AI Governance / Cybersecurity
An accounting associate at a 22-person CPA firm pastes a client's tax return into ChatGPT to draft a summary — no malicious intent, no IT ticket, and no awareness that the data may be retained and used to train future model responses. By the time the firm's managing partner finds out, the question isn't whether a policy was needed; it's why no one had defined what "approved AI" even meant.
If that scenario sounds familiar, this post gives you the practical test to catch it before it happens — and what a workable policy actually looks like at your size.
What "Shadow AI" Actually Means for a Small Business
Shadow AI is the use of AI-powered tools by employees without IT or management review or approval. Shadow IT refers to any unauthorized software broadly; shadow AI is a specific, higher-risk subset because AI tools actively process, store, and may train on the business data employees paste into them.
Why Shadow AI Is a Different Problem Than Shadow IT
Shadow IT — an employee using an unapproved project management app, for example — creates a data-siloing problem. Shadow AI creates a data-exposure problem. When an employee feeds client information into ChatGPT, Microsoft Copilot, Grammarly Business, Gemini, or Perplexity on a personal free-tier account, that data leaves the business's control entirely, with retention and training terms the business never reviewed.
This Is the Foundation of AI Governance
Distinguishing sanctioned AI tools — those reviewed, approved, and configured for business use — from shadow AI is one part of a broader framework for safe, productive AI adoption in Orlando. Tech Rage IT's AI governance services cover this alongside tool vetting, policy creation, and ongoing enforcement — the full framework behind managing AI risk at the SMB scale.
The Four Signals That a Tool Is Shadow AI — Not a Sanctioned One
A sanctioned AI tool has passed four checks: it appears on a written approved-tools list, IT or management has reviewed its data-retention and training practices, employees access it through a company-managed account with data controls, and employees know which data types are off-limits to paste into it.
The Four-Signal Test
Apply these four questions to any AI tool an employee is currently using. If the answer to any one of them is "no" or "I don't know," the tool is functioning as shadow AI — regardless of how reputable or widely used it is.
- Is the tool on a written approved-tools list? An approved-tools list is a short, maintained document naming each AI tool the business has reviewed and permitted. If the tool isn't on it, it isn't sanctioned — by definition, not by oversight.
- Did IT or management review how it stores and trains on inputs? Most consumer-tier AI tools reserve the right to use submitted content to improve their models. Reviewing a tool means reading its enterprise data-use terms and confirming that business data submitted through a paid or enterprise account is excluded from training.
- Is the account a company-managed login with data-retention controls — not a personal free-tier account? A personal ChatGPT free account has different data terms than a ChatGPT Team or Enterprise account configured by IT. The account type, not the tool name, determines whether data controls exist.
- Does the employee know what data is off-limits to paste into it? Even a fully sanctioned tool becomes a liability when an employee pastes client PII, financial records, or proprietary project data into it without guidance. An acceptable-use rule defines this boundary explicitly.
How the CPA Scenario Fails Every Signal
Return to the opening scenario: an associate pastes a client's tax return into ChatGPT. Signal one fails — no approved-tools list existed. Signal two fails — no one reviewed ChatGPT's data-retention terms for that account tier. Signal three fails — the associate used a personal free-tier account. Signal four fails — no one had told the associate that client tax data was off-limits. The four-signal test catches all four failure points before the paste happens.
Why the Risk Is Amplified for Orlando SMBs in Regulated Industries
CPA firms, financial services companies, construction firms, and engineering practices face the same regulatory requirements as large enterprises but lack the legal and IT infrastructure to absorb the consequences of a data exposure. Shadow AI creates specific, named compliance exposure in each of these verticals.
CPA Firms and Tax Practices
CPA firms handle IRS-regulated taxpayer data and client PII governed by IRS Publication 4600 and the Gramm-Leach-Bliley Act's Safeguards Rule, which requires reasonable safeguards for client financial information. Pasting a tax return into an unreviewed AI tool is the kind of control failure regulators look at when assessing whether a firm's safeguards were reasonable. The compliance obligations for CPA firms extend to how client data is processed — including by third-party AI tools employees use on their own initiative.
