In a team meeting at a consultancy, a consultant shows a presentation she built in Gamma. The director asks why she did not use PowerPoint with Copilot, since that is what the firm pays for. The answer comes without hesitation: "This was done in ten minutes and it looked right straight away."
That answer is the whole explanation. Employees use other AI tools not because they ignore the policy, but because they are trying to get something done for which Copilot is not the obvious choice at that moment. Reading that as disobedience misses the information it carries.
What are they trying to achieve?
Copilot is strong at the work that happens inside Microsoft 365: summarising an email thread, rewriting a document, reducing a Teams meeting to action points. A lot of work sits outside that, and that is where people turn to other tools.
A presentation that looks good without design work is what Gamma is for. Images and layout are what Canva is for. Research with sources attached is why people open Perplexity. For a long text in a particular tone, or a piece of code, they turn to ChatGPT or Claude, because they know what they will get. And alongside the familiar names are the specialist tools: transcription, legal search, data analysis, each with an AI layer of its own.
Then there is habit. Someone has used ChatGPT in their own time for a year, knows how to phrase a question and has projects and a chat history there. The free account existed before the organisation bought Copilot, and a tool that is already open beats a button you still have to find. Speed works the same way: the chatbot tab is already there, the Copilot pane in Word still has to be opened.
| What someone is after | Where it comes from | What it asks of the organisation |
|---|---|---|
| A task Copilot does not do well | Presentations, images, research with sources, code | A decision about that tool, not about Copilot |
| A tool that is already familiar | Habit, history, a free account that already existed | An explanation of why the organisation prefers another tool |
| Speed in the moment | The tab is already open | Making the preferred tool visible at that moment |
| Better results for a specific task | People compare answers | Being honest about where Copilot is not the best option |
| A feature Copilot lacks | A specialist AI layer in a professional tool | A decision per specialist tool, with a condition |
None of those reasons is unreasonable. They are the reasons people use AI at all: it makes the work easier. The question for an organisation is not how to stop that, but how to deal with it sensibly.
Is it a problem?
That depends on two things: which tool, and which account. Using Perplexity to search public case law is different from pasting a client file into a ChatGPT account under consumer terms, where input can be used for training by default and there is no data processing agreement behind it. The type of account matters more than the name of the tool.
The real problem is usually not the tool. It is that the organisation does not know it is in use, and so has decided nothing about it. That is exactly what shadow AI is: a tool that anyone can start using on their own, that has no decision behind it and that is actually in use. Buying Copilot does not change that, because the decision was about Copilot.
What do you do with it?
First, see which tools are in use. Not through a survey, because people name the tools they remember, but through what gets opened in the browser. A consultancy with Copilot included in its Microsoft licences found eleven AI tools in use after a month. Copilot was at the top, ChatGPT just below it, and Gamma was opened daily in one team. For four of the eleven, nothing had been decided.
Then, a decision on each tool. That does not have to be a ban. The four outcomes are allowed, limited use (with a condition the organisation writes itself, such as "public information only"), no decision yet or not allowed. And every decision comes with the question: which tool do we point to as the alternative? Designating Copilot as the preferred tool is a decision too, and a stronger one than a ban, because it answers what someone was trying to do. If the question is whether to allow ChatGPT and Claude alongside Copilot, read which of ChatGPT, Claude and Copilot to allow.
That decision then has to reach people where it matters: when they open the tool. A policy document on the intranet does not reach them there. A notice in the browser does, with the allowed alternative as the first button and, if the organisation set it up that way, the option to continue anyway. This is what that register looks like, with the decision the organisation took on each tool:
