In April, the IT manager of a firm with a hundred and twenty staff sends a survey to all practice leads: which AI tools do your teams use? Eleven names come back in a spreadsheet, each with an owner. In June a partner asks whether the contract analysis tool his team has used for a few weeks can go through the firm, because two staff members are paying for it themselves. The tool is not on the list of eleven.
That is how it goes in almost every firm. The list was right in April; the work has carried on since, and so have the tools. That is shadow AI: self-serve, without a decision from the firm, and actually in use. It is not a list of violations. It is a list of decisions still to be made.
What runs next to the approved tools?
A number of tools come back almost everywhere, and for the same reason: at that moment the approved tool is not the obvious route for the job.
| What gets opened | Why people choose it | What the firm needs to know about it |
|---|---|---|
| ChatGPT on a free account | Rewriting a client email, tightening a note to the accounts | Whether input is used for training, and whether a client name was in it |
| Perplexity or another AI search engine | A tax question with sources, finding a statute | Free or business account, and what the query contained |
| Transcription of meetings | Minutes of the annual accounts meeting without the typing | Where the recording is processed, and what the client said in the meeting |
| PDF summarisers | Leases, loan agreements and minutes in an audit file | The whole document goes along, including pages the question did not need |
| AI features in professional software | The bookkeeping or compilation package gained an assistant with an update | No new domain, no new purchasing decision, but a new processing operation |
The last row is the hardest, and in a firm the largest: nothing new was installed, nobody requested anything, and yet text from a general ledger now goes to a model it did not go to last year. Browser extensions belong on the list too: an extension with read permissions is an AI tool as well.
Why does this weigh more in a firm?
Because the text being pasted is rarely neutral. A general ledger is a client. A payslip carries a name, a citizen service number and a bank account number. A draft opinion is information the client does not have yet, and for a listed client it can be inside information. In a firm the default content of a working day is client information under a duty of confidentiality, and part of it is personal data too.
A free account is not the same as an environment the firm set up. On a personal account, input can be used to improve the model unless the user switches that off, and there is no data processing agreement. The difference is set out in free versus business AI accounts. The Dutch Data Protection Authority reported breach notifications where employees had put personal data into an AI chatbot, and advises organisations to agree whether it is allowed and with which data.
Confidentiality is one of the principles in the Dutch professional code for accountants, the AFM supervises licensed audit firms, and the NBA oversees the profession. None of those frameworks prescribes how a firm handles AI; all three assume the firm knows what happens to client information. An AI service nobody has decided on falls outside that knowing. How this fits together for a firm as a whole is on the page about AI governance for accounting firms.
Why is a survey out of date after two months?
Back to the list of eleven. In April it held: Copilot, ChatGPT on a business account, Claude, Perplexity, the bookkeeping package, the scan-and-recognise software, the compilation software, a translation tool, a transcription tool, a data analytics tool in the audit practice, and a tool that summarises competitors' annual accounts for the advisory practice. A good list. Every tool had an owner.
By June it is wrong on four points. The advisory team has switched to a different transcription tool, because it worked better with Teams. The compilation software gained an AI note in an update that nobody reported. Two audit staff use a contract analysis tool a colleague recommended, at their own expense. And the translation tool has not been opened since May. Nobody did anything wrong. The survey described April.
This is not a matter of surveying more often. Every survey is a snapshot, and why tool catalogs age describes the mechanisms: tools appear daily, AI shows up in software you already have, and tools change owners. Which methods find use and what each misses is in how do you discover which AI tools employees really use. One thing matters more in a firm than elsewhere: the audit team spends weeks on site at the client, on the client's network. The firm's proxy logs see the firm, not the laptop in the client's meeting room.
How do you keep track without following staff?
By recording only what the decision needs: which AI services are opened from our firm, how often, and is there a decision on them. For that answer the service's domain is enough. Who opened it, which page and what was on it do not change the decision; they do change the measurement, from a count of services into a record of people. That distinction, and what it means for the GDPR and the works council, is in AI monitoring versus employee monitoring.
That is why the BeeSensible extension records only the registrable domain, at most once a day per device, with no user id, no path and no page content. Because the extension sits in the browser, it travels with the laptop to the client. The observed domains are matched against a catalogue of 865 AI tools, with the vendor, country, training policy and a risk score for each. An admin sees which tools have no decision yet and records that decision; BeeSensible never chooses itself.
