. People use AI because it saves them time, and a ban without an approved alternative pushes the use out of sight.
- Organizations respond in four ways: ban it, buy enterprise AI accounts, redact documents before they are sent, or run a model on their own hardware. Each has real trade-offs.
- Whatever you choose, require that the original document stays on your network, that sensitive values are removed before anything is sent, and that nothing is sent at all if that step fails.
How Common Is Shadow AI?
More common than most policies assume.
“88% of office professionals have shared work-related information with public AI tools.”
In a 2025 global study by KPMG and the University of Melbourne, almost half of employees admitted using AI in ways that contravene company policy, including uploading sensitive company information into free public AI tools.KPMG & University of Melbourne, 2025(source, opens in a new tab) And the consequences are already showing up in breach reports: IBM's 2025 Cost of a Data Breach Report found that one in five organizations reported a breach due to shadow AI.IBM / Ponemon, 2025(source, opens in a new tab)
The documents involved are the ones that matter most. Contracts carry counterparties, prices and bank details. Claims and HR files carry names, dates of birth and national ID numbers. Invoices carry account numbers. A single paste can send all of it.
Why Banning AI Rarely Works
A ban treats the symptom. People turn to AI for real reasons: a summary of a 40-page contract, the key dates pulled out of a lease, a first sort of an overflowing inbox. If the organization offers no approved way to get that help, the need does not go away. The use moves to personal phones and home laptops, where it is harder to see and impossible to govern.
A ban can still be the right short-term step while an alternative is chosen. It works best with a date attached and a clear message about what is coming.
Four Ways Organizations Respond
| Approach | What it does well | What to weigh |
|---|---|---|
| Ban public AI tools | Simple to announce; clear policy position | Use moves out of sight; the productivity need is left unmet |
| Enterprise AI accounts | Contract and data-handling terms you negotiate; central administration | Full document text still goes to the provider; the protection depends on the contract and on people using the approved account |
| Redact before sending | Sensitive values are replaced before any text leaves your network; you can use any provider | Redaction removes what the detector finds, so its coverage should be tested; the AI works on placeholders, not real names |
| Self-hosted model | No text leaves your infrastructure | You run and pay for the hardware and the model; capability depends on the model you can host |
These are not exclusive. Many organizations combine an enterprise account or a self-hosted model with redaction, so that even the approved route never receives the most sensitive values.
What to Require Before Any Document Reaches an AI Service
Whichever route you take, these are the questions that decide whether confidential documents stay confidential:
- Does the original document stay on your network? The safest design never sends the file itself, only text prepared from it.
- Are sensitive values removed before anything is sent? Names, addresses, ID numbers, bank and card numbers, passwords and keys should be replaced before the text leaves.
- Can you add your own protected terms? A general detector does not know your customer names, project codenames or unannounced products. You should be able to tell it.
- What happens if the protection step fails? The only acceptable answer is that nothing is sent.
- What does the service keep? Ask what is stored, for how long, and whether logs contain document content.
- Who chooses the AI provider? If the vendor chooses, you inherit its terms. If you bring your own account, the contract and billing are yours, and you can change provider later.
- Do results respect permissions? A summary of a confidential document should be as restricted as the document itself.
- Can you decide where AI runs? Some folders should never be processed. You should be able to choose.
How infoRouter Connect Handles It
infoRouter Connect is an optional add-on module for infoRouter, licensed separately, built around the redaction approach:
- The original document never leaves your network. AI models and outside services receive only redacted text.
- Sensitive values are replaced first. Before any text leaves your network, Connect replaces every sensitive value it detects with a placeholder. The AI company never receives the values Connect removed, and Connect puts the real values back before infoRouter stores the result.
- You can protect your own terms. Customer names, internal project names and anything else specific to your business can be added, and Connect treats them like a bank account number.
- If the cleaning step cannot run, nothing is sent.
- Nothing is kept. Working copies are purged as soon as the result is delivered, logs hold no document information, and your API key is never shown or logged.
- You choose the provider. Connect works with your own account at Anthropic, OpenAI, Microsoft Azure OpenAI or Google Gemini, or with a compatible model running on your own hardware.
- You choose where AI runs. Switch it on for a folder, or use it on one document at a time, and switch any operation off.
- Results inherit permissions. Summaries and extracted properties carry the same permissions as the document they came from.
Connect replaces the sensitive values it detects, and no detector catches everything, which is why the custom protected terms and the choice of where AI runs matter as much as the detection itself.
Frequently Asked Questions
- What is shadow AI?
- Shadow AI is the use of AI tools for work without the organization's approval, most often by pasting company documents or data into free public AI services. In a 2026 PagerDuty survey, 88% of office professionals said they had shared work-related information with public AI tools.
- Is it safe to paste confidential documents into a public AI tool?
- Not without knowing the provider's terms. Once a document is pasted in, its contents have left your organization under terms you did not negotiate. Use an approved route instead, and make sure sensitive values are removed before any text is sent.
- How can we use AI on documents without exposing sensitive data?
- Keep the original document on your network, replace sensitive values with placeholders before any text is sent, add your own protected terms, and make sure nothing is sent if that step fails. infoRouter Connect, an optional module licensed separately, works this way with the AI provider you choose.
Give People a Safe Way to Use AI
Request a Guided Trial. We set up an evaluation with you, in the cloud or on your own server, with infoRouter Connect included, so you can try AI on your own documents with the sensitive data stripped out first.