Executive summary
Shadow IT and shadow AI start with the same instinct: a staff member finds a tool that helps with their work. This piece looks at how AI tools can reach a firm by a different route, what that means when staff build their own apps with AI, and four steps for bringing those tools into the open.
Many firms handle shadow IT with an approved list of programs, an approval process for new software and an IT provider looking after the systems.
People reach for AI tools for the same reason they reach for any new software: it helps them do their work. Take Tom in a property team. The practice management system at his firm has a quirk the whole office has been muttering about for three years. Say Tom uses an AI app builder to make a small fix, and the rest of his team starts using it. Tools like that one can reach a firm through a browser tab.
1Shadow IT and shadow AI
Other AI tools can arrive the same way: a free site that summarises a long set of file notes, or a browser extension that sits over a program the firm already pays for. Some come as an AI feature a vendor switches on in an update to existing software.
Browser-based tools and personal accounts can sit outside controls designed around approved software and managed devices. These tools can be free, and people can sign up with a personal email address, so they can stay off the firm's invoices as well.
Some users of AI are now good enough to build IT apps with it, and these people may just be in your firm. AI app builders can let people create simple software without traditional coding experience. Tom's fix would then be software running inside the firm, and it may work with client matters.
2The decisions behind it
Who checks how Tom's app handles any client information it touches? Who fixes it when the practice management system updates? What happens to it when Tom moves on?
Similar questions apply to other AI tools in a firm: which work it is used for, what client information goes into it, and who checks what comes out. Clio's 2026 Legal Insights Report found 98% of Australian legal professionals use AI.
Across industries, Gartner estimated that 41% of employees acquired, modified or created technology outside their IT team's visibility in 2022, and it predicts that figure will reach 75% by 2027.
These are questions about how your firm works, so we would put them with your leadership team. Your IT provider can then set up the systems to match what you decide.
AI Uplift Program
See what is already running
The investigation finds out which AI tools are in use across your firm, anything your people have built, and how long your everyday work takes today. You keep the findings either way.
3A front door for AI
Your IT provider could set up the systems to lock it all down: block the sites, switch off the features, and enforce a rule against personal AI accounts.
Restricting the use won't give you the answers you need. But simply asking the questions will.
Four steps for asking
These are the four steps we would start with.
Name one person or role to own AI in the firm, so staff know who to tell when they find a new tool or build one.
Ask your people what they use and what they have built, and talk about the work each tool does. An AI audit can start with a simple check-in.
Agree a short list of approved tools, with a line for each on what client information can go into it.
Give anything staff build a second look before it touches client data, and put a name against keeping it running. Your IT provider can help with the review.
When this is working, a staff member who finds a useful AI tool knows who to mention it to, and people know what can go into each approved tool. If Tom's app is useful, the firm can review it, decide whether it belongs on a firm account and name a person responsible for maintaining it. If it solves a problem elsewhere, other teams can then consider using it, so the whole firm gets the benefit. If a client asks how AI is used on their matter, the firm can point to what it has agreed.
A restriction
- Blocks the sites it can reach
- Existing tools may remain outside the firm's view
- Each person may decide what goes into a tool
- Staff-built tools may have no named maintainer
A front door
- One named person hears about new tools
- A short approved list, with what can go into each
- Tools like Tom's get a review and a maintainer
- Leadership decides, and the IT provider sets it up
4Where we come in
Getting there starts with finding out what is already running, including tools like Tom's. Our investigation maps the AI tools in use across your firm, including any your people have built.
It includes a session with your IT provider and produces a draft AI use policy for your partners to finalise. It also measures how long your firm's everyday work takes today, so you have a baseline of your own. The findings belong to your firm whether or not we go any further together.
If you would like to talk it through, reach out to our team. The first conversation works out whether your firm is the right fit for the AI Uplift Program, and whether we are the right people to help.
A front door for AI
Frequently asked questions
What is the difference between shadow IT and shadow AI?
Shadow IT covers software staff bring in outside the firm's approval process. Shadow AI covers AI tools or features staff use outside the firm's approved processes. They may be browser-based, embedded in existing software, accessed through personal accounts or built by staff themselves.
Can our IT provider block shadow AI?
An IT provider can block particular sites and switch off some features. Once the firm has agreed its approved tools and what can go into each one, the IT provider can set up the systems to match.
Is it a problem when staff build their own tools with AI?
It can solve a problem the person who built it knows well. We would have a second person review it before it touches client data, and name a person to keep it running.
Who should make decisions about AI tools?
We would put them with the firm's leadership, with the IT provider advising on what the systems allow.
Where should a firm start?
By asking people what they use and what they have built. That list can show which tools to approve, which to replace with something the firm already has, and which staff-built tools need a review.
About the author
Julia leads the investigation and is the author of the report presented to your leadership. Her background is in research, data analysis and business strategy.
Primary sources
Clio, 2026 Legal Insights Report, Australia, 533 legal professionals and 500 members of the public, updated 7 April 2026clio.comGartner, Gartner Unveils Top Eight Cybersecurity Predictions for 2023-2024, 28 March 2023gartner.comThis article is general information about how firms organise their use of AI. It is not legal advice, and any policy drawn from it should be finalised by your firm.