You won't stop it by blocking alone. Give people a governed AI assistant that is better than the public one, connected to your own data and deployed where you decide; publish a clear policy on what data may go where; and log every use. Then measure shadow AI over time instead of pretending it isn't there.
- 69% of organisations suspect or have evidence that staff use prohibited public generative AI.Gartner survey of 302 cybersecurity leaders, 2025 (via dope.security)
- Organisations with high shadow AI paid about US$670,000 more per data breach.IBM Cost of a Data Breach Report 2025 (via Acronis)
- 36% of Australian employees have entered confidential data into AI tools that may lack oversight.IT Brief Australia, One in three Australians upload sensitive data to AI tools (Sept 2025)
- About one in three Australian workers use AI without their employer's knowledge.HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research)
Why it happens
People use public chatbots because they work and nothing better is on offer. Gartner found 69% of organisations suspect or have evidence of prohibited GenAI use. In Australia, about one in three workers use AI without telling their employer.
Why blocking fails
Blocks push use onto personal phones and accounts, where you have no visibility at all. The risk doesn't go away; it just leaves your logs.
A plan that works
First, a sanctioned assistant on a governed platform, connected to the documents and systems people need. Second, a one-page policy: which data classes may be used with which tools. Third, logging and an AI register so you know what's in use. Fourth, a quarterly review. This is the shadow AI programme inside our AI Governance service.
The cost of doing nothing
IBM's 2025 Cost of a Data Breach research found organisations with high levels of shadow AI paid about US$670,000 more per breach. In Australia, unmanaged AI also makes the Privacy Act's new automated decision-making disclosures harder to get right.
Questions people also ask
Is a policy enough?
What does a governed assistant look like?
Can BLDR replace public chatbots for staff?
One governed layer across every system you own.
Deploy where you decide, connect to SAP and your local systems, and make every agent action approved and logged. See how the pieces fit.
- Gartner survey of 302 cybersecurity leaders, 2025 (via dope.security)
- IBM Cost of a Data Breach Report 2025 (via Acronis)
- IT Brief Australia, One in three Australians upload sensitive data to AI tools (Sept 2025)
- HRD Australia, Australian workers still hiding AI use from employers (Employment Hero research)