The use of AI tools by staff and contractors without formal organisational approval is a growing risk with serious consequences for the public sector write Declan Goodwin and Frederick Lambert.
Artificial intelligence is already embedded in the day-to-day work of public sector employees whether their employers know it or not. The use of AI tools without formal organisational approval is no longer an emerging risk. It is a present one, and it is growing.
We refer to this as "shadow AI": staff reaching for consumer-grade or third-party AI tools outside of any procurement process, policy framework or governance structure. The scale of it should concern every monitoring officer, data protection officer and head of legal in local government.
A recent government survey confirmed that one in three adults have used AI in the workplace in the last month. Yet, in the same report, 84% of those in work said they had not undertaken any AI-related training in the past twelve months. This is where legal risk takes root.
When an employee shares information with an AI model, they may not appreciate that they are, in effect, disclosing it to a third-party system with its own data retention and processing arrangements. For public sector bodies which routinely handle sensitive personal data, the implications under UK GDPR are serious.
Beyond data protection, there is also the question of confidentiality. Employees sharing protected or commercially sensitive information with AI tools, perhaps whilst drafting a report or seeking legal research assistance, risk breaching confidentiality obligations owed to individuals, partner organisations or counterparties.
Where that information relates to potentially patentable intellectual property, the unauthorised disclosure may compromise the ability to seek protection altogether. In the public sector, this is particularly relevant to proprietary software, innovative service delivery models and jointly developed assets.
The hallucination problem
The professional services sector has already seen a number of high-profile cases in which practitioners have submitted AI-generated content to courts or clients, only for it to contain fabricated case citations or inaccurate statements of law. Local authorities are not immune. Officers relying on AI to research legislative requirements, draft committee reports or prepare legal arguments face a real risk of acting on outputs that are plausible but wrong.
This is not a counsel of perfection. AI tools can and do add value. But they require human oversight, and that oversight requires training. Without it, the organisation - not the individual -bears the legal and reputational consequences.
Agentic AI: a step change in risk
Most organisations are still getting to grips with generative AI, which produces content by identifying patterns in existing data. But the more pressing governance challenge is agentic AI - systems that do not merely generate content, but set objectives, plan and execute multi-step tasks with limited human intervention.
In a public sector setting, this might mean an AI agent autonomously processing an application, sending correspondence or interacting with external systems and the legal and contractual implications are significant. In future, supplier contracts will need to define clearly how and when such tools can be used in the performance of services. Employment policies will need to address the boundaries of delegated AI-driven decision-making. Without that framework, neither the authority nor its officers will have clarity on where accountability sits.
From an employment law perspective, the risks cluster in two areas. Firstly, where employees use AI tools in ways that breach data protection obligations or confidentiality duties, disciplinary questions arise but so too does the employer's own liability if it has failed to provide adequate policy guidance or training. An employer cannot readily rely on a rule it never communicated.
Second, there is a growing risk of over-reliance on AI in people management decisions. Recruitment tools, performance assessment platforms and absence management systems are increasingly AI-assisted. Where those tools produce decisions (or recommendations treated as decisions) on hiring, promotion or dismissal, the risk of rigid, undifferentiated outcomes increases. AI cannot currently replicate the contextual judgement a human line manager brings to complex employment situations. Tribunal claims for unfair dismissal or discrimination become more likely where AI-generated outputs have been applied without appropriate scrutiny.
What organisations should be doing now
The legislative backdrop is tightening. The Cyber Security and Resilience (Network and Information Systems) Bill - the most significant reform of the UK's cybersecurity framework since 2018 - is currently progressing through Parliament and will impose new obligations on many public sector bodies.
Proactive risk management also requires public bodies to take several practical steps now. Existing IT acceptable use policies and data protection policies should be reviewed and updated to address AI specifically, including the distinction between approved and unapproved tools. Data protection impact assessments should be conducted where AI is being used to process personal data. Employees - not just senior officers - need access to practical training that helps them understand what they can and cannot do, and why.
Contract managers should audit supplier agreements to identify where AI use is already contemplated, permitted or prohibited. Legal teams advising on procurement should ensure new contracts address AI governance expressly, particularly where agentic AI capabilities are in scope.
The challenge for the public sector is not unique but the accountability framework within they operate - the duty to act lawfully, to protect individuals' data, and to make fair and transparent decisions - makes it particularly acute. Shadow AI is not a problem that can be managed by ignoring it.
Declan Goodwin is a commercial partner at Clarke Willmott LLP, specialising in commercial contracts, intellectual property and data protection. Frederick Lambert is a solicitor in the firm's employment team.
