Having run more than 200 AI workshops for business owners and leadership teams, many of them in India, I ask the room a simple question: who has put something from work into a free AI tool in the last month?
Nearly every hand goes up.
Then I ask a second question: who has been told by their company that this is allowed? Most of the hands come back down.
That gap has a name. People call it shadow AI, and it’s the part of AI adoption almost nobody in the boardroom wants to talk about.
Raj Goodman Anand, Founder, AI-First Mindset
What actually gets pasted
When I dig into what people are putting into these tools, it’s rarely dramatic. A customer list someone wants cleaned up. Notes from a sales call, with names and phone numbers still in them. An angry email from an employee that a manager wants to “make more professional” before replying. A vendor contract. A salary sheet someone needed turned into a chart before a meeting.
None of this is malicious. People are trying to get their work done faster, which is exactly what their bosses keep asking them to do. The CEO stands up at the town hall and says, “use AI everywhere,” and then nobody tells the team which tool, on which account, with what data.
So, they open the free version on their personal login and get on with it.
Why DPDP changes the conversation
For a long time, this felt like an IT hygiene issue. It isn’t anymore.
India’s Digital Personal Data Protection Rules were notified in November 2025, and the full set of obligations comes into force on 13 May 2027. That’s less than eight months away. Under the DPDP Act, your company is responsible for the personal data it collects, even when an employee is the one who moves it somewhere else. The Act expects you to have reasonable security safeguards in place, and the penalty for failing to do that can go up to ₹250 crore.
Now think about what happens when a sales executive pastes 300 customer names and mobile numbers into a personal account on a free chatbot. The company no longer knows where that data sits, who can access it, how long it’s kept, or whether it’s being used to train someone else’s model. It would be very hard to argue you took reasonable steps to protect that data when you didn’t know it was happening at all.
I’m not a lawyer, and every company should get proper legal advice on this. But I don’t think “we didn’t know our people were doing it” is going to be much of a defence.
Why banning it doesn’t work
The first instinct of most leadership teams is to block the websites. I’ve seen companies do this. Usage doesn’t stop. It moves to people’s phones, where the company has even less visibility. Same work, same data, less control.
Banning AI in 2026 is a bit like banning email in 1998. You’re fighting the wrong battle. People have already seen how much time these tools save them, and they aren’t going back.
What I’ve seen work
The companies that handle this well tend to do a few simple things.
They give people a good, sanctioned tool. If you want people to stop using the free version, give them something better. Business and enterprise plans from the major AI providers come with admin controls and don’t train on your data by default. The cost of a few hundred licences is small next to a regulatory penalty, or the cost of losing a key client’s trust.
They write a rule people can remember. Not a 40-page policy nobody reads. One page, ideally a traffic light. Green: public information and your own writing, go ahead. Amber: internal documents, remove names first. Red: customer personal data, health, financial or HR information, never in an unapproved tool.
They teach people to strip the personal details. AI doesn’t need to know the customer’s name to help you rewrite an email to them. “Customer A” works just as well. This one habit removes most of the risk, and it takes about five minutes to teach in a workshop.
They ask before they audit. One of the most useful things a leadership team can do is run a no-blame survey: which AI tools are you using, and for what? You’ll learn more in a week than any firewall log will tell you, and you’ll find out which teams are already doing clever things you can spread across the business.
And leaders go first. In many of the founder rooms I work with, the heaviest users of free AI tools are the owners themselves, often with the most sensitive data on their laptops. If the rules only apply to junior staff, nobody will take them seriously.
The good news hiding in the problem
Shadow AI tells you something useful: your people want to use AI. That’s the hard part of adoption already done. Plenty of companies spend lakhs on training and still can’t get staff to open the tools.
The job now is to channel that energy into something safe before the deadline. The companies that do this before May 2027 will end up faster and more compliant. The ones that don’t will probably find out what their employees have been doing when the Data Protection Board asks them first.
About The Author
