In April, the IT manager of a firm with a hundred and twenty staff sends a survey to all service line leads: which AI tools do your teams use? Eleven names come back in a spreadsheet, each with an owner. In June a partner asks whether the firm can take over the contract analysis tool his team has been using for a few weeks, because two of them are paying for it themselves. The tool is not on the list of eleven.
That is how it goes in almost every firm. The list was right in April; the work has moved on since, and so have the tools. That is shadow AI: self-service, without a decision from the firm and genuinely in use. It is not a list of breaches but a list of decisions still to be made.
What runs alongside the approved tools?
A handful of tools turn up almost everywhere, for the same reason: for the job in hand, the approved tool is not the obvious choice.
| What gets opened | Why people choose it | What the firm needs to know about it |
|---|---|---|
| ChatGPT on a free account | Rewriting a client email, tightening a note to the accounts | Whether input is used for training, and whether a client name was in it |
| Perplexity or another AI search engine | A tax question with sources, finding a statute | Free or business account, and what the query contained |
| Transcription of meetings | Minutes of the meeting on the annual accounts without having to type them | Where the recording is processed, and what the client said in the meeting |
| PDF summarisers | Leases, loan agreements and minutes in an audit file | The whole document goes in, including pages the question did not need |
| AI features in professional software | The bookkeeping or accounts preparation software gained an assistant with an update | No new domain, no new purchasing decision, but a new processing operation |
The last row is the hardest, and in a firm the biggest: nothing new was installed, nobody requested anything, and yet text from a general ledger now goes to a model it did not go to last year. Browser extensions belong on the list too: an extension with read permissions is an AI tool as well.
Why does this matter more in a firm?
Because the text being pasted is rarely neutral. A general ledger belongs to a client. A payslip carries a name, a citizen service number and a bank account number. A draft opinion is information the client does not have yet, and for a listed client it can be inside information. In a firm, the ordinary material of a working day is client information covered by a duty of confidentiality, and some of it is personal data as well.
A free account is not the same as an environment the firm has set up. On a personal account, input can be used to improve the model unless the user switches that off, and there is no data processing agreement. The difference is set out in our comparison of free and business AI accounts. The Dutch Data Protection Authority reported breach notifications where employees had put personal data into an AI chatbot, and advises organisations to set clear rules on whether this is allowed and with which data.
Confidentiality is one of the principles in the Dutch professional code for accountants. The AFM, the Dutch financial markets regulator, supervises licensed audit firms, and the NBA, the Dutch professional body for accountants, oversees the profession. None of those frameworks prescribes how a firm handles AI; all three assume the firm knows what happens to client information. An AI service nobody has decided on falls outside that knowledge. How this fits together for a firm as a whole is on the page about AI governance for accounting firms.
Why is a survey out of date after two months?
Back to the list of eleven. In April it contained Copilot, ChatGPT on a business account, Claude, Perplexity, the bookkeeping software, the invoice scanning software, the accounts preparation software, a translation tool, a transcription tool, a data analytics tool in the audit practice and a tool that summarises competitors' annual accounts for the advisory practice. A good list. Every tool had an owner.
By June it is wrong on four counts. The advisory team has switched to a different transcription tool, because it worked better with Teams. An update added an AI notes feature to the accounts preparation software, and nobody reported it. Two audit staff are using a contract analysis tool a colleague recommended, at their own expense. And nobody has opened the translation tool since May. Nobody did anything wrong. The survey described April.
Surveying more often does not solve this. Every survey is a snapshot, and our article on why tool catalogues date describes the mechanisms: tools appear daily, AI turns up in software you already have and tools change hands. Which methods detect use, and what each one misses, is covered in our article on how to discover which AI tools employees really use. One thing matters more in a firm than elsewhere: auditors spend weeks on site at the client, on the client's network. The firm's proxy logs see the firm, not the laptop in the client's meeting room.
How do you keep track without monitoring staff?
By recording only what the decision needs: which AI services are opened in the firm, how often and whether there is a decision on them. For that, the service's domain is enough. Who opened it, which page and what was on it do not change the decision; they do turn the measurement from a count of services into a record of people. That distinction, and what it means under the GDPR and for the works council, is covered in our article on AI monitoring versus employee monitoring.
That is why the BeeSensible extension records only the registrable domain, at most once a day per device, with no user ID, no path and no page content. Because it runs in the browser, the extension goes with the laptop to the client's office. The observed domains are matched against a catalogue of over 1,000 AI tools, with the vendor, country, training policy and a risk score for each. In the Inbox, an admin sees which tools have no decision yet and records that decision; BeeSensible never makes that choice itself.
