Employees are increasingly hiding their use of AI and blurring the lines between personal and work AI use. This creates compliance, security and privacy risks that HR and legal teams must untangle.

The use of AI tools in the workplace is on the rise. These include a range of emerging technologies that enable computers to undertake tasks such as data analysis, communication, research and problem-solving using machine learning.

As the availability and accessibility of AI tools rapidly accelerates, their use in everyday life is inevitable. However, a concerning trend is emerging. Increasingly, the tools are being used in the workplace without employers’ knowledge – a concept known as ‘shadow AI’.

A report from the federal government’s Jobs and Skills Australia highlights that 21-27 per cent of employees are using AI behind their managers’ backs. 

The employees cite concerns that it “feels like cheating” to use AI, or say they have a fear of “being seen as incompetent” if they’re known to be using it.

Many employers have been caught unprepared for the implications of shadow AI use at work. This is particularly true when it comes to managing confidentiality and privacy, the generation and ownership of intellectual property, the impact on employees’ duties and the policy frameworks needed to respond.

The dual risk of shadow AI

With shadow AI posing growing risks for organisations, employers are urged to actively engage with how these tools are being used in their workplaces – not just to maintain compliance, but to safeguard against potential financial and reputational losses. 

Key emerging risk areas include:

1. Protecting confidential information and proprietary knowledge

Many AI tools, such as ChatGPT, are readily available on the internet.  

The tools often require information to be shared with the tool to enable it to learn, develop reasoning and then perform a task. However, the information uploaded may be private, commercially confidential or sensitive, and its use, even for a work-related task, can result in inadvertent disclosure. 

This could have serious consequences, particularly in sectors where privacy and confidentiality are critical. Furthermore, the information may not be recoverable.

The disclosure could expose the employer to significant legal penalties and consequences. 

Professional standards may also be breached in specific sectors. For example, if a teacher was found to be using AI to mark students’ essays, it could breach assessment integrity policies and accreditation standards.

Without clear policies and guidance, employees may inadvertently breach confidentiality or privacy obligations – and employers can still be held liable for those breaches. Such incidents also carry significant reputational risk.

2. Managing performance, productivity and breaches of trust

Does your organisation prohibit the use of AI in producing work outputs – and if so, is that ban enforced?

If some use is permitted, have clear parameters and guardrails been communicated to employees to protect the business?

These are the kinds of questions employers must now address. In the absence of clear policy, enforcing standards of honesty, accuracy and accountability becomes increasingly difficult. 

While it may be reasonable to discipline an employee who presents AI-generated work as their own, ambiguity around what constitutes acceptable use can weaken an employer’s position.

Many employment contracts and workplace policies still lack explicit provisions addressing AI use, performance expectations and disclosure requirements. Strengthening these documents now will help organisations manage risk and uphold integrity as AI becomes further embedded in day-to-day work.

Examples in action

Recent cases highlight the importance of risk-management steps as the use of shadow AI becomes more common.

In one case, an employee’s dismissal was found to be unfair when it was discovered that a communication, generated by the employer using AI, informed the employee of a final restructure decision when the employer was required to first consult before a final decision was made. 

The manager tried to argue that the decision was not final, but that the tool got it wrong because of his own poor instruction and language. The Fair Work Commission did not accept the manager’s reasoning. 

In another recent case, a Victorian lawyer lost his practising certificate after submitting a list of court authorities that included fictitious cases generated by an AI tool – a list he had failed to verify before presenting to the court.

It’s essential for HR teams to proactively identify and manage the risks associated with shadow AI use. As employees increasingly turn to these technologies to boost productivity, the potential for data breaches, ethical lapses and compliance failures grows. 

This is a rapidly evolving landscape, and maintaining effective oversight will require ongoing monitoring, education and policy adaptation to keep pace with emerging risks and regulatory change.

Amanda Junkeer is a Partner specialising in industrial and employee relations at law firm Gadens.

A version of this article was originally published in the December/January 2026 edition of HRM Magazine.

All information, content and materials available on this site are for general informational purposes only. The contents of this article do not constitute legal advice and should not be relied upon as such.

Gain clarity and stay ahead of AI-driven change with AHRI’s brand-new AI & HR: What You Need to Know to Stay Compliant course.