Start with a task your team does every day

Imagine a bookkeeper at an accounting firm preparing a month-end update for a client. She uploads a financial statement to an AI chatbot and asks it to draft a plain-language summary. She checks the figures, edits the wording, and finishes the email.

She’s found a useful way to get through her workload. But the firm hasn’t reviewed the tool or told her what she can share. The tools showed up before the rules did.

For the business owner, that leaves questions: 

• Did the statement include client names or account details? 
• Was she using a personal account or a business-approved service? 
• What happens to the information after it’s submitted?

This hypothetical example illustrates how easily AI can become part of everyday work before a business has considered those questions. Unapproved or unmanaged AI use is often called “shadow AI.”

As we explored in Shadow IT in SMBs, employees often adopt tools to solve a practical problem. Understanding that work is a useful starting point for deciding what to support, what to change, and where to investigate further.

What can your team tell you?

Start by asking employees to walk you through how they use AI. A recent example will tell you more than a general question about whether they use it.

You might open with: “We want to understand which AI tools are helping you work so we can give everyone clearer guidance. Can you walk us through a recent task?”

Then ask:

• Which tool did you use, and what did it help you do?
• What info did you enter, upload, or connect?
• Did you use a personal account or a company account?
• Is this a regular part of your work?

In the bookkeeper’s case, those questions uncover a specific workflow: the client’s financial information is used to draft an email. Next, have your IT contact review whether the tool, account, and data handling are appropriate for that work.

Keep the conversation constructive. If people expect every disclosure to result in losing a useful tool, they may be reluctant to explain how they use it. Understanding what they need also helps you find a suitable alternative if a particular use needs to stop.

You can begin this with your existing IT team or provider. If you need help bringing employee feedback and technical findings together, Third Octet’s Shadow AI Discovery combines an anonymous employee survey, a review of sign-in (and traffic logs where available), and a risk-rated report with recommended actions.

What should IT look at more closely?

Employees can explain the task they were trying to complete. They may need help understanding the access they granted or how a service handles company information.

For example, someone might remember connecting an AI meeting assistant without knowing which permissions they accepted. Your IT contact can help determine what needs checking, including whether the tool has access beyond what the employee intended.

For the accounting firm, the review would need to address the account used, the information submitted, and the service’s data-handling settings and terms. Those details help establish whether the workflow is suitable for client information.

Technical records can contribute to that investigation, but they have limits. A record showing that someone accessed an AI service doesn’t necessarily reveal what they submitted. Some questions may require employee input, a settings review, or further investigation.

A useful assessment should make those distinctions clear: what the evidence shows, what remains uncertain, and what needs follow-up.

The technical review can also catch what a survey alone might miss – for example, a record showing someone signed into an AI tool with a work account, even if they didn’t think to mention it.

What will you know afterward?

You should come away better equipped to decide which uses can continue, which need changes, and which findings need prompt attention.

For the accounting firm, that means getting closer to a practical answer: can the bookkeeper keep using this workflow, and under what conditions? The response might involve an approved account, different rules for the information she submits, or a different way to complete the task. That decision depends on the findings.

Third Octet’s assessment provides a risk-rated report with recommended governance actions. For you as an owner, the value is being able to set priorities and give the people handling your IT a clear basis for follow-up.

The questions you’ll want answered include:

• Which AI tools and uses were identified?
• What company information or access is involved, and what could be confirmed?
• Which findings deserve attention first?
• What should happen next?

How much time and access will it take?

Before you arrange discovery, you’ll want a clear picture of the work involved. That includes your employees’ time, the support needed from your IT contact, and the access required for the review.

The process asks for about 15 minutes of your time to launch the survey, roughly an hour of your IT contact’s time for the technical review, and 60 minutes with you at the end to walk through the finalized report. No software or monitoring agents are installed – the review works with access and records you already have. The Discovery itself is free.

Get a clearer picture of AI use in your business

You don’t need a finished AI policy to start asking useful questions. Begin with a task your team already does, understand how AI helps, and involve your IT contact where company information or access needs review.

Before you decide whether your business needs new AI rules, find out what your team is already using and where company information is involved.

Third Octet’s Shadow AI Discovery brings employee input and technical findings together to help you decide what needs attention.

See what Shadow AI Discovery includes

When you enquire, the first step is a short intro call to walk through how the process works, what information is collected, and what the final report includes – no technical preparation needed on your end.