Someone on your team is using a publicly available AI chatbot to work faster. Maybe they're drafting a client letter, summarizing a meeting, or cleaning up a contract. This is happening in offices with five employees and offices with five hundred. The difference is that larger firms have people writing policies to stop it. You probably don't.
When employees use publicly available AI chatbots for work tasks, the client and business data they enter may be stored, reviewed, or used to train the AI provider's models—without the employee or the firm knowing. For small offices in regulated industries, a single paste of a client file into a public chatbot can create a breach, a privilege waiver, or a regulatory violation. A written acceptable-use policy and a vetted, enterprise-licensed AI tool are the minimum controls a small firm needs today.
What is shadow AI, and why does it matter in a small office?
Shadow AI is the use of AI tools that the business hasn't reviewed, approved, or secured. Unlike the shadow IT of a few years ago—a personal Dropbox account, an unapproved app—shadow AI carries a specific risk that most small-office employees never consider: the data they type into the tool may not stay private.
What actually happens to the data employees enter
Most publicly available AI chatbot services operate under terms of service that allow the provider to store, review, and use submitted content to improve their models. That policy often changes when an organization pays for an enterprise plan with a data processing agreement—and it rarely applies at all on the no-cost, unauthenticated tier most individual employees reach for first.
When a staff member pastes a client's name, a medical record, a financial summary, or case details into one of these tools, that information leaves your office network and enters a third-party server. You have no data processing agreement with that provider. You have no audit trail. You have no reliable mechanism for deletion. And you almost certainly have no idea it happened.
For firms in healthcare, law, financial services, or any field where client confidentiality is a legal or ethical obligation, this is not a theoretical problem. It is a live compliance exposure.
Why small offices carry the most risk
Large firms issue policies, run formal training, and deploy technical controls that block unapproved tools. At a six-person office, the policy is often unwritten, training is informal, and no one is monitoring the network for data leaving through a browser tab.
Employees at small firms also tend to move fast and wear multiple hats. When a paralegal is drafting a motion and a chatbot will produce a workable draft in thirty seconds, the judgment that stops a larger-firm employee—"this might violate our policy"—is less likely to kick in when there is no policy to violate.
The risk compounds because small-firm clients tend to be individuals and small businesses themselves. A data exposure at a boutique law firm or a solo financial planner is not an abstract statistic. It is a named person whose private information is now in a vendor's training dataset.