Growing risk of Shadow AI in UAE: What happens when employees bring their own AI to work

Abu Dhabi: Two experts in corporate work and law have warned of the spread of the ‘shadow AI’ phenomenon in the workplace, as employees are no longer content with bringing their personal devices to the offices, but are now bringing their own artificial intelligence tools and applications into the workplace without prior permission. They emphasised that while this new digital trend saves employees long working hours and speeds up the pace of achievement, it presents institutions with a real security dilemma known as ‘shadow AI’, where these unregulated tools could turn into open windows for leaking sensitive data. The Microsoft and LinkedIn Work Trends Index, based on a study of 31,000 people in 31 countries, revealed that 78% of AI users were bringing their own AI tools to work, known as BYOAI or Bring Your Own AI. Employees, on condition of anonymity, confirmed that artificial intelligence applications have become a key part of their daily tasks, noting that they use their personal accounts on these applications to speed up the pace of work, which saves them a lot of time and effort, and doubles their productivity. They stated that the most prominent personal artificial intelligence tools they rely on have functions ranging from writing texts, summarising reports, programming, and generating presentations, in addition to analysing data, drafting contracts, and processing long and complex documents, as well as generating professional images, noting that the cost of paid subscriptions for these applications is low compared to their benefits, as their prices range between $10 (Dh36) and $20 (Dh72) per month. According to a study conducted by KnowBe4 in the UAE and Saudi Arabia, and published by Business Wire last June, 41% of employees reported that they usually resort to acquiring self-operating artificial intelligence (Agentic AI) tools themselves in cases where official options are unavailable or restricted, which makes organisations vulnerable to cyberattacks. More than half of cybersecurity leaders (54%) reported that mistakes made during day-to-day work had the greatest impact on their organisations’ cybersecurity over the past 12 months, while 44% of employees admitted that time pressures and distractions in the work environment actually push them to make serious security mistakes, even when they are aware of sound security protocols. For its part, the Cyber Security Council of the UAE government warned against artificial intelligence tools that appear in search results, as not all of them are safe, and some of them aim to collect user data and information. The Council stressed on the importance of using artificial intelligence tools only from trusted sources, not granting them access to the camera or other information, verifying the reliability of the site, and reviewing the permissions they request before approving them. Spread of AI in workplaces Ahmed Shahrouj pointed out that the spread of artificial intelligence in workplaces is happening at a speed that is sometimes difficult for institutions to keep up with. Picture credit: Supplied Corporate innovation consultant Ahmed Shahrouj said that the concept of shadow AI, or what can be called “artificial intelligence outside of governance,” is the use of artificial intelligence tools or applications by employees. Employees perform the work of the organisation without these tools being officially approved, or without their use being fully subject to the organisation’s controls related to data, privacy, security and risk management. Shahrouj pointed out the danger of this type of use, as it often does not seem dangerous. The employee does not feel that he is sharing the organisation’s data with an external party. He simply wants to summarise a report, rephrase a letter, analyse an Excel file, review a contract, prepare a presentation, or extract recommendations from a long document. But from a data governance perspective, copying information into a chat box or uploading a file to an external platform is ultimately a data sharing and processing operation, and this is where the challenge begins when employees get ahead of the organisation's policies. He pointed out that the spread of artificial intelligence in workplaces is happening at a speed that is sometimes difficult for institutions to keep up with, and that indicators suggest that the use of artificial intelligence is no longer always an institutional decision that starts with the information technology department, but may start with the employee himself. He said: “An employee discovers a new tool in the morning, creates a personal account, and hours later the tool becomes part of how he does his work. This is how shadow AI can be created before the organisation even knows it has shadow AI.” Shahrouj pointed out that the risks are not limited to the data of clients, their names and personal numbers. The information that is entered may be a contract that has not yet been signed, a financial offer