The Samsung leak and the policy that actually stops shadow AI

In short: shadow AI is the use of AI tools the organization has not approved, usually with company data pasted into consumer accounts. Bans do not stop it; the evidence says most AI users bring their own tools and many admit entering non-public data. What stops it is an approved tool that is as easy as the unapproved one, plus a one-page rule for which data may go into which kind of tool.^1,2

In April 2023, according to Bloomberg, Samsung engineers uploaded internal source code to ChatGPT while using it to help with their work. In early May the company sent staff in one of its largest divisions a memo banning generative AI tools such as ChatGPT on company-owned devices and networks, and warning that uploading company data from personal devices could lead to dismissal. The memo cited an internal survey in which 65 percent of respondents said such services posed a security risk. Samsung’s stated concern was that data sent to the services is stored on external servers, is hard to retrieve or delete, and could be exposed to other users.³

Several banks had restricted the tools for similar reasons. Nearly three years on, the case is still the one most often used to justify a ban. It is worth asking what a ban achieves.

What people actually do

Three surveys, from three different angles, tell the same story.

When the approved route is slower or absent, people use the unapproved one, and company data goes into consumer accounts on consumer terms, out of sight of the security team. A ban moves that behavior to personal phones; it does not stop it. IBM’s figures add the governance side: 63 percent of the breached organizations either had no AI governance policy or were still developing one, and of those with a policy, only 34 percent audited regularly for unsanctioned AI.⁴ A rule nobody checks is not a control.

The policy that works: a data table, not a prohibition

The fix is short enough to fit on one page of an AI use policy. Rows are your data classes; columns are the kinds of tool:

The contract terms in the middle row are the ones a vendor review should confirm before anyone signs; the questions are in our piece on AI vendor due diligence. Then do the part that makes the table work: give people an approved tool for the tasks they are already doing with unapproved ones, put the table in onboarding, and make it easy to ask “can I use this here?”

Why people go around the rules

Shadow AI is rarely defiance. People use the tool that helps them finish today’s work, and they hide it when they are unsure whether it is allowed. The research on what workers expect from AI shows a workforce that is curious and anxious at once; a policy that only says “no” teaches them to stop asking. A policy that says “yes, here, with this data” brings the use into the open, where it can be measured and improved.

Detect, then decide

A data table is the rule; detection tells you whether it holds. Most organizations already have the means: web proxy and DNS logs show traffic to consumer AI services, data loss prevention tools can flag source code or customer records pasted into a browser, and expense reports show personal AI subscriptions being claimed. Use the first month’s findings to decide which tools to approve rather than which people to discipline. If half of a team is using the same unapproved tool for the same task, that is a procurement signal.

Three questions for this quarter

1. Do your people have an approved AI tool for drafting and summarizing, with enterprise data terms? If not, they are using one without them.
2. Does your AI use policy say, in one table, which data may go into which kind of tool?
3. Would your security team know if source code or client files were pasted into a consumer chatbot tomorrow? If not, the Samsung scenario is not a risk you have mitigated; it is one you have not measured.

The data classification, contract terms and monitoring behind that table are taught in Module 8 of the AIMP program, and the AI use policy template includes the table ready to adapt. Samsung’s memo was a reasonable first reaction in 2023. In 2026 the stronger position is the one that makes the safe route the easy route.