Financial Services Firms
SEC and FINRA rules on data handling, record-keeping, and supervision apply regardless of firm size. A registered investment adviser at a 15-person practice is subject to the same record-keeping requirements as a large broker-dealer. Shadow AI tools that process client account data or communications create potential record-keeping gaps that examiners can flag. IT support for financial services firms needs to account for AI data flows, not just traditional network security.
Construction and Engineering Firms
Construction and engineering firms carry a different category of risk: proprietary bid data, design files, and subcontractor agreements pasted into an unsanctioned AI tool can expose competitive information and create IP ownership ambiguities. Many project contracts — particularly public-sector and government work — include data-handling clauses that shadow AI use can violate without anyone realizing it.
What a Sanctioned AI Policy Looks Like at the 20–75-Person Scale
At the 20–75-person scale, AI governance means three concrete things: a short approved-tools list, a one-page acceptable-use rule employees sign, and a data-classification rule defining what can and cannot be submitted to any AI tool. Enterprise prescriptions like private LLMs and RAG pipelines are not the starting point.
Enterprise Frameworks Don't Fit a 30-Person Firm
The governance frameworks published by enterprise vendors assume a dedicated CISO, an internal IT department, and the budget to deploy private large language models or build custom AI pipelines. A 30-person CPA firm or engineering practice in the Orlando metro has none of those. Applying an enterprise framework to that firm produces a policy no one reads and no one enforces.
The Three Things an Orlando SMB Actually Needs
- Approved-tools list: A maintained short list of AI tools the business has reviewed and permitted, with the account tier required for each (e.g., "ChatGPT — Team account only, managed by IT"). Not an app store. A list.
- AI acceptable use policy: A one-page document employees sign that names which data categories — client PII, financial records, contract terms, proprietary design data — are off-limits for submission to any AI tool, sanctioned or not.
- Data classification rule: A simple, tiered classification (e.g., "public," "internal," "confidential") mapped to AI tool access. Confidential data does not go into any AI tool without explicit IT approval. Internal data goes only into approved tools on company-managed accounts.
Where Tech Rage IT Fits
While enterprise vendors publish generic governance frameworks built for Fortune 500 IT departments, Tech Rage IT's technicians work directly inside Orlando SMBs across CPA, financial services, construction, and engineering — translating AI governance from a compliance abstraction into a concrete, enforced policy that fits a 20- or 50-person team. That's what the company means by better technicians delivering better service: the policy gets built, communicated to staff, and connected to the managed IT foundation that AI governance connects to.
Frequently Asked Questions
What is shadow AI and how is it different from shadow IT?
Shadow AI is the use of AI-powered tools by employees without business review or approval. Shadow IT covers any unauthorized software broadly. Shadow AI is a higher-risk subset because AI tools actively process, store, and may train on the business data employees submit — creating data exposure, not just a data-siloing problem.
Can free-tier AI tools like ChatGPT retain and train on the data employees submit?
Consumer and free-tier accounts for tools like ChatGPT may use submitted content to improve their models, depending on account settings and the user's opt-out status. Enterprise and Team account tiers typically exclude submitted data from training — but only when the account is properly configured by IT, not left at default settings.
What industries are most at risk from shadow AI data leaks?
CPA firms, financial services companies, engineering practices, and construction firms carry the highest exposure because their employees regularly handle regulated or confidential data — client PII, tax records, SEC-regulated communications, proprietary bid files — that creates compliance risk when submitted to an unsanctioned AI tool.
What is a sanctioned AI tool, and how do I create an approved-tools list?
A sanctioned AI tool is one the business has reviewed for data-retention practices, approved for use, and made accessible through a company-managed account with appropriate data controls. An approved-tools list is a maintained document naming each permitted tool and the required account tier. Tech Rage IT's AI governance services include building and maintaining this list.
Not Sure Which AI Tools Your Team Is Using — or Whether Any of Them Are Safe?
Book a free 10-minute discovery call with a Tech Rage IT technician who will walk you through exactly which AI tools are running in your environment, which ones create liability, and what a practical, enforced AI policy looks like for your size of business.
Book Your Free Discovery Call
