Dealing with shadow AI: What companies should do instead of banning AI
In most companies across Singapore and Thailand, the AI policy already exists: drafted, approved and circulated. And yet, somewhere in the same organisation, an employee is pasting a supplier contract into a free chatbot to summarise it before a meeting. This is known as shadow AI: employees using AI at work without company oversight, such […] The post Dealing with shadow AI: What companies…
In many Singapore and Thai companies, AI policies exist, but employees often use AI tools like chatbots, writing assistants, and summarisers without company oversight. This is known as shadow AI – employees using AI without IT department or administration approval, running on unmonitored accounts. The motivation is clear – these tools are familiar and can increase productivity.
However, when employees upload sensitive data like contracts, invoices and customer records into unmanaged tools, the company loses visibility and control, violating personal data protection laws. Prohibition rarely works, as it only encourages employees to use unapproved tools like personal devices, making visibility even more elusive.
Instead, companies should view shadow AI as a demand signal and provide useful approved tools, implementing identity management, access controls, monitoring, logging, and continuous training to address the risks. When useful approved tools are available, employees will adopt them willingly, turning hidden AI usage into productivity while ensuring proper data practices.
Regional differences in regulation make this especially important, as Southeast Asia’s AI readiness varies and enforcement is inconsistent. Internal governance should guide response to shadow AI, turning it into a strategic advantage rather than a reactive measure.
Written by urgent.news from e27's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
