Shadow AI: your employees already use AI, with your data. Five steps to govern it

Tuesday, 4:50 p.m., at a 25-person accounting firm. A technician has until tomorrow to answer a client who is disputing a notice of assessment. She copies the correspondence, adds the T4 slip and the financial statements, and asks the AI assistant on her phone for a summary and a draft letter. The result is good. Nobody at the firm knows the file has left, where it went, or for how long.

The same scene plays out elsewhere: a paralegal summarizes a statement of facts, a clinical research associate rewrites part of a protocol, a sales director has a client list analyzed. Nobody is acting in bad faith: the tool is effective, free and within reach, and the organization has offered nothing else. The problem is not AI. It is that AI is working with your data, outside any framework.

Shadow AI means AI tools used in an organization that the organization has not chosen or assessed: nobody has checked where the data goes, who can read it or what the vendor does with it. It is mostly generative AI, the kind that produces text, images or code on request. Five forms keep coming up:

• personal accounts on consumer AI assistants, free or paid;
• browser extensions that summarize, translate or draft from the page on screen;
• AI features added to software you already use (email, word processing, video conferencing), switched on without an assessment;
• transcription bots that join meetings to record and summarize them;
• mobile apps on personal phones.

Use is growing fast. According to Statistics Canada, the share of workers who had used generative AI at work rose from 17% in September 2024 to 30% in July 2025; a separate survey conducted in March 2026 puts it at 35.9% over the previous 12 months, and at 65.6% in professional, scientific and technical services, a sector that includes legal services, accounting and scientific research. The agency does not say how much of that use goes through tools provided by the employer.

On the business side, 19.2% of businesses reported having used AI to produce goods or deliver services in the 12 months before the second-quarter 2026 survey, and cybersecurity or privacy concerns were their leading barrier (13.4%). The two surveys do not measure the same thing, but Statistics Canada, which made the same comparison with 2025 data, notes that the gap may reflect worker-driven use.

What goes into the tool is not abstract “data”: it is the whole document, names included. And, the federal government warns, the suppliers of some tools may inspect that data or use it to further train their models.

The document often contains information about third parties: your client’s own clients, the opposing party, the trial participant, the person speaking in a transcribed meeting. And what comes back matters too: a summary produced by AI about an identifiable person may itself be new personal information, the federal government points out.

Law 25: a possible incident

Quebec’s private-sector privacy act, modernized by “Law 25,” requires reasonable security measures (s. 10) and defines a confidentiality incident as access to, use or communication of personal information not authorized by law, or its loss (s. 3.6). Pasting a client’s file into a tool nobody has assessed communicates it to a third party, with no contract and no assessment: depending on the circumstances, that is an incident, to be assessed, sometimes reported, always recorded (ss. 3.5 to 3.8). If the information goes outside Quebec, the communication would also have required an assessment and a written agreement (s. 17; see our guide to Law 25 and AI).

Professional secrecy

Quebec’s Charter of human rights and freedoms protects professional secrecy (s. 9), and the Professional Code, which covers lawyers, notaries and chartered professional accountants among others, requires professionals to preserve the secrecy of all confidential information that becomes known to them in practice: only the client, or an express provision of law, can release them from it (s. 60.4). The Barreau du Québec points out that supervision extends to the AI tools the team uses, and it requires its members to complete a two-hour course on generative AI before April 1, 2027.

Confidentiality agreements and trade secrets

For a CRO, the ICH E6(R3) guideline on good clinical practice, implemented by Health Canada on April 1, 2026, calls for activities transferred to a service provider to be documented in an agreement, and for the sponsor to oversee the important ones, even when subcontracted. It defines confidentiality as preventing disclosure, to anyone other than authorized individuals, of the sponsor’s proprietary information or of a participant’s identity. For an SME, a client list with its margins is valuable because it is confidential; and if a non-disclosure agreement limits the information to named individuals, the vendor of a consumer tool is not one of them.

What comes back: plausible errors

The large language models behind these assistants can routinely produce plausible-sounding content that is not necessarily accurate, the privacy commissioners note. The Barreau warns that some tools can make up sources, as with fabricated case law. An approved tool does not remove that risk: review by a competent person remains the rule.

