Shadow AI and Client Risk

Your clients did not wait for you.

Someone in accounting pasted a vendor contract into a free chatbot to get a summary. A sales rep bought a Copilot seat on a personal card and expensed it. A meeting note taker joined the leadership call and nobody knows where the transcript went. The office manager uploaded the employee roster to a scheduling tool that trains on customer data.

None of that ran through you. All of it lands on you when something goes wrong.

That is the position most 10 to 20 person MSPs sit in right now. You have no visibility into what AI tools live inside your client base, no policy governing them, and no line item on the invoice for the work of controlling them. You carry the risk without the revenue.

This guide fixes both halves. First you get your own house in order, because you cannot sell governance you do not practice. Then you turn the same work into a service your clients pay for.

Much of the framework here comes from the GTIA Data and AI Guidebook, "The Future is Data-Driven: A Board-Level Blueprint for AI Success," produced by the GTIA UK and Ireland Community. It is a good document. It also assumes you have a board, a data lake, and an MLOps engineer. You have 15 people and a service manager wearing four hats. So this is that framework, translated.

Why the enterprise playbook does not fit you

Read any board-level AI guide and you will find the same recommendations. Invest in unified data platforms. Establish an AI ethics review committee. Hire data scientists, data engineers, and governance leads. Build a skills matrix rating proficiency from one to five.

You are not doing any of that. Neither are your clients. A 60 person manufacturer in your portfolio has no data lake and never will.

Strip the enterprise scaffolding away and three things survive translation. They are the same three things that matter whether you run 40 seats or 40,000.

Know what data you have and how sensitive it is.

Control who and what can reach it.

Log what happens so you can prove it later.

That is governance. Everything else in those guides is tooling built on top of those three ideas. You can do all three with the stack you already own.

The guidebook's own closing advice says it plainly. Start small. Audit one system, clean one dataset, secure one integration. That advice works at your size better than it works at enterprise size.

Part one: get your own house in order

Start with your business, not your clients. Two reasons.

You will find things that scare you, and it is better to find them in your own shop than in a client's compliance audit. And your first client conversation goes much better when you can say "we did this ourselves in March, here is what we found."

Your own exposure is worse than your clients'

Think about what sits inside your systems.

Your documentation platform holds credentials, network diagrams, and admin passwords for every client you serve. Your PSA holds ticket histories describing exactly how each client's environment is configured and where it is weak. Your RMM has agent-level access to every endpoint under contract. Your email archive contains client contracts, security assessments, and incident reports.

Now consider that most of those platforms shipped AI features in the last 18 months. Ticket summarization. Documentation search. Automated response drafting. Some of it runs locally against your tenant. Some of it sends data to a third party model provider. Vendors do not always make the difference obvious in the release notes.

A breach at a 30 person manufacturer is bad. A breach at their MSP is 200 companies at once. Threat actors know this. So do regulators, and so do the cyber insurance carriers who have started asking about AI use on renewal questionnaires.

Shadow AI discovery checklist

Run this against your own environment first. Give it a week. Then run the same list against each client during onboarding or a scheduled review.

Identity and app layer

• Pull the list of OAuth applications and enterprise apps consented to in Microsoft Entra or Google Workspace. Look for anything with AI, GPT, Copilot, assistant, transcribe, or summarize in the name.
• Check which of those apps have delegated permissions to read mail, files, or calendars.
• Review who has permission to consent to new apps. Turn off user consent if it is still on.
• List every browser extension deployed or self installed across managed endpoints.

Spend and procurement

• Ask finance for 12 months of card statements and filter for software under $100 per month. Shadow tools hide in small recurring charges.
• Check for personal card reimbursements tagged as software or subscriptions.
• Review your own vendor list for AI features you enabled and forgot about.

Meetings and communication

• Identify every note taker bot that has joined a meeting in the last 90 days. Most platforms log the participant.
• Check whether external note takers can join meetings without a host prompt.
• Look at where transcripts land and who they get shared with automatically.

Platform features you already own

• List every AI feature turned on inside your PSA, RMM, documentation platform, and email security tool.
• For each one, find the answer to a single question. Does this send data outside our tenant, and to whom.
• Check whether your Microsoft 365 tenant has Copilot enabled, and if so, what files a normal user can surface through it.

Data exposure

• Run a sharing report on your file storage. Look for anything shared with "anyone with the link."
• Identify how many files sit in locations every employee can read.
• Find your client credential and documentation stores and confirm who has access.

That last group matters more than people expect. Copilot and similar tools inherit the permissions of the person using them. They do not create new access. They surface access that was already too broad and nobody noticed because search was bad. Turn on a capable assistant in a tenant with sloppy permissions and an intern finds the payroll spreadsheet in four seconds. The AI did not cause that problem. It just ended the era of security through poor search.

