The hidden risks of unmanaged AI in the workplace

AI can deliver genuine benefits, but when its use develops without clear policies or oversight, organisations can expose themselves to risks they haven’t fully considered.

Unmanaged AI describes employees using artificial intelligence tools for work without formal approval or oversight from their organisation. For example, an employee might use a publicly available AI tool to summarise a confidential document, analyse customer information or draft a commercial proposal. Their intention may be to work more efficiently, however, depending on the tool, its settings and the information involved, they could unintentionally expose sensitive business information or create data protection concerns.

1. Sharing confidential information
AI tools process the information users provide. Businesses need to understand how that information is handled, retained and potentially used by the service provider. Employees should not assume that information entered into an AI tool will remain confidential.

2. Inaccurate information
AI-generated responses can appear convincing even when they contain errors. This becomes particularly important when employees use AI to support financial decisions, technical work, customer communications or other activities where accuracy matters.

3. Data protection and compliance
Where personal information is involved, organisations must consider their responsibilities under UK data protection legislation. This includes understanding the purpose of processing, the lawful basis, security arrangements and whether information may be transferred internationally.

4. Lack of consistency
Without guidance, different employees may adopt different tools and approaches. This can create inconsistent working practices, unnecessary software costs and difficulties managing business information.

The solution isn’t necessarily to prevent employees from using AI, in fact, an outright ban may encourage people to use tools without discussing them. A more constructive approach is to establish clear guidance.

• Identifying which AI tools employees are already using.
• Establishing a list of approved tools.
• Defining what information can and cannot be shared.
• Reviewing security and data protection arrangements.
• Providing practical employee training.
• Establishing responsibility for reviewing AI use.
• Regularly assessing whether the tools are delivering value.

The aim should be to help employees use AI confidently and responsibly.

For organisations already using Microsoft 365, Microsoft Copilot may provide opportunities to introduce AI within an existing business technology environment, however, adopting Copilot still requires preparation.

Businesses should review their Microsoft 365 permissions, information-sharing arrangements, licensing and data governance before introducing AI capabilities more widely. If employees already have access to information they shouldn’t, AI-powered search and assistance may make those existing permission problems more apparent.

Perhaps the most important consideration is understanding what an organisation wants AI to achieve.

• Is the objective to reduce administration?
• Improve customer service?
• Help employees find information?
• Automate repetitive processes?

Once the problem is clear, it’s easier to evaluate which tools are appropriate, what safeguards are needed and how success should be measured.

AI is likely to become an increasingly familiar part of business technology. The organisations that benefit most won’t be those that adopt the greatest number of tools, but those that understand how to use them effectively, securely and with a clear purpose.

At abtec, we help organisations understand their technology requirements, including Microsoft 365, security and the infrastructure needed to support new ways of working.

Contact abtec to discuss your technology and security requirements.

Email: info@abtec.net
Telephone: 01942 209060
Website: www.abtec.net