Issue 04 · October 2026

AI Up

The weekly briefing from AI Up

The Upside

Human-led AI for the people who have to make the call. One big idea, one free playbook, every week.

This week: The AI you can't see.

5 min read

In this issue

Shadow AI in a business of one

The security companies have discovered shadow AI, and my feed is full of ads about it. Most of them are written for businesses with an IT department. This week is for everyone else.

The big idea

In a small business, the shadow AI is usually the owner.

The free playbook

The Shadow AI Check: ten questions, two minutes.

In the Sprint

Safe AI setup, sorted in week one.

A note from our founder

Hi there,

There's a question I hear a lot at the moment, usually tacked on at the end of a call: "I'm using AI every day now, but I've got no idea if I'm doing it safely. Am I?"

That's a really good question to be asking, and it's what this issue is about. I've kept it practical. There's no scare campaign here, just a quick way to see where you stand and what to fix first.

If you only do one thing this week, take the Check. It takes two minutes and you'll know more at the end of it than most businesses do.

Bec

Bec Mason · Founder & Fractional CAIO / AI Architect, AI Up

This week's big idea

Shadow AI isn't just a big-company problem.

In a business of one, it's usually you. And that's fixable.

If you've scrolled Instagram or LinkedIn lately, you've probably seen the ads. Shadow AI is already inside your business, they say, and you just can't see it. Then they offer you software that finds it and blocks it.

For a company with 500 staff and a security team, fair enough. "Shadow AI" just means AI being used for work that nobody has approved or set up properly, and in a big organisation that can be hundreds of people doing their own thing.

But most of the people I work with are consultants, sole operators and small teams. There's no IT department and nobody to block anything. If there's shadow AI in the business, it's usually the owner, on a personal ChatGPT account, pasting in a client's brief at 9pm because they're under the pump and it's quicker.

I'm not saying that to make anyone feel bad. Nobody sat down and decided to put client information into a personal account. They just started using the tool before anyone thought about how it should be set up, and then it turned into a habit. I'd bet most of us have done some version of it.

Why it matters more than it feels like it does

The numbers are a bit confronting, even allowing for the fact that some of them come from big-company research.

~3 in 4

workplace ChatGPT sessions run through personal accounts, not company ones.

37%

of notified data breaches in Australia were caused by human error (Jan to Jun 2025).

US$670K

added to the average breach where shadow AI was widespread.

A small business is never going to face a breach bill like that last one. The risk for you looks different, and it's more personal. It's the client who asks, "Do you put my information into AI?" and you're not sure what to say. It's the contract or NDA you signed that says confidential material can't go to third parties, when a personal AI account is exactly that. It's the contractor who finishes up and takes a year of chat history about your clients with them.

None of that shows up on a dashboard. It shows up in a conversation with a client, usually at the worst possible time.

You can't really ban your way out of this, and in a small business you wouldn't want to. AI is too useful.

What actually fixes it

The good news is that the fix is boring, in the best way. You don't need security software. You need three things set up once and then left alone.

The first is a proper business account, on your business's billing, with the training-on-your-data setting switched off. The second is one workspace that's set up for your business, so you're not starting from scratch (and pasting your whole client file in) every time you open a new chat. The third is a page of plain rules: what can go into AI, what never does, and what always gets checked by you before it goes to a client.

That's it. Once those are in place, the next time a client asks what happens to their information, you've got a real answer. Most of your competitors won't.

Free playbook · 2 minutes

The Shadow AI Check

Ten yes-or-no questions. Answer them honestly, for you and anyone who works with you. Nobody's marking it but you.

Do you use a personal (not business) AI account for client or business work?

Have you pasted client names, emails or personal details into an AI tool?

Have you uploaded a client's document, brief, contract or spreadsheet into one?

Do you know whether your AI tools train on what you put in, and have you switched that off?

Could you list every AI tool used for work in your business this month?

If a contractor or team member finished up tomorrow, would their AI chat history stay with the business?

Do you have written rules, even one page, on what can and can't go into AI?

If a client asked "Do you put my information into AI?", could you answer with confidence?

Do your client contracts, NDAs or privacy policy say anything about AI?

Does a person always check AI output before it goes to a client?

How to score it

Give yourself a point for every yes to questions 1 to 3, and a point for every no (or "not sure") to questions 4 to 10.

0 to 2: In the light. You're ahead of most. Tidy up the gaps and write your rules down.

3 to 6: Some shadows. Normal, and very fixable. Start with your account and your rules.

7 to 10: Working in the dark. No judgement. This is where most small businesses start, and it's a few weeks of work to fix.

Prefer it done for you?

Take the Check online and you'll get your score plus your three biggest risks, each with one thing to do about it this week.

Take the Shadow AI Check →

In the AI Architect Sprint

Safe AI setup comes first

If your score made you wince a bit, this is the part of the Sprint built for you. Before we build anything, week one sorts out the foundations: a proper business account on your billing, the privacy and training settings locked down, and a one-page AI rules sheet for your business that you'll actually use.

Then we spend the next three weeks building your workspace and your first systems on top of it, so the safe way to use AI is also the easiest way. Four live 3-hour sessions, one a week, built with you rather than handed over in a report.

Group of five

$990 + GST each

One-to-one

$2,450 + GST

Bring your crew

Know four people using AI on a personal account?

You probably do. Send them the Check, and if a few of them score in the shadows, do the Sprint together. Five of you pay $990 + GST each instead of $2,450, everyone builds for their own business, and you keep each other on track. Got two or three keen? We'll help you fill the group.

Start a group →

Or simply forward this issue to someone who comes to mind. I'll take good care of them.

Bring your AI into the light

There are three ways into AI Up. Most businesses start with one:

AI Architect Sprint · for consultants, solo operators and small teams

Fractional AI Architect · for teams of 10 to 200 with a bottleneck to fix

Fractional COO + CAIO · for leadership teams who need operations and AI in one seat

See the AI Architect Sprint →

Not sure which fits? Book a free 30-minute call and we'll tell you straight.

Sources

~3 in 4 personal accounts: Cyberhaven Labs, 2025 AI Adoption & Risk Report.

37% human error: Office of the Australian Information Commissioner, Notifiable data breach statistics, January to June 2025.

US$670K: IBM, Cost of a Data Breach Report 2025.

AI Up

Fractional AI Leadership

Know someone who should read this? Forward this email, or send them to subscribe here.

ai-up-today.com · BecAIUP@outlook.com

AI Up · Human-led AI · Australia
The Upside is a weekly briefing from AI Up. Subscribe free · To stop receiving it, email BecAIUP@outlook.com with "Unsubscribe".