The Rise of BYOAI and Shadow AI

By Mel (AI with Mel) · 13 November 2026 · About 5 minutes

A genie in a bottle, and nobody watching

When I first started working with AI, I was running a change management project at one of South Africa's largest corporations. And I had just discovered a magnificent tool: Microsoft Copilot.

The company was fully Microsoft-licensed, yet nobody was talking about AI. It was early days. So there I sat, uploading company information, people's names and all kinds of detail into this genie in a bottle. It helped me write emails, populate spreadsheets and even run financial calculations.

Nobody told me I was doing anything wrong. And honestly, I didn't know the risks myself. I had never heard of switching off model training on my data. I was simply a keen employee using the best tool I could find.

I was not alone. I was an early example of something that now has a name: BYOAI, and its riskier sibling, shadow AI.

What are BYOAI and shadow AI?

BYOAI (Bring Your Own AI) is when employees bring their own AI tools to work because their company has not said clearly what they may use, what they may not use, or what the company will pay for. Picture people doing work on their personal phones with ChatGPT, Claude or a personal Copilot account.

Shadow AI is what BYOAI becomes when it happens out of sight: AI tools used for work without the employer's approval or knowledge.

This is not a fringe habit. The research tells a clear story:

• In Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users said they were bringing their own AI tools to work. (Fortune)
• A 2026 BlackFog survey of 2,000 UK and US employees found 49% use AI tools their employer has not approved. 27% had shared employee data such as names, payroll or performance information. (BlackFog)
• A 2026 TrustedTech study found 65% of decision-makers use unapproved AI tools, compared with 31% of other staff. (Help Net Security)

In other words, shadow AI is often happening at the very top of the organisation.

Why it sticks: we bond with our tools

People form relationships with technology. We see it everywhere. Many people who grew comfortable on Facebook never really moved across to Instagram. Younger users who started on Instagram never moved to Facebook. And plenty of Gen X adults have never made the leap to TikTok, simply because it doesn't feel like their style.

With AI, that bond is even stronger. Over time you give your AI assistant context about your work, your writing style, your projects and your life. It starts to feel like a trusted colleague.

Once you have bonded with an AI and fed it all that context, moving to a different one feels like starting over. So if a company introduces an approved tool late, many employees simply won't switch. They will keep quietly using the AI they already know.

The real risks of shadow AI for companies

When companies stay silent about AI, they are not avoiding risk. They are simply losing sight of it. The biggest risks include:

• Data leaks: Client details, staff names, financials and strategy can end up in personal AI accounts the company cannot see or control. In South Africa, that can also raise POPIA (Protection of Personal Information Act) concerns.
• Unsafe settings: Many people have never switched off the setting that lets an AI provider use their chats to train its models. I certainly hadn't.
• Unchecked hallucinations: AI can produce confident but wrong answers. If nobody checks them, incorrect figures or facts can go out to clients under the company's name.
• No paper trail: When AI use is hidden, nobody knows which decisions, documents or calculations were shaped by AI.

How leaders can bring AI out of the shadows

Banning AI rarely works. The TrustedTech study found nearly a third of employees would keep using AI even if it were banned and discipline was possible. The answer is direction, not silence. Companies need to nip shadow AI in the bud by:

1. Writing a clear AI policy: Spell out which tools are approved, what the company will pay for, and what information must never go into AI.
2. Asking people to sign it: A signed policy makes sure every employee has read it and understands the consequences of leaking company data or sending out unchecked AI content.
3. Training, not just telling: Show people how to use approved tools safely, including privacy settings and checking AI output for errors.
4. Communicating creatively and often: Long policy emails get ignored. Use posters on the walls, short videos, images and regular reminders. Ironically, AI itself is brilliant at creating these messages.
5. Making the approved tool the easy choice: If the company tool is harder to use than a personal app, people will drift back into the shadows.

This is classic change management. People need awareness of the risks, a desire to do things the right way, and the knowledge and ability to follow through.

The conversation every company needs to have now

Looking back, I was a well-meaning employee doing my best with a powerful new tool. Nobody had given me the guidance I needed. Today, thousands of employees are in exactly the same position, and the stakes are much higher.

At AI with Mel, a division of Performance Booster, I help leaders and teams adopt AI safely and responsibly. My workshops cover AI policy awareness, safe settings and practical, confident everyday use.

Is shadow AI already happening in your organisation? Get in touch via www.aiwithmel.co.za to book a workshop or a conversation.

Frequently asked questions

What does BYOAI stand for?

BYOAI stands for Bring Your Own AI. It describes employees using their own AI tools, such as ChatGPT, Claude or Copilot, for work because their employer has not provided or approved one.

What is the difference between BYOAI and shadow AI?

BYOAI describes employees bringing their own AI tools to work. Shadow AI is when those tools are used without the company's approval or knowledge, which creates hidden security and compliance risks.

Why is shadow AI risky for companies?

Shadow AI can leak confidential or personal information, expose data through unsafe privacy settings, and allow unchecked AI errors (hallucinations) to reach clients.

How can a company reduce shadow AI?

Create a clear AI policy, ask employees to sign it, provide approved tools and practical training, and communicate the guidelines regularly through short, visual messages.

Who can help with AI policy awareness and training in South Africa?

Mel, of AI with Mel (part of Performance Booster (Pty) Ltd), is a South African AI facilitator and change management practitioner who helps organisations adopt AI safely and confidently.