An employee pastes a client contract into ChatGPT to summarize it. Nobody told them not to. Nobody told them they could, either.
That gap — the space between what employees actually do with AI and what their employer has written down — has a name now: shadow AI. It’s exposing a hole in a document most companies wrote years before generative AI existed: the code of conduct. Closing that gap takes more than a new policy PDF. It takes people trained to build and enforce standards that keep pace with how work actually happens, which is precisely the gap the CIPD Level 5 Associate Diploma in Organisational Learning and Development is built to close.
The Policy Vacuum Nobody Noticed
Most codes of conduct still read like they were built for a world of email and Excel. They cover harassment, confidentiality, and conflicts of interest. They say nothing about a chatbot.
Employees noticed the gap before employers did. A 2026 survey from PagerDuty and Wakefield Research found that 66% of office professionals have used AI tools at work despite believing those tools weren’t permitted. More than a third admitted feeding customer data into public AI models while doing it — not out of malice, but because no one had drawn the line.
The scale is bigger than a few rogue employees. A separate 2026 Founder Reports survey of more than 2,000 U.S. workers found that 44% say their employer has no clear AI policy, or aren’t sure one exists. At companies with fewer than 10 employees, that number climbs to 59%. Meanwhile, the U.S. Chamber of Commerce puts generative AI adoption among small businesses at 58% and rising.
Verizon’s 2026 Data Breach Investigations Report tracked the fallout: shadow AI detections rose fourfold in a single year, making it the third most common non-malicious insider action behind actual breaches. Policy hasn’t caught up to behavior. It’s falling further behind it.
Why This Belongs in the Code of Conduct, Not a Separate Memo
Some companies treat AI use as an IT problem. Write a tool list, block the rest, done. That misses what a code of conduct actually does.
A code of conduct explains an organisation’s principles, professional obligations, and appropriate workplace behaviour, helping employees make wise decisions and uphold uniform standards. An AI tool is now part of that daily decision-making — what data goes into a prompt, when to trust an output, when a human needs to check the work before it goes out the door. Bolting a separate AI memo onto an unrelated document splits guidance that belongs together, and employees end up following whichever document they happened to read.
Governance platforms working in this space have reached the same conclusion. AI usage policies typically get linked to a company’s existing code of conduct, with compliance monitored the same way any other internal violation would be — through the same reporting channels, the same review process, the same consequences.
Where AI Genuinely Changes the Conduct Conversation
Four areas need direct language, not vague reassurance:
- Data handling. Which tools are approved, and what never goes into a prompt — client records, unreleased financials, anything under an NDA.
- Verification, not blind trust. AI drafts contracts, code, and emails. Someone still has to own the output before it’s sent, filed, or shipped.
- Disclosure. If AI shaped a decision or a deliverable, say so. Silence here is where shadow AI thrives.
- Escalation. Employees need a named person or channel to ask “is this okay?” before they act, not after.
None of this replaces the older sections of a code of conduct. It sits alongside respect, accountability, and ethical decision-making — the same categories a well-built code has always covered, just applied to a newer tool.
The Judgment Problem AI Can’t Solve
Here’s the part policy alone won’t fix: AI can flag a rule violation. It can’t decide whether pasting a slightly-too-detailed prompt into a chatbot was a rushed mistake or a pattern worth addressing. That call still needs a person who understands context, intent, and consequence — three things no AI model reliably weighs the way a human colleague does.
Why AI Can’t Replace Soft Skills: The Science of Human Judgment gets into why — pattern recognition and judgment aren’t the same skill, and the gap between them shows up exactly in moments like this.
That’s the argument for training managers and HR teams on ethical decision-making before AI adoption outpaces it, not after. Waiting until a shadow AI incident forces the conversation means writing policy under pressure, reacting instead of preparing.
What This Looks Like in Practice
A workplace with a strong AI-aware Code of Conduct doesn’t ban AI and hope employees comply. It names approved tools, sets a clear line on data, gives employees somewhere to ask before they act, and backs all of it with people who know how to enforce standards fairly and consistently.
The 44% of companies still working without any AI policy are running that experiment blind. The shadow AI numbers already show how it’s turning out — quietly, unevenly, and mostly out of sight until something breaks.
Skip the policy, and employees write their own rules anyway, one prompt at a time. The only question is whether anyone finds out before or after it costs something.
Related: Fear of Becoming Obsolete Is the New AI Workplace Anxiety — And It Has a Name
