Artificial intelligence is finding its way into nearly every corner of business, whether leadership has approved it or not.
An accounting manager uses ChatGPT to help analyze a spreadsheet. A sales representative uploads customer information to an AI platform to draft a proposal. Someone in operations uses a free AI tool to summarize a confidential vendor agreement.
In each case, the employee is simply trying to work more efficiently. The problem is that the company may have no idea which tools are being used, what information is being shared or whether the outputs are accurate.
This is known as shadow AI: the use of artificial intelligence tools without formal approval or oversight from an organization's IT, security or leadership teams.
For CFOs and business leaders, shadow AI presents a growing challenge. Companies want the productivity gains that AI promises, but those gains can introduce financial, operational and compliance risks when employees adopt tools outside established controls.
Why Employees Are Turning to Unapproved AI Tools
Most employees aren't deliberately trying to circumvent company policies. They're trying to solve problems.
Consider an employee who spends several hours each week preparing reports. They discover an AI tool that can complete much of that work in minutes. The benefit is immediate, while getting a new technology approved through the company's formal process could take weeks or months.
It's easy to understand why they might start using it.
In many cases, shadow AI reveals a disconnect between the tools employees need and the resources their organizations provide. Employees are finding practical applications for technology faster than their companies can evaluate and implement it.
That initiative can be valuable. It can also create problems when employees don't understand where the boundaries are, particularly when sensitive business information is involved.
The challenge for leadership is finding a way to support innovation without losing control of company data and processes.
The Financial and Operational Risks of Shadow AI
The most concerning aspect of shadow AI isn't necessarily the technology itself. It's the lack of visibility into how that technology is being used.
When employees rely on personal AI accounts or unapproved applications, those activities may fall outside the company's existing security measures, vendor agreements and internal controls.
For financial leaders, several areas deserve particular attention.
1. Exposure of confidential financial information
Employees may upload financial statements, payroll records, customer information or proprietary business data without understanding how the AI provider handles that information.
Depending on the platform and its settings, submitted data may be retained, reviewed or used to improve AI models. Even when a provider offers privacy protections, those protections need to be verified before sensitive information is shared.
For companies handling confidential client information, a single unapproved upload could create contractual, regulatory or reputational consequences.
2. Inaccurate information influencing business decisions
AI tools can produce convincing answers that contain factual errors, incorrect calculations or unsupported conclusions.
Imagine a financial analyst using an AI-generated summary to evaluate a vendor contract or prepare a budget forecast. If the output isn't independently verified, an error could influence a purchasing decision, financial projection or recommendation to management.
The concern isn't that employees are using AI to assist with analysis. It's that AI-generated work may be treated as reliable without the same review standards applied to other business information.
3. Gaps in internal controls and accountability
Businesses invest considerable effort in establishing approval processes, access restrictions and documentation requirements.
Unapproved AI tools can introduce new workflows that bypass those safeguards.
If an employee uses an external AI application to process financial information, who verifies the output? Where is the work documented? Does the company have a record of what information was shared?
These questions become especially important during audits, regulatory reviews or investigations into financial discrepancies.
4. Unexpected technology costs
Shadow AI can also create unnecessary expenses.
Individual employees or departments may purchase overlapping AI subscriptions without coordination. Over time, those costs can accumulate, leaving the organization paying for multiple tools that perform similar functions.
Without centralized oversight, leadership may struggle to evaluate whether those investments are delivering measurable value.
Before Writing Another Policy, Find Out What's Already Happening
A common response to emerging technology risks is to introduce new restrictions.
While clear policies are necessary, a blanket prohibition on unapproved AI tools may do little to address the underlying issue. Employees who have come to rely on these tools may continue using them, particularly if no practical alternative is available.
A better starting point is understanding how AI is already being used throughout the organization.
Leadership can begin by asking department heads and employees a few straightforward questions:
- Which AI tools are you currently using for work?
- What tasks are those tools helping you complete?
- What types of company or customer information are being entered?
- Where could an approved AI solution make your job easier?
These conversations should focus on understanding existing practices rather than assigning blame, while still addressing any serious security or compliance concerns that come to light.
