A ban can define an important boundary, but it cannot by itself remove the work that led staff to seek an AI tool. Where demand remains unresolved, use may stop, move elsewhere or become less visible. Those are possibilities to investigate, not an assumption that every restrictive NHS policy produces hidden use.
This article is dated 10 October 2026 and concerns organisational practice in England. The GMC's February 2025 research account describes doctors using both workplace systems and tools they had selected themselves. Its qualitative findings are useful context, not a prevalence estimate for unapproved NHS AI use.
Define shadow AI by the task, not just the brand
An unapproved personal account processing a patient letter is a different situation from a clinician asking a general educational question without patient information. The software might be identical, but the data, intended action and organisational exposure are not.
A workable policy should say which combination of tool, account, task and information is permitted. "This brand is approved" is too broad when different products under the same name have different terms or capabilities. "AI is banned" may be too imprecise when staff cannot tell whether it includes ordinary search, transcription built into another system or a personal revision tool.
Shadow use also need not be deliberate rule-breaking. A staff member may reasonably but incorrectly believe that an institution's subscription approves every feature. An update that adds document upload or an optional browser extension can create a new workflow without a new purchasing decision. Clear instructions should anticipate those misunderstandings.
Follow the need that the unofficial tool is meeting
Consider a fictional junior doctor who repeatedly spends time turning discharge information into a patient-friendly explanation. The organisation prohibits external AI processing of patient data, but its approved systems do not offer an equivalent drafting function.
The unsafe response would be to upload the discharge letter through a personal account and remove only the patient's name. The useful organisational response is not to excuse that upload. It is to understand the unmet task and identify a lawful, clinically appropriate alternative, whether that is an approved template, better existing software or an assessed AI workflow.
Ask staff what they are trying to accomplish, how often the need arises, what information they think the tool requires and which part of the task is genuinely difficult. These questions can expose unnecessary manual work without making unapproved processing acceptable. They also prevent procurement from starting with a favoured product rather than a defined problem.
Separate knowledge seeking from patient-data processing
A fictional clinician asking "What does current UK guidance say about follow-up after this type of investigation?" may be able to formulate a general question without disclosing a real patient's circumstances. That does not authorise transferring the investigation report, consultation transcript or distinctive history into an unrelated service.
The ICO's data-minimisation guidance, checked on 10 October 2026, supports limiting personal information to what is necessary for the purpose. It does not say that removing names makes every clinical narrative anonymous. Where the task genuinely requires identifiable information, use an approved pathway rather than disguising a patient record as an educational prompt.
For clinical decisions, a second boundary remains even when no personal data are entered: an answer still needs source and applicability checks. Privacy-safe input does not establish clinically reliable output. Conversely, a useful answer does not retrospectively justify an unauthorised disclosure.
Write a policy that staff can use during work
A proposed task-based policy should make the main routes visible rather than require staff to interpret a long legal document every time they open a browser.
| Task | Proposed policy approach | What still needs checking |
|---|---|---|
| Personal revision with fictional cases | Specify permitted tools and account conditions | Accuracy, appropriate sources and learning purpose |
| General clinical reference question | Define approved reference workflows | Jurisdiction, source support and local applicability |
| Summarising an identifiable patient letter | Require an assessed organisational service | Processing arrangements, review and record handling |
| Recording a consultation | Require the approved recording workflow | Patient information, dissent and output verification |
| Sending messages or changing records | Authorise the exact action and permissions | Identity, destination, clinical approval and completion |
This is an illustrative policy structure, not a declaration that every organisation must permit the first two categories. Local restrictions may be justified. The important point is that a staff member should know which rule applies and where to obtain an answer when the task is ambiguous.
Make the approval route proportionate and visible
A request form can be short while still asking the important questions: what problem needs solving, what information would be processed, what output would be used, what could happen if it were wrong and which existing alternatives have been considered.
Then provide a named route for triage. A general learning request should not automatically enter the same assessment process as a service that writes to patient records. A consequential new deployment should not bypass scrutiny merely because it is inexpensive or easy to install.
Publish the status of requests in a way that does not expose sensitive information. Staff should be able to see whether a need is being assessed, declined with reasons or addressed through another option. An unexplained silence creates uncertainty; it does not communicate a usable safety boundary.
Respond to disclosure without confusing learning with immunity
An organisation benefits from learning where unapproved use has occurred, but should not promise blanket immunity from every consequence. The response depends on the information involved, possible harm, intent and applicable procedures.
A practical first response is to stop further inappropriate processing, preserve relevant evidence through approved channels and involve information governance where needed. Do not instruct staff to delete everything before the facts have been assessed, or to send screenshots containing patient data to a personal email account. ICO breach guidance provides the reporting framework where a personal-data breach may have occurred; not every policy breach is automatically a reportable data breach.
The longer-term review should ask whether confusing instructions, unavailable alternatives or an unrecognised workflow contributed. A focus solely on the individual may leave the same conditions in place for the next person.
Apply the same boundary to iatroX
Clinical reference should not become the unapproved alternative to an unavailable records tool. For iatroX, distinguish the general knowledge question from the patient-data task and check the current privacy policy against that intended use. Specialist branding is not an organisational approval decision.
A sensible reference workflow is to ask the general clinical question, inspect the relevant source and apply it within the approved clinical environment. That offers a practical alternative for some knowledge needs. It does not replace organisational approval for patient-data processing, nor solve every documentation or workflow problem that gives rise to shadow AI.
Frequently asked questions
Does shadow AI always involve patient information?
No; the term can include unapproved tools used for personal administration or learning. The governance response should consider the actual task, information and consequences rather than assume every use is identical.
Is removing the patient's name enough to use a personal AI account?
No; indirect details can still identify someone, and pseudonymised information may remain personal data. Use an approved pathway when the task requires patient information.
Should staff report previous unapproved use?
They should follow organisational incident and information-governance procedures, particularly where patient information or care may be affected. The organisation should make that route clear and assess the circumstances fairly.