Shadow AI: when everyone brings their own tools to the table

A staff member works out that one AI tool writes a good first letter to a new client. A colleague finds one that pulls the deadlines out of a 40-page lease. A third person switches on a summarising feature that has appeared in the practice management system. All simply trying to get through their work faster. However, some may have done this on their own accounts.

People finding better and more efficient ways to do their work usually benefit the firm. Yet issues can arise when this is done in isolation.

When staff use AI tools the firm hasn't approved, or AI features the firm hasn't decided to use, it is called shadow AI. Clio's 2026 Legal Insights Report, a survey of 533 Australian legal professionals, found 98% of them use AI. Across 47 countries, KPMG and the University of Melbourne found 40% of employees say their workplace has a policy or guidance on generative AI use. Without that guidance, each person makes the choice for themselves.

This can mean a lot of good work happening across the firm with no single list of the tools doing it. It can also mean a lot of data and information going into tools which have not been approved or checked.

So how can a firm leverage shadow AI to ensure it is both safe and productive?

1Where shadow AI turns up

What we tend to see is shadow AI arriving from several directions at once. A staff member signs up for a tool in their own name, sometimes pays for it themselves, and uses it on a work laptop and a home computer. The firm may only realise if it turns up on an expense claim. A free version leaves even less of a trail, because there is no invoice at all.

Some of it comes built into software the firm already uses. Practice management systems, video platforms and email programs have been adding summarising, drafting and transcribing features, and in January 2025 Microsoft introduced Microsoft 365 Copilot Chat, a free AI chat for its business customers. Because these features come from a vendor the firm already approved, they can be in use across the firm before it has talked about them.

These tools can turn up anywhere (partners included!). A partner using a personal account for client letters is part of the same pattern as a graduate doing it, and partners are often the people least likely to be asked about it. Those that are using AI most capably can also be the quietest about it, particularly if they have figured out how to streamline workflows and do not want to lose their new tools.

2Productivity and safety

When the people using AI well keep quiet about it, the firm can't build on their work, and it can't check where its information is going.

Take a staff member who has spent weeks getting a tool to produce a first draft that needs very little correction. That method lives in their personal account, next to their personal material, where the firm can't see it or back it up. If they move to another firm, the account goes with them. Meanwhile, three people in different teams may be paying for the same tool on their own cards, or for something already included in a licence the firm holds.

The same accounts may hold client information. The Office of the Australian Information Commissioner (OAIC), in its guidance on commercially available AI products, asks organisations to check a product's terms to understand "who will have access to personal information input or generated", and to update their privacy policies to explain how they use AI. It also recommends that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools.

Clients are starting to ask the same questions. Clio's research, reported by Team Clio for ALPMA, found 70% of Australian legal professionals say clients are now asking how AI is being used in their matters. The question may arrive in a tender, a due diligence questionnaire or a phone call, and answering it means knowing which tools touched the matter and whose account they were in. Faced with all of that, a firm's first instinct can be to ban personal AI accounts.

3Is banning shadow AI always a good call?

But what happens after a ban? What we're seeing is that the use carries on and people stop mentioning it. AI tools are websites and apps that open on a personal phone or a home computer, so a policy reaches only part of the use (Shadow IT vs Shadow AI looks at this in more detail). The people who were furthest ahead, the ones the firm most needs to hear from, learn to keep their tools to themselves.

Asking keeps those people talking, and it gives the firm the list it needs. With that list, the firm can approve the tools that work, put firm accounts behind them, and give a named person the job of keeping it current.

The AI Ask

The ask works best as a conversation, run in six steps.

Once a firm has worked through those steps, a partner asked by a client how AI was used on their matter can answer in a sentence. A staff member who finds a useful tool mentions it in a team meeting the way they would mention a good precedent, and the method is shared across the firm. The firm pays for each tool once, and knows where its client information goes.

4Where we come in

Our investigation finds out which AI tools your people use, what work they use them for, where client information goes and what it costs. It measures how long the firm's work takes today, so the firm starts from a baseline of its own, and it includes a draft AI use policy for your partners to finalise. The findings belong to your firm whether or not we go any further together.

If you'd like to know what is in use across your firm, reach out to our team. The first conversation works out whether your firm is the right fit for the AI Uplift Program, and whether we are the right people to help.

Bringing shadow AI into view