NCSC's shadow AI warning: make useful tools visible

What happened

On 7 September 2026, the UK's National Cyber Security Centre published guidance about shadow AI: AI use outside an organisation's approved systems and processes. It explains that unapproved tools can expose sensitive material and reduce visibility over how information is handled. Its advice includes understanding why employees use these tools and providing suitable, secure alternatives.

Read the NCSC's original publication. This is guidance, not a new law or a report about AAG.

Why it matters to a small business

A company does not need a large technology department to encounter the underlying problem. A person may paste a customer complaint into a familiar personal app because writing a reply is difficult. The immediate intention can be helpful while the business has no agreed view of the information involved.

AAG's take

Our suggested starting point is a short conversation about actual tasks. Ask where writing, finding information or organising records is taking too long. Record the task before choosing a product. Then offer a clear route for asking whether a particular tool and type of information are appropriate.

For example, an invented restaurant manager might need help rewriting a public menu description. That is a different task from analysing named staff sickness records. An approval list that treats both as simply “AI use” leaves the important distinction unexplained.

Create a one-page working rule with three examples: information that may be used, information that needs checking first, and information that stays outside the tool. Name the person who answers questions and give staff a way to report a mistake promptly. Make the approved route practical enough to use during a busy day.

This is AAG's operational interpretation, not an NCSC assessment of any particular business. Our practical AI pilot guide explains how to test one task, limit access and measure the result.

Sources and further reading

National Cyber Security Centre, Simon B, The hidden risks of shadow AI, 7 September 2026. Reviewed 13 October 2026. Summary is paraphrased; the example and recommendations are original AAG analysis. No endorsement is implied.