Shadow AI is the use of AI tools at work without your organisation’s approval or oversight. It might be a staff member using a chatbot to tidy up notes, or connecting an AI assistant to their email. They’re trying to make the work easier, but you may not know which tools they’re using or what information they’re sharing.
For NDIS providers, the concern is what happens to participant information and whether anyone checks the output before it becomes part of a record. Finding out how your team already uses AI gives you a starting point for deciding what’s useful, what needs safeguards and what needs to stop.
Why this is different for NDIS providers
The information your staff handle every day isn’t generic business data. It’s participant files, behaviour support plans, incident reports, funding and support coordination detail, some of the most sensitive personal and health information there is. When that information ends up inside a consumer AI tool, even accidentally, even with good intentions, you’ve lost visibility over where it went, who processed it, and how long it’s retained. You can’t produce an accurate answer to “what happened to this participant’s information” if you don’t know it was ever there.
The OAIC recommends keeping personal information, especially sensitive information, out of publicly available generative AI tools. Its guidance on privacy and AI products is a useful starting point when reviewing the tools your team uses.
Progress notes are a useful place to start the conversation. Our guide to using ChatGPT for NDIS progress notes explains the privacy considerations and checks staff should make before saving a draft.
And it’s rarely one dramatic incident. It’s usually smaller than that: a support worker pasting a rough case note into a chatbot to tidy the language, a team lead using an AI assistant to summarise an incident report, someone connecting an AI tool to their email to save time on scheduling. Each one feels harmless in the moment. None of them get raised, because nobody’s asked whether they should be.
The signs shadow AI is already happening
You don’t need a formal audit to start noticing. A few honest questions usually surface it fast:
-
Which AI tools are staff actually using day to day?
-
Do staff know which tools are approved and what your AI policy allows?
-
Has anyone connected an AI tool to email, calendars or other work systems?
-
Have participant files, reports or plans been entered into an AI tool?
-
If someone started using a new AI tool tomorrow, how would you find out?
For most providers, the honest answer to at least one of these is “not sure.” That’s not a failure. It’s just what happens when a fast-moving technology arrives faster than a written policy can keep up with it.
Why banning it outright doesn’t work
The instinct, understandably, is to shut it down: block the tools, write a policy that says no, move on. In practice, that rarely works and often makes things worse. Staff under pressure to get documentation done will find a way around a rule that doesn’t account for their actual workload, and now the AI use that was happening in the open becomes AI use nobody talks about at all, which is a harder problem to manage than the one you started with.
The better approach is bringing shadow AI into the light rather than pretending it isn’t there: understanding where AI is already being used, deciding deliberately what’s safe and what isn’t, and building a framework your team will actually follow because it reflects how they really work, not a generic template that assumes a level of process nobody has time for.
What good governance actually looks like, once you can see it
Once you know how your team is using AI, you can put practical rules around it:
-
Keep an approved-tools list. Record which AI tools staff can use, for which tasks and under what conditions.
-
Make new tools easy to request. Give staff someone to ask before trying an unapproved AI tool.
-
Be clear about information. Explain what staff can enter into each tool, especially when participant records or sensitive information are involved.
-
Set review responsibilities. Make sure staff know who checks AI-generated work before it is saved, shared or used.
-
Keep the picture current. Assign someone to review the tools, their settings and how staff use them as things change.
Getting these checks in place takes some work upfront. Once staff know which tools they can use, what information they can enter and who to ask for help, they spend less time guessing what’s allowed.
Once you’ve agreed on those basics, you can choose a useful workflow to try. Our guide to adopting AI while staying audit-ready explains how to approach that next step.
Where to start
Shadow AI isn’t a mystery to solve after the fact. It’s the clearest signal you already have of where governance is thin, and it’s far easier to work with once you can actually see it. The fastest way to find out where your organisation stands is a short, honest look at what’s already happening, not a guess.
Take the Shadow AI Quick Check: 10 questions, about two minutes, instant results. No sales pitch, just a clear picture of where you stand right now.