Skip to content
HIFENCE

Shadow AI in Mid-Market Companies: What to Do When Employees Use AI Without Rules

Picture of Daniel Sarica, the founder of HIFENCE. Daniel Sarica

Published: April 8, 2026

If you run a company of 50-150 employees, chances are high that part of your team is already using AI tools (ChatGPT, Copilot, Gemini, transcription tools) on their own, with data they shouldn’t be entering, without management having any visibility into it.

This article is not about what shadow AI is - you can find that information anywhere. It’s about what you concretely do in a small or mid-size company where people are already using AI tools on their own, without rules.

Step 1: The inventory - how to do it without making it feel like an investigation

The worst way to run the inventory is an email from IT that sounds like an audit. “Please report any unauthorized applications you are using.” People get scared and hide things.

What works: a short email from the CEO or HR, framed as an opportunity:

“We know many of you are using AI tools for work, and that’s a good thing - we want to provide safe, company-paid options. To do that, we need to understand what’s being used today. Please fill out the form below. This is not an audit and there are no consequences.”

The form has four questions

  • Which AI tools do you use for work? (ChatGPT, Copilot, Gemini, Claude, transcription tools, others)
  • On what account? (free personal, paid personal, company account)
  • What do you use them for? (emails, summaries, analysis, code, transcription, others)
  • What types of data do you usually enter? (generic text, customer data, contracts, financial, HR)

The technical alternative: IT checks network traffic to openai.com, claude.ai, gemini.google.com. You can’t see what data was entered, but you can see how much traffic there is and from which machines. Combined with the form, you get a fairly clear picture.

At a 70-employee company, the form revealed that 23 people were using ChatGPT daily. IT had no idea. The CEO had no idea. Salespeople were entering lists of customer names, emails, and phone numbers to generate personalized emails. Accounting was copying clauses out of contracts to produce summaries. HR was using a free transcription tool for interviews - candidate names, salary expectations, and personal details sent to a third party’s servers with no contractual agreement of any kind.

Time required: 1-2 days (sending + collecting responses).

Step 2: The tool decision

Based on the inventory, you decide what’s allowed.

The minimum setup for most mid-market companies

  • ChatGPT Team ($25/user/month) - data is not used for training, you get a DPA, and you can control who has access
  • or Microsoft Copilot (if you’re on M365 Business Premium, it’s partially included) - data stays in your company’s tenant
  • An explicit ban on free personal accounts for work data

The differences matter: on a free ChatGPT account, OpenAI can use what you enter to train its models (there’s an opt-out in the settings, but how many employees know to do that?). On ChatGPT Team, data is not used for training and you get a DPA you can show an auditor or an enterprise customer’s security team. With Copilot on M365, the data doesn’t even leave your company’s tenant.

The cost: for 20 active users on ChatGPT Team, you’re looking at $500/month. That’s negligible next to what a single data incident or privacy penalty can cost.

Step 3: The internal policy - a one-page document

We’ve seen 15-page AI usage policies that nobody has ever opened. What works is one page with three sections:

Template

[COMPANY NAME] - AI Usage Rules

1. Approved tools

  • [ChatGPT Team / Microsoft Copilot / other] - company-provided accounts
  • Free versions are NOT used for work data

2. Data that does NOT go into any AI tool

  • Personal data of customers or employees (names, Social Security numbers, addresses, contact details)
  • Contracts or contract excerpts
  • Financial information (margins, pricing, cash flow, invoices)
  • HR data (performance reviews, salaries, disciplinary records, medical information)
  • Proprietary internal processes or methodologies

3. If you’re not sure

  • Ask [contact person] on [channel - email/Slack/Teams]. There are no consequences for asking.

Update owner: [Name], frequency: quarterly.
Approved by: [CEO], date: [___]

Print it, include it in onboarding, send it by email. And most importantly: walk through it in a 15-minute meeting with the team. A PDF sent by email that nobody opens is not a policy, it’s a file.

Step 4: The periodic check - 30 minutes a month

Once a month, IT checks:

  • have new tools shown up in network traffic?
  • are there questions or unclear situations?
  • is the policy still relevant, or does it need updating?

And once a quarter, management rereads the policy and signs off on it again. In front of a regulator, a cyber insurance carrier, or an enterprise customer’s security team, “we didn’t know” is not a defense. Proof that you took action is.

The most common mistakes

Three things.
First: the policy exists but the tools don’t. You say “don’t use free ChatGPT” but offer no paid alternative. People will keep using it, just hidden. It’s like banning personal cars at the office without providing any parking.
Second: the policy is emailed but never discussed. Nobody reads it. Nobody knows what it says. But “we have a policy” - box checked.
Third: nobody checks. The policy gets signed in January; by March, half the team is using a new transcription tool someone recommended on LinkedIn, and nobody knows. A free tool, with sensitive data, on servers who knows where.
The difference is between companies that have a document and companies that have a process. The document is necessary but not sufficient. The process (inventory, decision, communication, verification) is what actually reduces the risk.

Privacy and compliance implications

Privacy: sending customer or employee personal data to an external processor with no contractual agreement in place is exactly the kind of practice privacy laws penalize. Under the CCPA, penalties run up to $2,500 per violation - $7,500 if intentional - and each affected person can count as a separate violation. If you handle EU residents’ data, GDPR applies on top, with fines of up to 4% of global revenue. US regulators have already brought enforcement actions over how companies handle personal data in AI products. This is not a theoretical issue.
Compliance: external AI tools are uncontrolled third-party services. Every framework your customers, auditors, and insurers care about - SOC 2, NIST CSF, HIPAA, CMMC - expects you to manage the risks in your digital supply chain. You cannot delegate that responsibility away, and claiming ignorance doesn’t hold up. If an employee enters sensitive data into an unapproved tool and an incident follows, that responsibility lands on management, not on IT.
The difference between “we have a problem” and “we have a solution” is one afternoon of work and $500 a month. Between a six-figure incident and a working policy sit a few hours of work and one decision. It’s probably the best investment an executive can make in 2026. This is where we can help, with our cybersecurity services.

If you want to understand the risks in your own company

If you’re not sure which AI tools are being used in your company or what data ends up in them, you can start with a short conversation where we review your current situation and identify the areas worth addressing first.