Someone in your business pasted a client contract into ChatGPT this week to get a quick summary. Someone else dropped a spreadsheet of staff salaries into Copilot to reformat it faster. Neither person thought twice, because the tool answered helpfully and the task got done. Neither asked where that information actually went.

This is shadow AI: staff using AI tools the business has not reviewed or configured correctly, often with information the business would never knowingly hand to a third party. It is not malicious. It is convenient, and convenience is why it spreads fast.

What Actually Happens to Pasted Data

The answer depends on which tool, which plan, and which settings, and most staff have no idea these variables exist.

Free consumer accounts for tools like ChatGPT and Claude may, depending on current settings, use conversation content to improve future models unless a user has opted out. Information pasted in can, in some configurations, influence a model other users interact with later.

Business and enterprise tiers of the same tools typically offer stronger protections, including commitments not to train on your data. That protection exists only if the business has subscribed to and configured the correct tier, rather than staff defaulting to a personal free version.

Microsoft Copilot behaves differently depending on licensing. Copilot inside a properly licensed Microsoft 365 tenant respects your existing data boundaries. A personal Copilot account, or one used outside your tenant’s configuration, does not carry the same guarantees.

The common thread: safety depends on configuration decisions most staff cannot make, and most businesses have not made deliberately.

Why This Is Higher Risk Than It Looks

One staff member pasting one document feels minor. Multiplied across a business over months, it adds up to real volumes of client information and financial data flowing into tools whose policies nobody has read. Under the Privacy Act, your obligations around personal information do not pause just because an AI tool was involved.

There is a reputational angle too. If a client learns their contract details were pasted into a public AI tool to save someone ten minutes, that is a very difficult conversation to have well.

Building a Policy Staff Will Actually Follow

A blanket ban rarely works, because the productivity benefit is real and staff will find a way around a rule that feels disconnected from how they work. A workable policy is specific, not absolute.

• Name which AI tools are approved for business use, and on which licensing tier
• Be explicit about what can never be pasted in: client details, financial records, health data, confidential material
• Provide an approved alternative for the task staff were trying to solve
• Configure enterprise protections once, at the tenant level, rather than relying on individual choices

The tenant-level point matters most. Staff training helps, but it is not a control you can rely on alone. Locking down the right settings at the account level removes the decision from each individual interaction.

Stopping Unapproved Tools Without Creating Friction

Blocking every AI tool outright usually backfires, pushing usage further underground. A better approach combines a short list of approved tools, clear guidance on what is safe to paste where, and technical controls such as conditional access and data loss prevention that catch risky transfers without blocking legitimate use. The goal is steering behaviour toward safe options, not a permanent game of whack-a-mole with every new AI tool that launches.

How Otto IT Can Help

Our managed cybersecurity services include configuring Microsoft 365 and Copilot tenant settings correctly, and our Virtual CIO service can help draft an AI usage policy your staff will actually follow. If you suspect shadow AI use is already happening, which it almost certainly is, talk to us about getting visibility and the right guardrails in place.

Frequently Asked Questions

Can we actually see what staff have pasted into AI tools already?

Visibility depends on which tools and what logging is enabled. Enterprise-tier AI tools and a properly configured Microsoft 365 environment offer meaningfully more audit capability than free consumer accounts.

Does using the paid version of ChatGPT or Claude make this a non-issue?

It significantly reduces the risk around model training, but does not remove every consideration. Data residency and retention settings still need checking against your specific obligations, particularly in regulated industries.

How quickly can an AI usage policy realistically be put in place?

A basic policy covering approved tools and prohibited data types can be drafted and communicated within a week. Technical controls such as conditional access rules typically take a little longer, depending on your current Microsoft 365 configuration.