Shadow AI Employees: Why Your Company Needs an AI Usage Policy – Part 1

Your finance manager uploads sensitive client data into ChatGPT to prepare a quarterly report.

Your marketing coordinator inputs proprietary product information into an artificial intelligence (AI) tool to generate social media content.

Your legal assistant uploads confidential contract templates to expedite the contract drafting process.

Each employee believes they are simply working more efficiently.

What they don’t realise is that they may have just exposed your company’s most valuable assets to unknown third parties, violated client confidentiality agreements and potentially breached international data protection laws.

This is shadow AI usage in the workplace: employees using artificial intelligence tools in their daily work without organisational approval, policies or oversight. The scale of this hidden adoption is staggering.

According to Microsoft’s 2024 Work Trend Index study, 75% of knowledge workers use AI tools at work.

Yet, while 79% of leaders agree that AI adoption is critical to remaining competitive, 60% worry that their company lacks a vision and plan to implement it.

Even more concerning, 78% of AI users are bringing their own tools to work rather than using company-approved solutions.

In Namibia’s rapidly digitalising economy, this percentage continues to increase as professionals realise that these tools help them compete more effectively across sectors, from financial analysis to tourism marketing.

The challenge becomes more complex because Namibia currently has no data protection legislation, leaving businesses to navigate international frameworks without clear domestic guidance.

The critical insight that most corporate leaders miss is simple: the problem is not the technology itself, but the absence of proper oversight. Your employees are not being reckless – they are being resourceful.

However, without AI governance frameworks, training and oversight, their innovative approaches can create risks that threaten your organisation.

Understanding these risks requires examining how shadow AI creates vulnerabilities that traditional business controls never anticipated.

For Namibian businesses serving international clients, these dangers appear in three critical areas.

The Hidden Dangers of Unregulated AI Use

Data exposure and privacy violations represent the most immediate concern. When employees input confidential information into public AI platforms, they may inadvertently share sensitive data with foreign entities.

Most employees don’t realise that many AI platforms use input data to improve their models, meaning your confidential information could theoretically appear in responses to other users.

This challenge becomes particularly acute for Namibian businesses because the country lacks comprehensive data protection legislation.

Companies serving clients in the European Union must comply with the General Data Protection Regulation requirements, while those working with South African entities must consider Protection of Personal Information Act regulations.

Without clear domestic guidelines, businesses must navigate this complex web of international frameworks while managing legal uncertainty.

Intellectual property risks emerge when proprietary information or trade secrets are shared with AI systems.

Consider a mining company engineer who uploads geological survey data to an AI tool for analysis and interpretation.

That proprietary information about mineral deposits could potentially be retained by the AI platform and influence responses to competitors asking similar questions.

– Chisom Obiudo is an admitted legal practitioner of the High Court of Namibia. She also serves as a member of the National Commission on Research Science and Technology National AI technical advisory committee. She can be reached at chisomokafor11@gmail.com

In an age of information overload, Sunrise is The Namibian’s morning briefing, delivered at 6h00 from Monday to Friday. It offers a curated rundown of the most important stories from the past 24 hours – occasionally with a light, witty touch. It’s an essential way to stay informed. Subscribe and join our newsletter community.