The fitters coordinate their jobs in a WhatsApp group. Sales keep a spreadsheet of all open quotes that only one colleague maintains. Purchasing has set up a Trello board, and a clerk has customer enquiries drafted by his personal ChatGPT account. None of it appears in the IT documentation, and none of it was approved by anyone.

This is called shadow IT, and since AI tools became available to everyone, shadow AI has joined it. The first reflex is often to ban it all. This article suggests a different view: shadow IT shows where staff lack a tool. It is a signal, not an offence.

What shadow IT looks like in a business

  • Messenger groups for jobs, shift plans or photos from site, usually WhatsApp.
  • Private spreadsheets mapping a workflow the ERP does not know: complaints, tool lending, holiday planning, quote tracking.
  • Personal accounts with ChatGPT, Claude or Copilot that staff use to draft emails, translate texts or summarise minutes, often with customer data in the text.
  • Task tools such as Trello, Notion or Asana that a team has set up for itself.
  • Self-built applications, in Access, Power Apps or by now with AI tools such as Lovable, that keep a whole department running.
  • Cloud storage such as Dropbox or a private Google account, because otherwise the customer would not get the drawing.

Why shadow IT arises

Nobody sets up a WhatsApp group to annoy IT. They do it because the job has to go out today and the official tool for it is missing, too slow or does not work on a phone. The spreadsheet arises because the ERP does not know the workflow and an extension was never commissioned. The ChatGPT account arises because the business has not offered one of its own.

Put differently: shadow IT is a supply problem on the employer’s side. Staff are solving a problem the business has left them with. That is an achievement, not negligence. Punish it and you do not get better IT, just better hidden IT.

What is a problem nonetheless

The different view does not mean everything is fine. Shadow IT has consequences the business should know about:

  • Knowledge hangs on individuals. If the colleague with the spreadsheet leaves, the spreadsheet leaves with her. The Trello board belongs to whoever created it.
  • Data sits in many places. The order is in the ERP, the arrangement about it in WhatsApp, the delivery note as a photo on a private phone.
  • Customer data leaves the building. Whatever is typed into a personal AI account sits with a provider the business has no contract with. That needs checking, together with your data protection officer, without it turning into an accusation against staff.
  • Self-built tools have gaps. An application from a building kit often has no permission check, no backup and no test environment. Which gaps those typically are is described in Built it yourself with AI.

Making it visible: ask, do not ban

You only learn about shadow IT if staff are not afraid to talk about it. So a ban does not help, but a question does: “Which tools do you use that did not come from us, and why?” Best asked in the department, not by all-staff email. Whoever listens gets a list, and a reason for every entry.

Those reasons are the valuable part. “Because the ERP does not run on the phone” is a requirement. “Because otherwise I lose track of the quotes” is one too. Ask once in this way and you know more about your workflows than any questionnaire would tell you.

What you learn from it

Every tool in the shadows points to a workflow the official software does not cover. The spreadsheet shows which fields the workflow needs, because the colleague created exactly the columns she really uses. The WhatsApp group shows which information the fitter needs on the road and when. The ChatGPT account shows which texts are written again and again in the business. These are finished requirements, phrased by the people who do the work.

Adopting the good parts

  • Offer an official alternative. For the personal ChatGPT account, an account the business is responsible for, with clear rules on what may go in. For the WhatsApp group, job capture on the phone that writes into the order system.
  • Take the spreadsheet seriously. If a list keeps a department running, it is a prototype. How to tell it is reaching its limit is described in When Excel is no longer enough.
  • Retrofit self-built tools rather than throwing them away. An application that staff have adopted is worth a lot. What it lacks for use with real data is shown by the production readiness check in twelve questions.
  • Write down the rules afterwards. Not as a list of bans, but as an answer: this is our tool for jobs on the road, this one for texts, this one for tasks.

How to proceed

  1. Ask every department about the tools that did not come from you, and about the reasons.
  2. Sort the list: which is a gap in the software, which a missing access and which a habit?
  3. Clarify with your data protection officer where customer data sits today.
  4. Close the biggest gap first, with an alternative at least as convenient as the shadow.
  5. Repeat the question regularly. New shadows point to new gaps.

A business without shadow IT does not have the strictest rules but the best-fitting tools.