Short answer
Shadow AI happens when staff use AI tools the firm has not approved, with no rules about what information goes in. At an architecture or engineering firm, that can mean pasting client site plans or contract language into a personal chatbot account. This is not an argument against AI. A short written policy covering approved tools and off-limits information addresses most of the risk. Insurers and clients may ask about it, and policy wording varies, so review the actual terms.
What shadow AI looks like at a small firm
Consider a 10-person firm where nobody has set any AI rules. A project manager uses a personal chatbot account to summarize a long specification. An associate pastes a client’s site plan into another tool to draft a narrative. An office manager uses a free tool to clean up a proposal that includes client contact details.
Each person is trying to work faster, and none of them intends any harm. The problem is that the firm does not know which tools hold which information, or what those tools do with it. Settings differ by product and by account type, so the firm cannot assume what happens to the data.
What the 2026 breach reports say about shadow AI
IBM’s 2026 Cost of a Data Breach research reportedly found shadow AI in 43% of the breaches it studied, up from 20% the year before. It also reportedly found that those breaches cost more on average. The figures come from a study of 602 organizations, mostly large ones, so the dollar amounts do not describe what a small firm would pay. Please check the figures against the original IBM report before relying on them.
Verizon’s 2026 Data Breach Investigations Report is also reported to rank shadow AI among the more common sources of accidental data leaks. Treat that as a signal that the issue is real, not as a prediction for any single firm.
Why shadow AI creates contract risk
Many client agreements and NDAs limit where project information can go. Some restrict sharing with third parties, and some require written approval before data leaves the firm’s systems. Pasting a client’s drawings or financial details into an outside tool may conflict with those terms, depending on the contract language and the tool’s settings.
Security-sensitive projects raise the stakes. Drawings of secure facilities, utilities or critical infrastructure often carry stricter handling requirements. A contract review can show which clauses apply, and the firm’s contract check can help identify confidentiality language worth a closer look.
What to put in a one-page AI policy
A short policy is usually enough to start. It can cover:
- Approved tools. Name the tools staff may use, and prefer business accounts with data controls, such as options that stop the provider from training on the firm’s inputs.
- Off-limits information. List what never goes in, such as client personal information, security-sensitive drawings, confidential contract terms and employee records.
- Account rules. Require staff to use firm-managed accounts instead of personal ones.
- Review of output. Require a person to check anything AI produces before it goes to a client, since the firm remains responsible for its work.
- Questions and exceptions. Name one person staff can ask before using a new tool.
Business tiers of many AI tools offer data controls, so the goal is approved use rather than avoidance. Settings and terms vary by vendor and plan, so the firm should read them before approving anything.
Real-world example
Consider a hypothetical eight-person engineering firm. A client’s agreement requires written consent before project data is shared with outside parties. An engineer pastes part of the client’s site plan into a personal chatbot account to draft a summary.
Nothing goes wrong immediately. Months later, the client asks how the firm handles project data, and the firm cannot say which tools staff have used. The firm adopts a one-page policy with an approved business account and a list of information that stays out. It also reminds staff to check each contract’s confidentiality terms before using any tool.
What to check in your firm
Firms may want to review:
- Which AI tools staff already use, including personal accounts.
- Whether client contracts or NDAs restrict where project data can go.
- Whether the firm has approved business accounts with data controls turned on.
- Whether a written policy lists what staff must never enter.
- Whether the firm could answer an application question about its AI use policy.
Why AI use may show up on insurance applications
Some cyber applications may begin asking whether a firm has an AI use policy. Some carriers are also reportedly drafting exclusions for incidents tied to unapproved or poorly governed AI tools, according to a Cloud Security Alliance research note. These exclusions are emerging, not universal, and wording differs by carrier.
Answer application questions accurately. The cyber application shows the kinds of questions firms are typically asked, and a written policy makes honest answers easier.
Hardcover insight
Firms often wait to write an AI policy until something goes wrong. A simple document written now takes less time than explaining a gap to a client or an underwriter later. It also gives staff clear permission to use approved tools, which tends to reduce the quiet use of personal accounts.
Related questions
What is shadow AI?
It is the use of AI tools that a firm has not approved, usually without rules about what information can be entered. Staff often do it to save time, without realizing the risk.
Is using AI at an architecture or engineering firm a problem?
Not by itself. The concern is unapproved use with no limits on what goes in. Approved tools and a short policy can address most of that.
What should an AI policy for a small firm include?
Approved tools, a list of information that never goes in, firm-managed accounts, human review of output and a person to ask about new tools.
Can client contracts restrict AI use?
Some contracts and NDAs limit where project data can go or require consent before sharing it. Review the confidentiality language in each agreement.
Will an insurance application ask about AI use?
It may. Some applications are beginning to ask whether a firm has an AI use policy. Answer accurately and review the policy wording.