Subtitle: Why up to 27% of Australian workers are using unauthorised AI tools and what business leaders must do about it
Publication Date: 23 October 2025
Reading Time: 8 minutes
In Summary
Shadow AI (unauthorised employee use of AI tools) has emerged as the most pressing cybersecurity challenge for Australian organisations in 2025. The federal government's "Our Gen AI Transition" report reveals that between 21-27% of Australian workers, particularly in white-collar industries, use AI without their employer's knowledge. Josys's Shadow AI Report 2025 found that over a third (36%) of Australian professionals regularly upload sensitive company data including strategic plans (44%), financials (34%) and customer PII (24%) to AI platforms.
With Australia's Privacy Act amendments now in force, penalties for serious privacy breaches reach up to $50 million for corporations. A new statutory tort for serious invasions of privacy commenced on 10 June 2025, enabling individuals to sue directly for damages. Australian organisations cannot rely on outright bans as shadow AI merely goes underground. Business leaders must implement detection strategies, risk management frameworks, and practical enforcement that enables innovation whilst protecting data and maintaining compliance with Australian privacy law.
The Current Landscape
What's Happening
The Australian federal government's comprehensive "Our Gen AI Transition: Implications for Work and Skills" report reveals a critical challenge: between 21-27% of Australian workers, particularly in white-collar sectors, are using generative AI tools without employer approval. A 2025 Mandarin survey found 25% of Australian public servants already using unauthorised AI tools, with this figure even higher among younger, tech-savvy workers.
The Jobs and Skills Australia report describes these shadow AI users as sometimes "hidden leaders, driving bottom-up innovation in some sectors." One Queensland public servant quoted in the report said using AI allowed them to "do three people's jobs" by automating low-value tasks like formatting reports or drafting meeting terms of reference.
Josys's Shadow AI Report 2025, surveying 500 Australian technology decision makers across sectors and company sizes, reveals alarming data exposure:
- 36% of Australian professionals regularly upload sensitive company data to AI platforms
- Strategic plans (44% of those uploading sensitive data)
- Technical data (40%)
- Financials (34%)
- Internal communications (28%)
- Customer personally identifiable information (24%)
- Intellectual property and legal/compliance documents (18%)
Sector-specific risks are pronounced. Sales and marketing teams lead with 37% uploading sensitive data, followed by finance and IT/telecoms (36%) and healthcare (31%). "Shadow AI is no longer a fringe issue. It's a looming full-scale governance failure unfolding in real time across Australian workplaces," said Jun Yokote, COO and President of Josys International.
Yet Australian organisations are unprepared. Only one in three (33%) are fully prepared to assess AI risks, with nearly 20% not prepared at all. Additionally, 63% of professionals lack confidence in using AI securely, exposing a major readiness gap.
Employees cite several reasons for hiding AI usage: feeling that using AI is "cheating" (common response), fear of being seen as "lazy," and fear of being seen as "less competent." The simplicity and accessibility of web based tools in personal life, combined with their speed and intuitive interfaces compared to official systems, drives this underground adoption.
Why It Matters Now for Australian Organisations
Three converging factors make this critical for Australian organisations: enhanced regulatory penalties, direct litigation exposure, and fragmented governance across jurisdictions.
Australian Privacy Act Reforms Create Severe Financial Exposure
The Privacy and Other Legislation Amendment Act 2024, passed in November 2024 with most provisions commencing in December 2024, has fundamentally changed the risk landscape:
- Top-tier penalties: Up to $50 million for corporations (or three times the value of benefit obtained, or 30% of adjusted turnover during the breach period)
- Mid-tier penalties: Up to $3.13 million for interferences with privacy
- Low-tier penalties: Up to $313,000 for non-compliances
- Infringement notices: OAIC can now issue direct penalties up to $62,600 for minor breaches like non-compliant privacy policies
The Office of the Australian Information Commissioner (OAIC) now has enhanced enforcement powers including infringement notices, compliance notices, and expanded investigation capabilities. Australian Privacy Commissioner Carly Kind noted that 2025 is going to be a "big year for privacy" accompanied by a "big year of enforcement action."
