Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A workplace ban can prohibit employees from using ChatGPT, but it cannot guarantee they stop. Microsoft’s 2023 study warned that users may circumvent rules and turn to less-known, potentially less-secure AI tools—a risk of recreating shadow IT, not proof that every ban causes shadow AI. Meanwhile, a 2025 survey reported that some employees already keep workplace generative AI use secret. For employers, the practical question is how to make permitted use visible and safer, rather than assuming a prohibition makes it disappear.
What shadow AI means at work
Shadow AI is the use of generative AI tools for work outside an organization’s approved or managed processes. It can include an employee pasting work material into a public chatbot, using an unapproved AI feature inside another service, or adopting a tool without IT or security review. The defining issue is not that AI was used; it is that the organization may lack visibility into the tool, the data involved, and the purpose.
That distinction matters. A sanctioned AI service can still be used inappropriately, and an unapproved tool does not automatically mean a breach occurred. Risk depends on the service’s data terms, the information submitted, organizational configuration, access controls, and applicable obligations.
Why a ban may drive use out of sight
In its 2023 study commissioned by Microsoft, ISMG found that 38% of surveyed business leaders and 48% of cybersecurity leaders expected to continue banning workplace generative AI. The same study reported that 73% of business leaders and 78% of cybersecurity professionals intended to use a walled-garden or “own AI” approach. These are survey responses from that study, not measures of current practice across all employers.
#1 Best Overall
The report’s expert analysis cautioned that a ban “could replicate the ‘shadow IT’ issue in AI” if users circumvent rules and move to less-known, potentially less-secure variants. That is a plausible governance concern, not a controlled finding that bans cause hidden use. Read the ISMG study commissioned by Microsoft.
Some secrecy is documented in survey reporting. Axios reported in May 2025 that 42% of office workers surveyed said they used generative AI tools at work; one in three of those users said they kept that use secret. The one-in-three figure applies to users in the survey, not to all office workers, and neither figure is a universal rate or a census. Axios’s report on secret workplace AI use.
Ban versus governed access: the trade-offs
| Question | Blanket ban | Governed access |
|---|---|---|
| Visibility into use | May make rule-breaking harder to see if employees circumvent the policy; Microsoft’s warning is an analysis of this risk, not proof of an outcome. | An approved route can make authorized use easier to identify, though the sources do not establish that any single program eliminates shadow use. |
| Protection of sensitive data | States a prohibition, but does not by itself show whether employees comply or prevent all data exposure. | Can pair permitted tasks with data-handling rules and access controls; effectiveness depends on implementation and employee practices. |
| Employee friction and usefulness | Prevents authorized use, which may encourage workarounds; the extent of that effect is not established by the available evidence. | Offers a legitimate path for appropriate tasks, while requiring review and ongoing management. |
| Clarity about permitted work | Simple to state, but may leave employees unclear about related tools, features, or exceptions unless those are defined. | Can specify allowed services, data types, and use cases, but requires clear communication and maintenance. |
| Keeping rules current | A prohibition still needs review as tools and workplace needs change. | Requires continuing assessment of services, configurations, risks, and policy. |
This comparison describes governance trade-offs, not a published ranking. A prohibition may be justified for a particular organization, task, or data category; the point is that a ban alone is not evidence that use has stopped.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What risks an employer should assess
ISMG’s Microsoft-commissioned study found that 80% of surveyed business leaders and 82% of cybersecurity professionals cited staff leakage of sensitive data as a top concern. Those percentages represent concern responses, not observed leak rates. The relevant risks are conditional and should be assessed against actual tools and uses.
Rank #3
- Sensitive-data exposure: assess what employees may submit, how the specific service handles inputs, and whether the organization has configured appropriate protections. Do not assume every service trains on submitted data or that every use exposes it.
- Inaccurate output: establish when AI-generated material needs human verification, especially if it informs consequential decisions or is shared externally.
- Compliance and licensing: review obligations relevant to the organization’s sector, jurisdiction, data, and the content or intellectual property involved.
- Tool sprawl: identify which AI features and services are in use so that unreviewed tools do not multiply without ownership or oversight.
These are issues to evaluate, not claims that every use produces harm. A useful policy distinguishes low-risk assistance from uses involving sensitive information, external commitments, or decisions that require accountable human judgment.
How to make workplace AI use safer and more visible
1. Define the rules in terms employees can apply
Say which services and use cases are approved, what information may not be entered, and what review is required before output is relied on or shared. Address AI features embedded in software employees already use, not only standalone chatbots. Explain how an employee can ask for approval or report a tool already in use.
2. Provide an approved route where appropriate
If some workplace uses are acceptable, offer a reviewed way to do them. A paid account alone does not establish safety: assess the service’s data terms, configuration, identity and access controls, permitted data, and review obligations. Microsoft describes granular access controls for AI applications in its own security guidance; that is vendor guidance, not independent proof that a particular control prevents leakage or shadow AI. Microsoft Security’s guidance on AI application controls.
Recommended Free Tools
3. Match controls to the data and task
Set boundaries around sensitive information and higher-impact uses, and ensure employees know how to handle outputs that may be wrong. Controls should reflect the organization’s data classifications and actual obligations rather than treating every prompt as equally risky.
Best Value
4. Ask employees what they need and what they are already using
Employee input can reveal where approved tools are missing, where rules are confusing, and which tasks are driving workarounds. The KPMG 2025 report frames shadow AI as a sign that employees may be moving faster than systems intended to support them; this is a consultancy perspective, not a measured finding that applies to every organization. KPMG’s 2025 report on shadow AI.
5. Review the policy as tools and use cases change
Generative AI services and workplace features change quickly. Reassess approved tools, access, data rules, and employee guidance on a regular basis and when material changes warrant it. A policy that was accurate for one service or configuration may not fit another.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use a framework without treating it as a turnkey fix
NIST’s AI Risk Management Framework is voluntary, not a certification or a legal requirement. Its Generative AI Profile, released July 26, 2024, helps organizations identify generative AI risks and consider risk-management actions. NIST says the framework is being revised, so consult its current materials rather than treating the profile as a fixed checklist. It can structure risk discussions, but it does not select an organization’s policy or guarantee that controls work. NIST AI Risk Management Framework.
Implementation can be constrained by staff, resources, and the pace of change. GAO’s 2025 review of inventories from 11 selected federal agencies found reported generative AI use cases rose from 32 in 2023 to 282 in 2024 and documented policy, resource, and rapid-change challenges. Those figures describe the selected agencies’ inventories, not all federal use or private-sector shadow AI. GAO’s report on generative AI use and management at selected federal agencies.
What the evidence does—and does not—show
The evidence supports treating hidden workplace AI use as a real governance concern: industry surveys report secret use and leaders’ concerns, while public-sector oversight documents practical implementation challenges. It does not establish that bans always create shadow AI, provide a universal rate of hidden use, or identify one best policy for every sector or jurisdiction. Employers should use the evidence to ask whether their own rules, approved options, and controls make appropriate use visible—not to assume either that a ban has solved the problem or that every employee using AI has created an incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
