London, UK — 20 July 2026 — Small and medium-sized businesses across the UK are being urged to get to grips with “Shadow AI” — the unapproved, unmanaged use of tools like ChatGPT and Gemini by their own staff — before it becomes a serious data and compliance headache. UK-based AI consultancy Cloud & Clear says the trend is now so widespread that most SMEs are exposed to it without realising, and warns that the businesses handling it best are not the ones trying to shut it down.
The problem hiding in plain sight
Shadow AI describes AI tools being used inside an organisation without formal approval, oversight, or any policy governing how they’re used. Cloud & Clear likens it to an employee using their personal Gmail account to send client documents: convenient, well-intentioned, and a problem most SME leaders haven’t thought through.
“Your staff are using AI right now,” says Jamie Bowden, COO and Co-Founder of Cloud & Clear. “Some of it you know about. A lot of it you probably don’t.”
The scale of the issue is backed by UK-specific research. A study commissioned by Microsoft UK and conducted by Censuswide in October 2025 found that 71% of UK employees have used unapproved consumer AI tools at work, with 51% doing so every week. Despite this, just 32% expressed any concern about the privacy of company or customer data they input into these tools, and only 29% were worried about the impact on their organisation’s IT security.
“These are not rogue employees trying to cause harm,” Bowden says. “They are people trying to do their jobs better, using tools they’ve heard work well. The problem isn’t intent, it’s that no one set the rules before the tools arrived.”
Why Shadow AI takes hold
According to Cloud & Clear, Shadow AI tends to appear for one of three reasons:
- Employees have a genuine need and the business hasn’t provided a tool for it;
- An official tool exists but is slower or less capable than the free alternative;
- Or staff were never told a policy existed, or the policy was too vague to be useful in practice.
The risks are real — but manageable
Data leakage is the most obvious risk. When an employee pastes a client proposal into a personal AI account for help with the writing, that data leaves the organisation’s environment — and, depending on the platform, may be used to train future models, with no visibility, audit trail, or way to retrieve it. The ICO has separately warned that UK GDPR obligations apply regardless of whether an AI tool was formally approved for use.
There is also an accuracy risk. Generative AI tools can produce plausible but incorrect output, and when that output feeds into client work, financial decisions or internal processes, errors can compound quickly — especially where a business has no visibility over where AI-generated content has entered its workflows.
Banning AI is not the answer
“Employees who feel blocked from useful tools find other ways to get access,” says Bowden. “A ban rarely holds, and it tends to make the problem worse because now it’s happening in secret, and you’ve lost whatever visibility you had.”
Instead, the consultancy recommends SMEs get ahead of the issue: being honest about what tools staff are already using, understanding why they’re using them, and building a practical framework that channels that behaviour rather than fighting it. That includes providing sanctioned tools that are genuinely better than the free alternatives, and being explicit about what data should never leave the organisation, and why.
“The organisations handling this well are not the ones that locked everything down,” added Bowden. “They’re the ones that had the conversation early, built sensible guardrails, and made it easy for people to do the right thing.”
Where SMEs should start
Cloud & Clear’s advice to SME leaders unsure of their exposure is simple: find out what AI tools your teams are currently using and embark on AI training so your business can move from risky experimentation to effective implementation.
The AI Edge Masterclass facilitated by Cloud & Clear offers a practical, strategy-first programme built specifically for business owners and decision-makers. It’s not about technology for technology’s sake — it’s about building the clarity, framework, and capability to make AI work for your business. You can find out more and register at AI Masterclass.