The responses may reveal more than potential risks. They can also identify opportunities to improve workflows, eliminate repetitive tasks and make better technology investments.
Building AI Oversight That Works in Practice
Once leadership understands where AI is being used, the next step is establishing reasonable safeguards.
That doesn't necessarily require a complicated governance program. For many small and midsize businesses, a practical approach can begin with a few fundamental measures.
Establish clear guidelines for sensitive information. Employees should know which types of data can and cannot be entered into AI platforms. Financial records, customer information, employee data and confidential agreements deserve particular consideration.
Evaluate and approve useful tools. Rather than expecting employees to abandon technology that makes their work easier, identify which applications offer meaningful benefits and can meet the company's security requirements.
Maintain human review of critical work. AI can support financial analysis, reporting and operational decision-making, but important outputs should still be reviewed by qualified employees before they influence business decisions.
Assign responsibility for oversight. IT, finance, operations and executive leadership should have clearly defined roles in evaluating AI tools, managing access and monitoring costs.
Revisit policies as technology evolves. AI capabilities and associated risks are changing quickly. Guidelines that make sense today may need adjustments as new applications become available.
The objective is to create an environment where employees can use AI productively without introducing unnecessary risk.
The CFO's Role in Responsible AI Adoption
Although AI governance is often viewed as an IT responsibility, its implications extend well beyond cybersecurity.
CFOs have a particularly important role because many of the risks associated with shadow AI intersect with financial reporting, internal controls, vendor management and resource allocation.
Finance leaders are also well positioned to evaluate the business case for approved AI investments.
Where can automation reduce administrative costs? Which applications offer measurable productivity improvements? What controls are needed to protect financial information? And how can the organization avoid paying for technology that delivers little value?
These are business questions as much as technology questions.
Working alongside IT and operational leadership, CFOs can help establish an approach that balances innovation with accountability.
The Bottom Line
Shadow AI isn't going away. As AI tools become more accessible and capable, employees will continue looking for ways to incorporate them into their daily work.
Companies that respond only with restrictions may miss an opportunity to understand how their teams are working and where technology could improve performance.
The more productive approach is to bring those activities into the open, establish appropriate safeguards and give employees access to tools they can use with confidence.
For CFOs, the first step may be as simple as asking a question at the next leadership meeting:
Do we actually know which AI tools our employees are using, and what company information they're sharing with them?
If the answer is no, it's time to find out.
Frequently Asked Questions
1. What is shadow AI in the workplace?
Shadow AI occurs when employees use AI tools without company approval or oversight, potentially exposing sensitive information and creating security or compliance risks.
2. What are the biggest risks of shadow AI?
Key risks include data breaches, inaccurate AI-generated information, weakened internal controls and unmonitored technology expenses.
3. How can businesses manage shadow AI?
Start by identifying which tools employees use, establishing clear AI policies and providing approved alternatives that support productivity without compromising security.
4. Why should CFOs be concerned about shadow AI?
Shadow AI can affect financial reporting, data security, compliance and technology spending. CFOs play an important role in balancing AI-driven efficiency with financial oversight.
About the Author
Donald O. Retreage, Jr. is a visionary finance executive and trusted advisor to C-suite leaders and boards of directors. He leverages his extensive background in corporate finance and operations to drive growth-focused strategies and successful business turnarounds. As a transformational servant leader, he excels at building and coaching cross-functional and cross-cultural teams to deliver measurable business outcomes that exceed stakeholder expectations.
Contact Us
If you have any questions or would like to discuss your organization’s finance and strategic management needs, please call the Florida CFO Group at 1-877-352-2367 or send us a message. We are here to help you navigate your financial challenges and achieve success!
Sign Up for the CFO Insider
Every month, our CFOs share what they’re seeing in the market, what smart companies are doing differently, and where hidden risks and opportunities may be emerging. The Florida CFO Insider is built for leaders who want to grow intentionally, optimize performance, and protect what they’ve built. Join the list and get the inside perspective - sign up here for the Florida CFO Insider Monthly Newsletter.