Shadow AI: The IT Risk We Can’t Ignore

Artificial intelligence (AI) tools are showing up in nearly everything we touch: research, drafting, e-discovery, motion practice, even the business apps on a standard desktop. Accordingly, law firms and legal departments have been busy stepping up to mitigate the risks. They’ve provided AI policies, reviewed terms and conditions, drafted re-training limitations, and researched data provenance, all in the name of vetting and approving AI tools for employees.

Yet, most employees abandon approved tools in favor of public chatbots like ChatGPT.

Microsoft’s 2024 annual Work Trend Index reported that 75 percent of knowledge workers use AI at work and 78 percent are “bringing their own,” adopting tools outside IT’s approved stack. More recently, BCG reported from a global 2025 study that 54 percent of employees would use an AI tool that isn’t authorized by their employer. If we think legal teams are the exception, all we need to do is watch the daily increase in hallucinated case citations.

Why the gravitational pull?

No friction. Public chatbots are ubiquitous––readily available on any browser, with no waiting. Many employees have become accustomed to free versions or have personal accounts they can log into from their phones.

Familiarity. The popularity of public chatbots means that many lawyers have already built personal workflows around them—custom instructions, saved prompts, conversation history, even muscle memory.

Tool sprawl causes context fatigue. Switching between user interfaces (UI) creates mental drag, and almost every platform now has an “AI button” you must hunt down. One generalist chatbot becomes the path of least resistance.

Perception. Anecdotal comments indicate that the public model can “seem smarter,” “more complex” or “more efficient.”

Of course, trading compliance for convenience comes with major consequences, including hallucinations that sneak into filings, confidentiality and privilege risks and unclear provenance that can cloud intellectual property (IP) rights and risk vicarious liability.

Even with vetted AI on offer, many attorneys and employees default to the public chatbot they know. The data backs it up, and so do our day-to-day observations. This isn’t new behavior. When official technology feels slow, opaque or cumbersome, professionals quietly adopt whatever helps them deliver. This is called shadow IT, and AI is just the latest flavor. We’ve seen similar compliance issues with file-sharing, short messaging and “free” PDF converters. But now, the tools aren’t just moving our data, they’re learning from it and processing it in ways that are difficult to control or reproduce.

In this piece, we’ll explore the legal risks of shadow AI and discuss practical tips for keeping your organization safer.

Legal Risks of Shadow AI

Shadow AI doesn’t introduce entirely new problems; the following issues are based on duties of which attorneys should already be intimately familiar.

Confidentiality and privilege. When client facts, strategy, identifiers, or personally identifiable information (PII)/protected health information (PHI) find their way into prompts for public models, this can result in a confidentiality violation or privilege waiver. Many providers retain and use prompts and other user-generated data for model training and service improvement, route traffic through third countries or allow contractors to access chats. That’s a problem for confidentiality, privilege, protective orders and cross-border privacy rules. Even “anonymized” narratives can be reconstituted when combined with public facts.

Candor and competence. The number of hallucinated citations and phantom quotes in filings are still on the rise. Attorneys must exhibit technological competency and model output must be verified like any other secondary source. That means cite-checking, running down quotations, validating docket facts and documenting that validation. Using an AI tool to draft doesn’t dilute duties of candor to the tribunal or the need for technological competence.

IP and provenance. You may not be able to own, license or safely reuse what a public model generates. Terms of service can grant the provider broad reuse rights, limit commercial use or disclaim originality. Training-data provenance is usually opaque, so downstream reuse can be accompanied by IP infringement risks. If you can’t answer “what data was the model trained on,” assume the chain of title is cloudy, and could involve piracy.

Discovery and retention. When prompts and outputs are relevant to a dispute, they could be considered actionable electronically stored information (ESI). If you can’t log, search, preserve, collect, review and produce them, you’re creating spoliation risk and complicating legal holds. Ephemeral chats, bring-your-own accounts and model versioning make reconstruction difficult.

Explainability and reproducibility. Much of what happens between prompt and output is hidden, and public models can change quietly. Today’s output may not be explainable or reproducible tomorrow.

The good news is that these critical issues can be mitigated. There are enterprise tools that boast fully licensed training data sets, no-train/no-retain defaults, logging and export for discovery, guardrails on prompts and role-based access and even algorithmic transparency. If we can reduce friction and raise literacy, shadow AI use should shrink—shrinking risk profiles in turn.

Prompt Privacy Hygiene

We’ve walked through the highly critical reasons that responsible organizations insist on vetting and approving AI tools before employees use them for work–especially for legal purposes. And when a client, firm, or organization bans public AI use for work, it shouldn’t be used. Period.

That said, we can begin helping with this issue by acknowledging the behavior that’s happening. We don’t benefit from ignoring the fact that public models are being used surreptitiously at work. And AI privacy literacy helps everyone. While we must discourage and correct unauthorized tool use, we can also promote awareness and compliance with practical, harm-reduction measures for safer prompting when using public AI.

