Who Did You Just Give Access to Your Business Data?

Someone in your team finds an AI tool that could save them hours. They create an account, upload a document or connect their work email. Within minutes, it is helping them get things done.

There may be no malicious intent, no suspicious email and no obvious warning. But a customer proposal, a meeting transcript or commercially sensitive information may now be held by a service your business has never reviewed.

If a customer asked where their information had gone, could you give them a clear answer?

Shadow AI Is Often Just People Trying to Do Their Jobs

Shadow AI means AI tools being used for work without the organisation's knowledge or approval. It might be a personal chatbot account, a browser extension, a meeting recorder or an AI feature inside an existing app.

The problem is not that every AI tool is unsafe. It is that the business may not know what is being used, what information is being shared or which terms apply. A familiar brand or a paid subscription is not a substitute for checking the particular product, plan and settings.

It Does Not Have to Be Connected to Your Network

“Connecting to the business” now means more than plugging a device into the office network. A cloud app may request permission to read mail, access files or act on someone's behalf. The exact permissions matter: signing in with a work account is not, by itself, proof that an app can read everything.

There is another route too. Copying text into a chatbot or uploading a spreadsheet can share information without granting any ongoing access. Removing an app's connection later does not necessarily delete data already uploaded or copied.

Six Questions to Ask Before You Connect or Upload

1. What Does This Tool Actually Need to Access?

Check the permissions, not just the sales pitch. Does a scheduling tool need your calendar, or is it also requesting access to email and contacts? Limit access to what is needed for the task. If the request is unclear, get advice before approving it.

2. What Information Will We Be Giving It?

Consider what is in the document or conversation, not just its filename. Customer details, staff information, pricing and confidential discussions can all appear in everyday work. Agree which information may be used with approved tools and which must stay out.

3. Where Does the Data Go, and Who Else Handles It?

Ask where information is stored and processed, whether it moves between countries and which other providers handle it. Check retention, deletion, human review and whether inputs or outputs can be used to train models. These arrangements vary by service, contract, account type and configuration. Do not assume all AI tools train on your data, or that none do.

4. Who Approved It, and Who Owns the Account?

A business-critical tool should not depend on an employee's personal account. Identify an owner, record its purpose and use business-managed access where appropriate. Include it in your process for people joining, changing roles and leaving.

5. How Do We Stop Access and Remove Our Information?

Know how to revoke permissions, disable integrations and request deletion. Check what happens to retained copies and backups under the provider's terms. Ending a subscription, deleting a user and removing stored information are not necessarily the same thing.

6. What Happens If the Provider Has a Problem?

Consider both a security incident and an outage. Who assesses your exposure, who can disconnect the service, and how would your team keep working? Understand what activity can be monitored and where visibility is limited. A supplier's reputation cannot replace your own response plan.

The Same Questions Apply to Your Supply Chain

AI is the obvious talking point, but the principle is wider. Accounting integrations, recruitment platforms, file-sharing services, outsourced support and supplier portals can also hold business information or have access to your systems.

Some connections are essential. They still need a named owner, appropriate permissions and regular review. A tool your team stopped using six months ago should not retain access simply because nobody remembered to remove it.

Useful AI Needs Clear Rules, Not a Blanket Ban

Start by asking your team what they use and why, without making them afraid to answer. Create an approved-tools list, a straightforward way to request new services and clear guidance on acceptable data use. Give people a safe way to do the work rather than leaving them to find their own.

Konnetix can advise on reviewing connected applications, understanding access permissions and putting practical approval and access-review processes in place. We can help you identify questions to put to suppliers and where specialist data-protection or contractual advice may be needed.

Our Complete 365 service brings together fully managed IT, cyber security and business assurance. It provides a broader basis for conversations about how technology is managed, rather than treating each new tool as an isolated decision. The right controls and any additional work depend on your systems and requirements; no service can guarantee visibility of every tool or prevent every supplier incident.

Before the next “we need this AI tool” becomes another connection nobody owns, ask what it can access and where your information will go.