The first reflex, a ban, fails for a simple reason: these assistants are one tab or one app away, on devices the organization does not manage, and some can even be used without an account, the investigation report notes. With no alternative, a ban does not remove the need: it moves the use to personal phones, with no trace in your systems.

The federal government asks its institutions to explore generative AI where they can manage the risks; it forbids public servants to enter personal information into publicly available online tools, but allows it in systems the government controls, with the appropriate safeguards. The Canadian Centre for Cyber Security recommends a plan for how AI is used, with oversight and review; the privacy commissioners ask that personal information go into a prompt only where authorized. The Ordre des CPA du Québec offers a model guideline, and the Barreau recommends internal policies, regular audits and ongoing training.

The first two steps require no purchase, and each one feeds the next.

1. 1

   Take stock of actual use

   A short survey, with no names and no sanctions: which tools, for which tasks, with which documents, on which device. Add what your systems already know: firewall or proxy logs, installed browser extensions (an extension can request permission to gather all the information the browser sees, the Canadian Centre for Cyber Security warns), AI features switched on, bots invited to meetings. Microsoft Defender for Cloud Apps, if your Microsoft licences include it, classifies discovered apps by category, including “Generative AI”; Microsoft advises discovering before blocking.

2. 2

   Classify your data

   Decide what never goes out, what can go out and on what conditions, with examples from your own files. The grid below is a starting point; the Ordre des CPA du Québec offers a similar one, with four sensitivity categories.

3. 3

   Offer an approved tool, one where you know where the data goes

   For each need identified, an assessed tool: you know who receives the data, where it is processed, how long it is kept, whether it trains a model and what the contract says. A paid subscription to a consumer assistant is not enough: according to the Ordre des CPA du Québec, only business accounts come with contractual commitments on how data is used. Even a business account leaves questions open: see our article on data sovereignty.

4. 4

   Write a one-page policy, and train

   One page everyone reads: permitted tools, excluded data, required review, who to contact. The law already requires policies that set out staff roles, approved by the person in charge of the protection of personal information (s. 3.2). Then train with cases drawn from your own files; the Ordre des CPA du Québec’s model can serve as the basis for a full version.

5. 5

   Review and adjust

   Review everything every quarter in the first year: tools in use, new AI features in your software, recurring requests, incidents. Add a tool when a real need appears: a frozen policy recreates shadow AI.

Which data, in which tool

The one-page policy: checklist

• Permitted tools are named, with the need each one covers.
• Data that never goes out is listed, with examples.
• Unapproved personal accounts, extensions and transcription bots are excluded from work.
• Every AI answer is reviewed by a competent person before it is used.
• Meeting participants know when a bot is transcribing, and can object.
• No AI feature is switched on in any software without an assessment.
• Anything sent to the wrong place is reported right away, without fear of punishment.
• The policy is dated, approved by the person in charge of the protection of personal information, read by everyone and reviewed on a set date.

Treat each case as a possible incident, without looking for someone to blame:

1. 1Note what went out, when and where, then delete the conversation and the files if the tool allows it.
2. 2Assess the risk of injury with the person in charge of the protection of personal information: sensitivity, anticipated consequences, likelihood of harmful use (s. 3.7).
3. 3If the risk is serious, promptly notify the Commission d’accès à l’information and the people concerned (s. 3.5).
4. 4In every case, record the incident in the register, which must be kept for at least five years.
5. 5For a law firm, the Barreau also recommends informing clients; for a CRO, reread the agreement with the sponsor.
6. 6Fix the cause: a missing tool, an unclear rule, training to redo.

1. 1Monday: send out the no-names survey.
2. 2This week: ask IT for the AI apps seen in the logs and the browser extensions installed.
3. 3Next: classify your data in one session, with a partner, the person in charge of the protection of personal information and each team.
4. 4Then: choose the approved tool for the two or three most frequent needs, and write the one-page policy.
5. 5Finally: train, set the date of the first review, and keep it.