Fix permissions before you deploy assistants. In that order, every time.

Internal AI use policy starter

You do not need 14 pages. You need one page people read. Cover these seven points and you have a real policy. The full two page template with copy-paste language sits on the AI policy page.

1. Approved tools. Name the specific tools and tiers people can use. "ChatGPT Team" is a policy. "AI tools" is not. Everything not on the list requires approval.

2. Data classification tiers. Three, not seven. Public means anything already on your website. Internal means anything about your business you would not publish. Restricted means client data, credentials, employee records, and anything covered by a regulation. Restricted data never touches a tool outside the approved list.

3. The credentials rule. No passwords, API keys, certificates, or connection strings go into any AI tool, approved or not. No exceptions, no matter how convenient.

4. Client data rule. State the specific condition under which client data can enter an approved tool. Most MSPs land on this: only in tools covered by your client agreements, and only in tiers with a data processing agreement in place.

5. Human review. Any AI output that reaches a client, a contract, or a configuration change gets reviewed by a person before it ships. Name who reviews what.

6. Disclosure. Employees tell you when they want a new tool. Make the request path easy, a Slack channel or a form, or they will route around you. That is how shadow AI started.

7. Consequences and review. State what happens when someone breaks the policy. Set a review date every six months, because this space moves.

Get everyone to sign it. Store the signed copies. When a client asks how you govern AI internally, you hand them the policy and the signed acknowledgments. That single artifact closes more governance deals than any slide deck.

Part two: what actually matters technically

Here is the guidebook's data architecture and governance chapter, rewritten for a company without a data engineering team.

Classification

Tag data by sensitivity using the three tiers above. Apply them in the tools you already own. Microsoft Purview sensitivity labels cover most of your client base. Start with the two labels that matter, Internal and Restricted, and expand later. A classification scheme nobody applies is worth nothing.

Access control

Least privilege is not new advice. AI makes it urgent. Every over-permissioned account becomes an over-permissioned assistant the moment a copilot license gets assigned.

Assign an owner to every data store. Someone is accountable for who can reach it. Review access quarterly and immediately after anyone leaves. Kill standing admin rights in favor of just-in-time elevation where your stack supports it.

Logging and audit

You need to answer three questions after an incident. What data did the tool touch. Who prompted it. When. If your current configuration cannot answer those, fix it before you expand AI use. Retain the logs long enough to satisfy your longest client contract or regulation, whichever runs longer.

Contracts

This is where most MSPs are exposed and do not know it.

Your MSA probably says nothing about AI. Your clients' MSAs with their own customers probably say nothing either. Meanwhile you have subprocessors you never disclosed, because your PSA vendor added an AI feature that routes data to a model provider.

Three fixes. Add AI use terms to your MSA covering what tools you use, what data they touch, and what the client consents to. Maintain a current subprocessor list and update it when vendors ship features. Get data processing agreements in place with every vendor handling client data.

Compliance, specifically

HIPAA. A business associate agreement is required for any service handling protected health information. Consumer tiers of the major AI tools do not come with one. Enterprise and API tiers often do, but you have to request it and execute it. A nurse pasting patient notes into a free chatbot is a reportable event. If you serve medical, dental, behavioral health, or any covered entity, verify this before anything else.

SOC 2. Your auditor will ask about AI tools in the next cycle. Vendor management, change management, and access review controls all touch AI use. Get the tool inventory and policy done before the audit, not during it.

CMMC. If any client touches controlled unclassified information under a DoD contract, treat this as the highest risk item in your portfolio. CUI entering an unauthorized cloud service is a serious problem. Most commercial AI services are not authorized environments for CUI. Microsoft 365 GCC High and the government cloud offerings handle this differently than commercial tenants. Know which tenant each client runs in before you enable anything.

State privacy laws. Nearly 20 states now have comprehensive consumer privacy laws on the books, and the count keeps climbing. California, Colorado, Connecticut, Virginia, Texas, and Oregon lead, and each has its own requirements around automated decision making, consumer rights, and data processing agreements. Your clients with customers in multiple states are subject to several at once. Most do not know it.

You do not need to become a privacy attorney. You need to know enough to raise the flag and refer.

Part three: turn it into revenue

Everything above is work. Right now most MSPs do that work for free, badly, and only after something breaks. Here is how to charge for it.

The QBR conversation

Do not lead with AI. Lead with what you found.

Open by naming the finding.

"I ran a discovery on your tenant last week. I found 14 AI tools connected to your Microsoft account. Six of them can read email. Two can read files. Nobody on your team approved any of them."

Pause there. Let it land. Do not fill the silence.

Then connect it to something they already care about.

