"We're not really using AI yet."
I hear that line often. Leaders think they are early, behind, or starting from zero. A benefits brokerage reached out recently because their operations director wanted help figuring out where to begin. He said they had not started yet.
During discovery with the sales team, someone mentioned cleaning up a renewal summary in ChatGPT. A few minutes later, another admitted to running numbers through Gemini. Once one person said it out loud, the rest of the room relaxed. In that single session, we surfaced more than a half-dozen AI use cases leadership had never heard about. More than half the team (23 of 42) were already using free AI tools to speed up day-to-day work.
The moment that stood out: a sales rep casually showed me how he uploaded sensitive client data into a free version of ChatGPT. He did not think he was creating a problem. In his mind, he was trying to deliver cleaner, faster work for a client.
The company did not have an AI program yet. The staff did.
You Already Have AI. You Just Can't See It.
What happened at that brokerage is not unusual. Leaders often assume they are deciding whether to adopt AI, but the real decision is whether to acknowledge what is already happening. People are using these tools today with real client information, and leadership has no visibility into how, when, or why.
Shadow AI is the quiet use of AI tools like ChatGPT or Gemini for day-to-day work without guidance, approval, or awareness from the company. In recent surveys, roughly half of employees say they use AI tools at work without approval, often with information their companies would consider sensitive.
One employee at a client site insisted she did not use AI at all. Then she mentioned she relied on "that chat thing" to clean up her emails before sending them. She had been pasting client names, plan details, and coverage questions into Co-Pilot for months. To her, AI meant robots and science fiction, not the textbox she used ten times a day.
These situations are not failures of intent. They show what happens when new tools arrive before clear policies or business-grade options are in place.
Shadow AI as Your Starting Point
Once leaders see the full picture, the instinct is often to shut everything down. That is understandable, but it misses the larger opportunity. Shadow AI is not only a source of risk. It is the clearest map of where employees already see value and where the real pressure sits in the business.
Most teams are improvising because nobody has given them a safer, supported option. They want to use these tools. They have already built early workflows. They just need guidance. Even a basic workshop covering effective prompting and the difference between safe and unsafe inputs can raise the floor on how people use AI.
When you address Shadow AI directly, you cut down the risk and give people a clear path to work smarter. You also learn where to invest next.
Turning Shadow AI into a Simple AI Program
We mapped everything employees shared into three groups. Green covered basic productivity work that did not involve sensitive information. Yellow included tasks that were useful but needed guardrails, such as summarizing dense documents. Red was anything involving client data, health details, or proprietary methods.
From there, early wins came quickly. One person had a prompt that consistently turned long carrier updates into clear summaries. We cleaned it up and made it a shared resource. We moved useful patterns into business-grade tools so people could keep the speed without the risk. We identified employees who were strong with prompting and asked them to support others.
Leadership came away with a clearer view: their team had already built the first draft of an AI program. Their role was to make it safe, consistent, and part of how the business worked.
A 30-Day Shadow AI Reset
For most small and mid-sized companies, the first step is not buying a new tool. It is getting a clear picture of how work and data move through the business today.
Week 1: Map your data landscape. List where sensitive information lives: CRM, ERP, email, shared drives, client portals. Identify who touches it and how it moves between systems.
Week 2: Surface what is happening. Run small-group conversations with employees. Frame it as learning, not enforcement. Ask what tools they use, what saves them time, and what feels risky.
Week 3: Build simple guardrails. Create a one-page guide using real examples from your team. What is safe to paste into a free AI tool? What stays inside approved systems only?
Week 4: Close the loop. Review what changed and what still needs work. Identify patterns that showed up across teams and flag them as candidates for further investment.
The Line That Sticks
The employees using AI in your company right now are not the problem. They are showing you where the pressure sits and what work is ready for support.
You do not need to start an AI program. You need to catch up to the one your team already built.