Shadow AI, Your AI Policy, and Asking for Approval

New AI tools appear every week. A coworker shares a meeting note taker. An ad offers a browser extension that summarizes every page. An AI agent promises to clear your inbox for you. Using any of these at work without approval is called shadow AI, and it is one of the most common ways company data ends up in the wrong place.

This lesson shows you what to ask before you try a new tool, how to read your company's AI policy, and how to ask for approval in a way that gets a quick answer.

What You'll Learn

• What shadow AI is and why it is risky, even when the tool is good
• Why browser extensions and AI agents need extra care
• The questions to ask before you connect any tool to your work accounts
• How to read your company's AI policy and find the parts that apply to you
• How to write a clear approval request

What shadow AI looks like

Shadow AI is any AI tool used for work that the company has not approved. It is rarely sneaky. It usually looks like this:

• Signing up for a free AI tool with your work email to try it on a real task.
• Installing an AI browser extension on your work laptop.
• Adding an AI meeting assistant that joins calls and records them.
• Connecting an AI app to your work email, calendar, or drive with "Sign in with" buttons.
• Using AI features inside a tool the company approved for something else.

The tool may be excellent. The problem is that nobody at the company has checked where the data goes, what the contract says, or what access the tool has.

Why extensions and agents need extra care

Most chatbots only see what you paste. Some tools see much more.

Browser extensions can often read the pages you visit. On a work laptop, that might include your email, internal systems, HR portals, and client files open in other tabs.

AI agents and connectors act on your behalf. When you connect one to your work accounts, it may be able to read your email, open files, send messages, or book meetings. It can do this at any time, not only when you are watching.

Meeting assistants record and transcribe calls. Other people on the call, including clients, may not know or agree.

For personal habits with extensions on your own devices, see Account, App, and Extension Hygiene. At work, the rule is simpler: do not install or connect it until it is approved.

Questions to ask before you try a new tool

Before you use any new AI tool for work, you should be able to answer these. If you cannot, that is your sign to ask IT.

More detailed questions:

• Who makes it? A known vendor, or an unknown app with no company details?
• What permissions does it ask for? "Read and change all data on all websites" or "full access to your mailbox" is a lot for a simple task.
• Can it act, or only read? Sending emails or editing files is a bigger risk than reading.
• Does it work in the background? Some tools keep running after you close them.
• What data levels would it touch? Use the levels from lesson 2.
• Is there a version the company already approved? Often the feature you want already exists in an approved tool.

Reading your company's AI policy

Many companies now have an AI policy, sometimes called an acceptable use policy for AI. It can be a full document or a short section inside a broader IT policy. If you do not know where it is, ask your manager or check your intranet.

You do not need to memorize it. Look for these parts:

1. Approved tools. Which tools and plans you may use.
2. Data rules. Which data levels can go into which tools.
3. Banned uses. Tasks AI must not be used for, such as some hiring or legal decisions.
4. Review and disclosure. When AI output must be checked or labeled.
5. How to ask. Who approves new tools and how to request one.
6. How to report. What to do if something goes wrong.

If the policy does not cover your situation, do not guess in your own favor. Ask. A policy that is silent on a tool does not mean the tool is approved.

How to ask for approval

A clear request gets a faster answer. Include:

• The tool, with a link, and the plan you would use.
• The task, in one or two sentences.
• The data it would touch, using the data levels.
• The access it needs, such as email, files, or browser.
• Why it helps, briefly.
• What you checked, like the vendor's privacy page.

You can use AI to help you draft the request. Fill in the brackets with your own details. Do not paste anything confidential into the prompt.

While you wait for an answer, do not "try it quickly" on real work data. Test it on public or made-up data only, if at all, and only if your policy allows that.

If you already use an unapproved tool

Many people do. The fix is simple:

• Stop putting work data into it.
• Disconnect it from your work accounts.
• Tell IT what you used and what kind of data it saw.
• Ask for approval if it is useful, so others can use it safely too.

Being open helps your company find good tools faster and protects you.

If you are a manager writing the policy or the approval process itself, see AI for Working Professionals: The Manager's Playbook.

Key Takeaways

• Shadow AI is any AI tool used for work without approval. Good tools can still be shadow AI.
• Extensions, agents, connectors, and meeting assistants can see and do far more than a chatbot. Do not connect them until approved.
• Before a new tool, ask: Is it approved? What can it access? Where does data go? Can I undo it?
• Read your AI policy for approved tools, data rules, banned uses, review rules, and how to ask.
• A good approval request names the tool, task, data, access, and reason.
• If you used an unapproved tool, stop, disconnect, and tell IT.