"Three of those tools have access to the folder where you keep employee records. If a regulator asks how you control access to that data, right now the answer is that you don't."

Ask a question instead of pitching.

"Do you know which of your people are using these, and what they are putting into them?"

They will not know. That is the point. Nobody knows.

Then make it easy.

"Most companies your size are in the same spot. This is not a failure on your part, the tools showed up faster than anyone could track them. I put together a way to get visibility and set some rules. It takes about three weeks. Want me to walk you through it?"

Three things make this work. You brought evidence from their actual environment instead of a generic warning. You tied it to a consequence they understand. You gave them a way out that does not require them to admit incompetence.

A generic AI risk email gets deleted. A list of 14 apps in their tenant gets a meeting.

Packaging and pricing the offer

Structure it in three layers.

Layer one, the assessment. A fixed fee project, banded by seat count, $3,500 to $8,000 depending on client size and complexity. Deliverables are the tool inventory, a permissions and sharing exposure report, a compliance gap summary against whatever framework applies to them, and a prioritized remediation plan. Sell this as a standalone. Do not give it away. A free assessment gets treated like a free assessment.

Layer two, remediation. Project work priced off the assessment findings, normally $5,000 to $15,000. Permission cleanup, sharing remediation, tenant configuration, policy development, and rollout of an approved toolset. This scopes differently for every client, which is exactly why the assessment comes first.

Layer three, ongoing governance. This is the part that changes your business. Monthly or per seat recurring covering quarterly access reviews, a monthly new-tool discovery scan, policy maintenance, an updated subprocessor list, user training refreshes, and an annual compliance readiness report. Somewhere between $8 and $20 per seat per month depending on regulatory burden, or a flat monthly fee for smaller clients.

Four things to get right.

Price the assessment so it stands on its own. If it only exists to sell remediation, clients feel the setup and trust drops.

Put governance in the recurring agreement, not the project bucket. Governance is not a project. Access drifts, staff turn over, vendors ship new features. That is recurring work and it deserves recurring revenue.

Charge more where regulation bites. A dental practice under HIPAA and a defense supplier under CMMC carry more risk and more work than a landscaping company. Your pricing should say so.

Sell the artifact, not the activity. Clients do not buy quarterly access reviews. They buy the annual report they hand their insurance carrier, their auditor, or their biggest customer's security questionnaire. Name the deliverable.

Your next 30 days

Week one. Run the shadow AI discovery checklist against your own environment. Write down what you find, including the uncomfortable parts.

Week two. Buy company accounts for anyone still on a personal login, then draft your internal AI use policy using the seven points above. Keep it to one page. Get it signed.

Week three. Fix your own permissions. Sharing report, stale accounts, over-broad folders, standing admin rights. This is the unglamorous work that makes everything else safe.

Week four. Pick three clients. Choose the ones with the most regulatory exposure or the most to lose. Run discovery on their tenants. Bring the findings to the next scheduled conversation.

By day 30 you have a policy, a cleaner environment, evidence from three client tenants, and three real conversations started. That is a service line with a pipeline behind it.

The part nobody says out loud

AI did not create a new category of risk. It made an old one impossible to ignore.

Permissions were always too broad. Data was always classified badly or not at all. Nobody ever knew which SaaS tools staff had signed up for. Those problems sat quietly for years because finding anything was hard.

Assistants ended that. They search everything a user can reach and return it instantly. Every access control mistake you never cleaned up is now one prompt away from being discovered by the wrong person.

Which means the work in front of you is not exotic. It is the fundamental work you have known about for years, now with a deadline and a reason clients will pay for it.

That is the opportunity. Your clients suddenly care about something you already know how to do.

Talk it through

Discovery and policy you can run yourself starting Monday. The harder question is the business side. What to charge, how to attach governance to existing agreements without a renegotiation fight, how to protect margin as you add delivery hours, and which clients to lead with.

Everything above is a template. Run it yourself this week and never talk to me. What I will not do is hand you a system and tell you your shop is wrong for not matching it.

Not sure this is your actual constraint? Take the MSP Owner Reality Check. Five questions, nine minutes, and it names the two or three things quietly capping your growth. https://themsphero.com/resources/msp-owner-reality-check-assessment

If you already know what is broken, book a 30 minute fit call at https://letschat.themsphero.com

Mike Kolb The MSP Hero

Source credit: The framework in this guide adapts material from the GTIA Data and AI Guidebook, "The Future is Data-Driven: A Board-Level Blueprint for AI Success," published by the Global Technology Industry Association and produced by the GTIA UK and Ireland Community. Compliance guidance, pricing structures, checklists, and the small MSP translation are original to The MSP Hero. Nothing here is legal advice. Talk to counsel about your specific regulatory obligations.