Prompt Privacy Checklist

Never Share

Client identifiers: names, emails, phone numbers, addresses, account numbers, SSNs, DOBs, medical or education records, minors’ information.

Case identifiers: matter names/numbers, docket numbers, court/agency IDs, protective-order material.

Strategy and privileged content: client communications, legal work product, legal theories, settlement ranges, draft briefs, internal notes.

Contract or business confidential information: pricing, terms, PII, trade secrets, non-public M&A or HR data.

Uploads with metadata: un-scrubbed PDFs/Word/Excel, audio/video with EXIF or embedded comments.

De-Identify

Mask the specifics. Replace specific information with tokens. Example: [CLIENT], [OPPOSING], [AMOUNT], [DATE], [JURIS].

Generalize the facts. “consumer class action over subscription billing” instead of company names; “$[X]–$[Y] range” instead of exact numbers.

Paste sparingly. Paste only the minimum text needed to get the task done; never full documents.

Scrub files. If you must upload, use redacted copies and strip metadata first.

Favor Guardrails

No-retain settings. Show preference for tools (or models) that can disable training/retention; confirm in the UI and policy.

Log the who/what/when. Record model name/version, date/time and prompts/outputs.

No reliance. Do not rely on AI for factual accuracy. Add sensitive facts or citations to outputs after they are generated, during the editing round.

Verify everything. Run an “assertion sweep” on output—names, numbers, quotes, cites, dates. Nothing gets delivered without independent confirmation.

Naming conventions. Don’t put client/matter names in file names, prompt titles or chat “custom instructions.”

These tips can make using public AI safer, but should never be used to justify unauthorized use. Instead, we can work to make the safer path the easier path. When friction drops and expectations are clear, shadow AI use should drop as well.

Governance That Works

If we want people to stop opening public chatbots for work, we will need to make the approved path faster and more efficient than the shadow path.

We can make a lot of progress with clear design thinking and by meeting people where they are. We can design systems and workflows around human behavior, placing approved AI tools where employees already spend a lot of time working––i.e., in their word processors, email and browsers. This encourages employees to use what’s already right there, instead of opening an unapproved model.

We can block and allow sites and tools with intention, at the organizational level. DNS and app controls can be used to block public model sites from work accounts while clearly publishing a safe “allow” list or whitelist. Putting short, “why” messages at the point of block allows for quick acceptance and pivoting (i.e., “Public chatbots may retain prompts and share confidential information; please use the approved assistant in Word instead”). Pairing this re-direct alert with just-in-time tips and a quick-start guide or video for the approved tool can even help drive quicker adoption.

Protective defaults can be added. There are automated guardrails coming to the market, tools such as PII detectors and prompt scanners that warn users if tokens look like names, SSNs, matter numbers or other sensitive text. Approved tools should be configured with no-train/no-retain turned on, documented data residency and disclosed subprocessors.

Single sign-on and role-based access can be used so that sensitive matters are walled off by default.

Don’t forget that AI prompts and outputs can be considered ESI. Your system should automatically capture who/when/model/version/prompt/output and file it to a matter workspace with a retention schedule you can honor.

Plan for dealing with noncompliance. Offer a standing amnesty path so people can report mistakes early. If someone pastes sensitive data into a public model:

1. Contain (revoke tokens, delete if the provider permits).
2. Assess privilege/confidentiality
3. Notify stakeholders/clients as
4. Document corrective steps and tighten controls to prevent

And finally, measure what matters. Track approved-tool adoption, blocked public calls, PII flags caught by guardrails and satisfaction with approved tool performance. Find the technology champions in your firm or organization and enlist their help. Tools will change, defaults will change and the market will change—but our duties won’t. If we reduce friction on the approved path, shadow AI shrinks and so do our risk profiles.

Mindful AI Use

The sheer volume at which new legal AI tools are being launched is genuinely astonishing. Inevitably, some tools will consolidate, some will fade and agentic AI may even let us stitch task-specific “mini workers” into our own matter workflows. Soon, we may be building more legal AI tools than we buy. And if agentic AI lets us assemble bespoke legal tools, great—we can assemble them to operate with carefully constructed guardrails.

The market will shift, people will shift, preferences will shift, but the baseline remains the same. Attorneys must stay mindful of our obligations, our duties don’t bend with the hype cycle. Confidentiality and privilege, candor to the court, technological competence, supervision, recordkeeping––they all apply whether AI is in the picture or not.

Change can be frightening, but there’s no need to fear this change. There are strategies for making the safer path faster. Focus on building frameworks that let your teams keep the speed dividend while minimizing the legal, ethical and bureaucratic drag. Make the safe choice the easy choice, and you’ll get the benefits of AI without handing your matters —and your reputation—to chance. That’s how we meet people where they are, keep faith with our obligations and practice law—competently, candidly and securely—all while the tech tools continue to shift under our feet.