What the Browser Knows: Mapping the AI Tools Your Team Never Declared
Photo: Ben P L from Provo, USA, CC BY-SA 2.0, via Wikimedia Commons
Most UK operations managers, asked how many AI tools their teams use, will give a tidy answer: one, perhaps two, both procured through IT and both documented. Ask the same question of the corporate card statement and of outbound web traffic and the answer usually grows. A free summariser installed as a browser extension, a transcription service on a personal handset, a chatbot opened in a spare tab to redraft a clause — none of these generate an invoice worth noticing, and all of them accept a paste.
That is the shape of shadow AI in 2026. It is not a story about reckless employees. It is a story about tools that behave like a utility: free at the point of use, instant, and requiring no ticket. Governance has not moved at the same speed, and the space between the two is where a register earns its keep.
Why a register beats a ban
A blanket prohibition looks decisive and functions badly. It pushes usage somewhere less visible, removes any chance of a support conversation, and leaves the organisation unable to answer a basic question from its board or its insurer: what data leaves the building, and where does it go?
A register does something more modest and considerably more useful. It converts an unknown into a list with names, owners and limits attached. Under the accountability principle of the UK GDPR, that list is also evidence — the sort of evidence the Information Commissioner's Office expects an SME to produce when a customer asks how their notes were handled.
Discovery: four sources that find most of it
You will not find shadow AI by asking managers to recall it. Use systems that already record what happened.
Identity provider logs. Third-party application consents in Microsoft 365 or Google Workspace are the richest single source. Every tool that asked a user to sign in with a work account left a record, a scope request and a date. Review consents quarterly rather than annually; a tool authorised in March may still be reading mail in November.
Web proxy or DNS logs. Most firms of any size already filter outbound traffic. Search the logs for a curated list of AI service domains, then examine volume by department rather than by individual. The purpose is to find categories of activity, not to build a case against a named person.
Card and expense data. Conversational AI subscriptions have a signature: small, monthly, recurring, often on a personal card reclaimed through expenses. A finance query on anything between eight and thirty pounds a month will surface more than an IT audit will.
A two-week disclosure window. Offer staff a period in which declaring a tool carries no consequence, and keep names out of the register itself. Usage numbers rise sharply when disclosure is not treated as a confession. Tell staff what is being monitored and why, consult before you monitor, and keep collection proportionate to the risk being managed.
Classify the data, not the tool
Tool names age quickly; data categories do not. Set four tiers and let the tier decide which tools are permissible.
| Tier | Typical content | Default position |
|---|---|---|
| 1 Public | Marketing copy, published material | Any tool, no approval |
| 2 Internal | Meeting notes, internal drafts | Approved tools only |
| 3 Confidential | Contracts, customer notes, pricing, staff data | Approved tools with data protection terms in place |
| 4 Regulated | Special category data, payroll, client money, privileged material | Named tools only, or not at all |
The register's job is to record, for each tool, the highest tier it may touch and the owner who agreed it. A tool that cannot meet tier 3 should not be quietly tolerated at tier 3 because one team finds it convenient.
Write rules people will read
Publish a one-page acceptable-use note with three lists: what is fine without asking, what needs a check first, and what must never be entered into an external AI service. Be concrete. Contracts under negotiation, customer contact notes, bank details and anything about a named employee belong on the third list. Marketing copy and public research belong on the first. The middle list is where the approval route lives.
Avoid the language of prohibition where a limit will do. Staff comply with rules they can apply to a real decision at four o'clock on a Friday.
A 48-hour approval lane
Approval that takes three weeks will be bypassed within a fortnight. Publish a short form — tool, purpose, data tier, vendor — and commit to a decision within two working days. Low-tier requests should default to yes. Higher-tier requests should trigger a data protection check: retention periods, whether customer data is used for training, subprocessor arrangements, and where processing sits. Record the outcome in the register, including refusals; a documented no, with a reason, prevents the same request returning in three months.
Keep the register alive
An unmaintained register is worse than none, because it implies coverage that does not exist. Give it a named owner, a review date and a line in the joiner and leaver process. Refresh the whole list each quarter and take a one-page summary to the board once a year: tools found, tools retired, requests approved, incidents nil. That summary is also the document that answers awkward questions from customers, auditors and insurers without a scramble.
The tone question
The register works only if discovery is separated from discipline. Be explicit that a first disclosure will not lead to action against the person who disclosed, and equally explicit that concealment after the rules are published is a conduct matter. That combination gives an organisation both accurate data and a defensible position.
Shadow AI is not a failure of loyalty. It is a gap between how quickly tools arrive and how slowly approval routes move. Close the second gap and the first shrinks with it.
