A fee earner has a witness statement to tidy up before five o’clock. The firm hasn’t given them an AI tool, or has one but it’s clunky, so they do what half the country does when it wants something done faster: they open ChatGPT on the side, paste the thing in, and get on with their afternoon. No malice, no memo, no record. Just a person trying to clear their desk. 

Multiply that by everyone in the building, and you have shadow AI. And you almost certainly have more of it than you think. 

What “shadow AI” actually means 

Shadow AI is the use of AI tools inside a firm that the firm hasn’t approved and often can’t see. Free ChatGPT on a personal login. A browser extension someone installed to summarise emails. An AI note-taker running in the background on a client call. A transcription app a PA signed up for on a free tier. None of it went through IT. None of it appears on any list. And all of it may be handling client information. 

It’s not a fringe problem. One recent report found that more than 80% of employees use unapproved AI tools at work, half of them regularly, and in many cases they don’t realise they’re doing anything outside sanctioned practice at all. That last part matters. Most shadow AI isn’t people intentionally breaking the rules but using normal-feeling technology to do their jobs, with no sense they’ve crossed a line.  

The gap that should worry you 

The uncomfortable bit isn’t that it’s happening. It’s the size of the gap between what’s happening and what leadership believes is happening. 

The UK numbers are stark. Research published this year by Access Legal found that 59% of fee earners admit to using unapproved AI tools for client work, while 68% of firm leaders say they have full visibility of AI use across the firm and believe they face zero risk. Read those two figures together and the problem states itself: most of the people in charge think they can see the whole picture, and most of the people doing the work know they can’t. 

That’s not just an awkward mismatch. Under the SRA Code, firm leaders carry a duty to supervise and it’s hard to supervise something you’re confident isn’t occurring while most of your team just gets on with it. 

It’s probably not who you think 

Ask a managing partner where the risk sits and they’ll usually point at the junior end – the trainees and paralegals, the digital natives, the ones who’ll try anything. 

They’ve often got it backwards. The bigger exposure tends to sit at the top. There’s a well-named version of this now, the “equity partner problem”: senior lawyers using unapproved tools to boost their own productivity, while handling exactly the firm’s most confidential and highest-value work. Juniors, on the whole, ask permission. Senior people trust their own judgment and don’t. And more often than not, they’re the ones with the sensitive matters open. 

Why “just ban it” makes things worse 

The instinct, once a firm realises the scale of this, is to shut it down. Blanket ban, all-staff email, problem solved. 

It isn’t, and it usually makes things worse. When a firm bans AI without offering an approved alternative, people don’t stop – they move to free, consumer tools on personal devices, which is where the firm loses all visibility over where client data is going. A ban doesn’t remove the behaviour. It removes your line of sight to it. And it’s unenforceable anyway, because AI is now baked into the software everyone already uses – Microsoft 365, your research platforms, the video calls – so “no AI” is a rule the tools themselves break for you.  

How to find out what’s actually going on 

You can’t govern what you can’t see, so the first job isn’t a policy. It’s a look under the bonnet. A few ways to do it that actually work: 

Ask, but make it safe to answer honestly 

A short, genuinely anonymous survey, covering which tools people have used for work, how often, for what, will tell you more than any assumption. People will admit to a form what they’d never volunteer in a team meeting, provided they’re sure it won’t land on them. 

Talk to IT about what’s leaving the building 

Your IT team can often see far more than leadership realises – traffic to consumer AI sites, browser extensions, new sign-ups on work accounts. They may already have a rough picture; they’ve just never been asked for it. 

Look at the tools you’ve already approved 

Shadow AI hides inside sanctioned software too. AI features have appeared in tools your firm signed off years ago, switched on by default, doing things nobody assessed. Worth an audit of what’s quietly been added to what you already run. 

Assume the meeting data is the blind spot 

Note-takers and transcription tools are the fastest-growing corner of this, and the easiest to miss. An AI bot on a client call captures a privileged conversation without a single document ever being uploaded. 

Start from “this is happening,” not “does this happen”  

The firms that get a real answer are the ones that go in expecting to find something. The ones that go in hoping to be reassured usually are but usually shouldn’t be. 

What to do once you can see it 

Finding shadow AI isn’t the end of the exercise, but it changes the conversation from a hunt into a plan. And the fix is more straightforward than the discovery. 

People reach for unsanctioned tools because there’s a job to do and nothing better in front of them. Give them a functional, approved alternative and clear guidance on using it, and shadow AI use tends to fall away on its own. The work to be done is the ordinary governance work – a short list of tools people are allowed to use, a plain sense of what can and can’t go into them, and someone whose job it is to keep that current. Not a forty-page policy. A clear, usable answer to “what am I allowed to do.”  

That’s a bigger topic than one blog post, and we’ve written it up properly in our guide to AI governance for law firms – what a firm needs in place before any tool goes live, and how to close the gap between what’s happening and what you’d sign off on. 

For now, the useful first move costs nothing: stop assuming, and go and look. The 68% who are sure they have full visibility are the ones most worth checking.