The Shadow-AI Rulebook: 6 in 10 Businesses Have Employees Using AI at Work — Only 36% Have Written the Rules
On September 15, the insurer Nationwide published a survey of small and mid-market business owners, and its headline finding is a bookkeeping problem no spreadsheet captures: six in 10 owners say their employees already use public AI chatbots or writing tools for work — while only 36% have a written policy governing that use, and just 37% train anyone to use AI responsibly. Your business almost certainly has shadow AI in it right now. The fix isn't banning it — it's a one-page rulebook. Here's what the data says and how to write yours this week.
The insurer Nationwide published a survey of small and mid-market business owners on September 15, 2026. Its headline finding describes a gap most owners can feel but few have measured: businesses are adopting AI far faster than they are managing it. Six in 10 owners say employees use public AI chatbots or writing tools for work — while only 36% have written rules for that use. The unapproved layer this creates has a name in the security world: shadow AI.
Shadow AI isn't an attack — it's an email your assistant drafted with a chatbot over lunch, a quote summary pasted into a free tool, a job post written by whatever model was open in a browser tab. The question isn't whether your company has shadow AI. It's whether it has rules for it.
What the Survey Found
Nationwide's numbers sketch the gap in four statistics. Adoption has already happened: 60% of owners say employees use public AI tools for work-related tasks. Governance hasn't: 36% have written policies governing employee AI use, and 37% provide training on responsible use. And the exposure isn't theoretical: 31% say their company was targeted by a generative-AI scam or fraud attempt in the past 12 months. Another 82% admit they need more information to protect against AI-enabled attacks — an honest place to start.
60%
Employees Already Use Public AI Tools for Work
36%
Have a Written AI-Use Policy
37%
Train Staff on Responsible Use
31%
Targeted by a Generative-AI Scam This Year
Why Banning Shadow AI Backfires
Employees don't sneak AI into work to be reckless; they do it because it works. PagerDuty's 2026 Shadow AI Survey found 66% of office professionals have used AI tools at work despite believing they weren't permitted — and 91% of them say the sanctioned alternative didn't meet their needs. Cyberhaven's research puts it concretely: 43% of workers have pasted confidential data into AI tools.
A blanket ban doesn't solve this — it just removes your visibility into it. The browser tab stays open; the behavior goes underground. What works in practice is the opposite of prohibition: give people approved tools they actually like, and write down the one line they can't cross. That turns shadow AI from a liability into a managed asset.
What's Actually at Risk
Three exposures. First, data leakage: customer lists, quotes and contract language pasted into public models — data you can't recall once it leaves. Second, unchecked output: AI drafts confidently, including when it's wrong, and errors reach customers when nobody reviews the draft. Third, outside attacks: the 31% of Nationwide owners targeted by generative-AI scams — cloned voices, urgent fake invoices — the threat landscape we covered in our piece on AI supercharging cyber attacks. And when something goes wrong, only about a third of businesses have an up-to-date incident response plan to open.
The One-Page Shadow-AI Policy
The good news: the rulebook that closes the gap fits on one page. Nationwide's cyber team put it plainly — know which tools employees are using, set clear expectations on what can be shared, and decide how AI-generated work gets reviewed. Five rules do exactly that.
- 1 Name the approved tools. Write the green list of sanctioned tools and tasks. The easiest wins are features built into software you trust — accounting and marketing platforms increasingly ship with agents built in, like the agents Intuit embedded inside QuickBooks and Mailchimp. If a sanctioned tool covers the job, the shadow tool has no reason to exist.
- 2 Draw the data line. Spell out what never goes into a public AI tool: customer names, payment and payroll data, contracts, passwords — anything you'd hate to see quoted back. The 43% who pasted confidential data had no rule to break — give them one sentence to remember, not a thirty-page policy nobody reads.
- 3 Keep a human check. Require review before AI output reaches a customer, a lawyer, or the wire-transfer department. This is the human-in-the-loop pattern — AI drafts, a person approves — the same gate serious agent deployments use, scaled down to a sticky note on a monitor.
- 4 Train for 30 minutes. Only 37% of businesses train anyone on responsible AI use. One half-hour session covers the data line, the review rule and what a generative-AI scam looks like: a cloned voice of “the boss,” an urgent invoice, a payment change nobody requested. Repeat quarterly; scams iterate faster than policy.
- 5 Rehearse the response. Only about a third of businesses have an up-to-date incident response plan. Answer three questions in advance: who calls whom within the first hour of a suspected AI incident, how access gets revoked, and when your insurance professional gets involved. Nationwide's advice to talk with your insurance professional about changing risks is worth taking literally.
The Quiet Advantage of Written Rules
A policy reads like a restriction but functions as permission. With rules in place, your team can use AI openly on sanctioned tools — so you finally see where the hours are going. That's the compounding edge behind the AI literacy divide: trained teams pull further ahead every quarter while untrained teams stay stuck at copy-paste.
And when you graduate from chatbots to autonomous agents — software that acts, not just answers — the same rules grow up with you. Approval gates, scoped permissions, audit trails and a rehearsed off switch — exactly the guardrails we broke down in the industry's guardrail moment. Write the policy now, and agent governance becomes an update, not a rebuild: policy first, autonomy second.
At GoHuman AI, the rulebook is built into the product: agents handle the watch-and-draft work — inbox, scheduling, follow-ups, reporting — and a human approves anything that spends money or speaks in your name. Governed agents replace shadow tools, so the policy your team follows is the software they use. If you'd rather have AI governed by design than audited after the fact, book a free automation audit and we'll map your workflows — shadow ones included.
Related Reading
The 83% Warning: AI Is Supercharging Cyber Attacks on Small Businesses
The outside half of the shadow-AI problem — and the 5-step defense checklist.
The Guardrail Moment: 5 Guardrails Every Small Business Should Install This Week
When chatbot rules grow up into agent rules — approval gates and audit trails.
The AI Literacy Divide: 89% of Small Businesses Use AI, But Only 23% Are Trained to Use It
Why trained teams turn the same tools into a compounding advantage.
A one-page policy takes an hour to write and closes the gap between how your team works and how you think it works. Book a free automation audit and we'll map your workflows — including the shadow ones — and show where governed agents fit.