In a team meeting at a consultancy, a consultant shows a presentation she built in Gamma. The director asks why not in PowerPoint with Copilot, since that is what the firm pays for. The answer comes without hesitation: "This was done in ten minutes and it looked right straight away."
That answer is the whole explanation. Employees use other AI tools not because they ignore the policy, but because they are trying to get something done for which Copilot is not the obvious route at that moment. Reading that as disobedience misses the information it carries.
What are they trying to achieve?
Copilot is strong at the work that happens inside Microsoft 365: summarising an email thread, rewriting a document, reducing a Teams meeting to action points. A lot of work sits outside that, and that is where the other use begins.
A presentation that looks good without design work is what Gamma is for. Images and layout are what Canva is for. Research with sources attached is why people open Perplexity. A long text in a particular tone, or a piece of code, they do in ChatGPT or Claude, because they know what comes out. And next to the familiar names sit the specialist tools: transcription, legal search, data analysis, each with an AI layer of its own.
Then there is habit. Someone has used ChatGPT privately for a year, knows how to ask, has projects and a history there. The free account existed before the organisation bought Copilot, and a tool that is already open beats a button you still have to find. Speed works the same way: the chatbot tab is already there, the Copilot pane in Word still has to be opened.
| What someone is after | Where it comes from | What it asks of the organisation |
|---|---|---|
| A task Copilot does not do well | Presentations, images, research with sources, code | A decision about that tool, not about Copilot |
| A tool that is already familiar | Habit, history, a free account that already existed | An explanation of why the preferred route differs |
| Speed in the moment | The tab is already open | Making the preferred route visible at that moment |
| Better results for a specific task | People compare answers | Being honest about where Copilot is not the best |
| A feature Copilot lacks | A specialist AI layer in a professional tool | A decision per specialist tool, with a condition |
None of those reasons is unreasonable. They are the reasons people use AI at all: it makes the work easier. The question for an organisation is not how to stop that, but how to handle it maturely.
Is it a problem?
That depends on two things: which tool, and which account. Using Perplexity to search public case law is different from pasting a client file into a ChatGPT account under consumer terms, where input can be used for training by default and no data processing agreement sits underneath. The account type weighs more than the name of the tool.
The real problem is usually not the tool. It is that the organisation does not know it is in use, and so has decided nothing about it. That is exactly what shadow AI is: a tool anyone can start on their own, with no decision behind it, and in actual use. Buying Copilot changes nothing there, because the decision was about Copilot.
What do you do with it?
First, see which tools are in use. Not through a survey, because people name the tools they remember, but through what gets opened in the browser. A consultancy with Copilot in its bundle saw eleven AI tools in use after a month. Copilot was at the top, ChatGPT just below it, and Gamma was opened daily in one team. For four of the eleven, nothing had been decided.
Then a decision per tool. That does not have to be a ban. The four outcomes are allowed, limited use (with a condition the organisation writes itself, such as "public information only"), no decision yet, or not allowed. And every decision comes with the question: which tool do we point to as the alternative? Naming Copilot as the preferred route is a decision too, and a stronger one than a ban, because it answers what someone was trying to do.
That decision then has to land where it matters: at the moment someone opens the tool. A policy document on the intranet does not reach that moment. A notice in the browser does, with the allowed alternative as the first button and the option to continue anyway. This is what that register looks like, with the decision the organisation took per tool:
