Someone on your team is probably already using AI. Not because anyone approved it, and not because anything’s gone wrong yet, but because AI tools are free, fast, and everywhere, and most people reach for whatever helps them get through their day. That’s shadow AI: AI use inside your organisation that hasn’t gone through any approval process, isn’t written down anywhere, and isn’t something you’d necessarily know about unless you asked.
For most industries, shadow AI is an IT headache. For an NDIS provider, it’s something more specific: a compliance risk sitting quietly inside your organisation, waiting to surface at the worst possible time, an audit, an incident review, a Commission enquiry.
Why this is different for NDIS providers
The information your staff handle every day isn’t generic business data. It’s participant files, behaviour support plans, incident reports, funding and support coordination detail, some of the most sensitive personal and health information there is. When that information ends up inside a consumer AI tool, even accidentally, even with good intentions, you’ve lost visibility over where it went, who processed it, and how long it’s retained. You can’t produce an accurate answer to “what happened to this participant’s information” if you don’t know it was ever there.
And it’s rarely one dramatic incident. It’s usually smaller than that: a support worker pasting a rough case note into a chatbot to tidy the language, a team lead using an AI assistant to summarise an incident report, someone connecting an AI tool to their email to save time on scheduling. Each one feels harmless in the moment. None of them get raised, because nobody’s asked whether they should be.
The signs shadow AI is already happening
You don’t need a formal audit to start noticing. A few honest questions usually surface it fast:
Do you know, with confidence, which AI tools your staff are actually using day to day, not which ones you’ve approved, but which ones are actually in use? Is there a written AI policy, and if there is, would your frontline staff actually recognise it? Has anyone connected an AI tool directly to email, calendars, or other systems, the kind of “agent” access that keeps working quietly in the background? Have participant files, reports, or plans ever been uploaded into an AI tool, even just to save time? And if a new AI tool started getting used tomorrow, would you know?
For most providers, the honest answer to at least one of these is “not sure.” That’s not a failure. It’s just what happens when a fast-moving technology arrives faster than a written policy can keep up with it.
Why banning it outright doesn’t work
The instinct, understandably, is to shut it down: block the tools, write a policy that says no, move on. In practice, that rarely works and often makes things worse. Staff under pressure to get documentation done will find a way around a rule that doesn’t account for their actual workload, and now the AI use that was happening in the open becomes AI use nobody talks about at all, which is a harder problem to manage than the one you started with.
The better approach is bringing shadow AI into the light rather than pretending it isn’t there: understanding where AI is already being used, deciding deliberately what’s safe and what isn’t, and building a framework your team will actually follow because it reflects how they really work, not a generic template that assumes a level of process nobody has time for.
What good governance actually looks like, once you can see it
Once shadow AI is visible instead of hidden, the work is more straightforward than most providers expect. It doesn’t mean writing a document nobody reads and filing it away. It means deciding, deliberately, which tools are approved and why, building a simple process for staff to request a new one rather than just starting to use it, and making sure someone is actually accountable for keeping that picture current as tools change. It means being clear with your team about what can and can’t go into an AI tool, in plain language, not legal phrasing borrowed from somewhere else. And it means treating this as something you check on periodically, not a box ticked once and forgotten, because the tools your team reaches for in six months won’t be exactly the ones they’re using today.
None of that requires slowing down. If anything, a team that knows what’s approved and why moves faster than one that’s quietly guessing whether what they’re doing is allowed.
A common misread worth heading off
None of this is an argument against AI. Providers sometimes hear “shadow AI risk” and assume the safe response is to ban AI tools outright. It isn’t. Staff will keep reaching for whatever helps them get through a heavy workload, whether or not there’s a policy, and a ban just moves that reaching out of sight. The actual goal is visibility and a deliberate decision, not prohibition. Most providers who go through this process end up approving more AI use than they started with, just with a clear picture of what’s happening and why, instead of a guess.
Where to start
Shadow AI isn’t a mystery to solve after the fact. It’s the clearest signal you already have of where governance is thin, and it’s far easier to work with once you can actually see it. The fastest way to find out where your organisation stands is a short, honest look at what’s already happening, not a guess.
Take the Shadow AI Quick Check: 10 questions, about two minutes, instant results. No sales pitch, just a clear picture of where you stand right now.