Right now, somewhere in your org, someone is pasting a stack trace, a customer record, or a chunk of the codebase into ChatGPT to get unstuck. You know it. I know it. The person doing it half-knows it's sketchy and is doing it anyway — because it works.
That's shadow AI, and the reason it's so hard to stamp out is that it's not laziness or malice. It's people trying to do their jobs faster. Send the "don't use ChatGPT" email and you don't stop it — you just make it quieter.
So don't start with a ban. Start with knowing what's actually leaving the building.
The four things that leak (roughly in order of how often I see it)
PII. Names, emails, addresses — worse if it's health or financial — tucked inside "help me reply to this customer" prompts. This is the one with legal teeth.