New Statutory Tort Creates Direct Litigation Risk
Commencing on 10 June 2025, the new statutory tort for serious invasions of privacy provides individuals with a direct legal avenue to sue for damages. Critically:
- Individuals can seek up to $2.5 million for serious invasions
- No need to prove financial loss (unlike previous causes of action)
- Opens door to both individual claims and class action risk
- Operates independently of Privacy Act, covering entities not normally regulated (individuals, small businesses)
- Requires proof of intentional or reckless conduct
This tort particularly threatens organisations experiencing data breaches through shadow AI, especially where system weaknesses were known or obvious.
Fragmented State/Territory AI Governance
As legal researchers have noted, there are jobs in Australia where the rules for using AI at work change as soon as you cross a state border. Without a national AI governance policy, Australian employers navigate a fragmented and inconsistent regulatory minefield. The Jobs and Skills Australia report calls for "national stewardship of Australia's Gen AI transition through a coordinated national framework," highlighting the absence of clear guidance.
Meanwhile, employees who could drive AI transformation are using tools in secret, fearing judgment as "lazy cheats," whilst organisations court privacy breaches at every turn. The Australian government is backing away from prescriptive AI regulation plans, leaving enterprises to develop their own frameworks.
Technical Deep Dive
The Technology Behind the Headlines
Shadow AI encompasses unauthorised AI tool use without IT oversight. Unlike conventional Shadow IT, Shadow AI introduces self-learning models that process and potentially retain corporate data.
Large Language Models analyse input prompts and generate responses based on training data. When Australian employees paste proprietary code, customer information, or strategic plans into these systems, they expose data to external platforms with unclear data handling practices that may not comply with Australian privacy law requirements.
Shadow AI manifests in several ways: browser-based usage, embedded AI model imports in code, external API calls, machine learning libraries for custom models, or on-premises AI agents using frameworks like LangChain. Each creates different security challenges that conventional tools struggle to detect.
Australian organisations face particular visibility challenges. IT Brief Australia reports that a Netskope research study found over half of all AI application adoption is now estimated to fall under the shadow AI category. These unsanctioned applications operate beyond IT control, raising concerns about uncontrolled access to sensitive data.
Key Technical Considerations for Australian Organisations
Cross-Border Data Transfers and Australian Privacy Principles
The most significant risk for Australian organisations stems from unmanaged personal account usage. When employees upload customer data to personal AI accounts, that data may be processed on overseas servers, potentially violating:
- Australian Privacy Principle (APP) 8 requirements for cross-border disclosure of personal information
- Contractual obligations around data residency
- Sector-specific requirements (e.g., financial services, healthcare)
The Privacy Act amendments clarify that entities' obligations under APP 11 include taking "technical and organisational measures" to protect personal information. Shadow AI usage through personal accounts lacks these measures entirely.
Data Retention and Model Training Risks
Once data leaves Australian organisational infrastructure via personal AI accounts, control is lost. Organisations cannot:
- Comply with APP 11 requirements to destroy or de-identify information no longer needed
- Respond to individual requests for deletion under enhanced "right to be forgotten" provisions
- Audit access or verify data handling in breach investigations
This creates particular exposure under the new statutory tort, where reckless data handling could support serious invasion of privacy claims.
Emerging On-Premises AI Agent Risks
Netskope's research found 34% of organisations using large language model interfaces locally, with Ollama showing highest adoption. Additionally, 67% of organisations have users downloading from AI marketplaces like Hugging Face, suggesting widespread experimentation. GitHub Copilot is now used in 39% of organisations, with 5.5% deploying on-premises agents built from popular frameworks.
On-premises AI agents pose significant shadow AI risks because they are highly accessible, often have access to sensitive data, and can execute code autonomously. For Australian organisations, this creates compounding risks where shadow AI operates entirely off corporate networks whilst accessing production data.
Business Implications for Australian Organisations
Strategic Impact
Shadow AI fundamentally challenges traditional IT governance in the Australian context. The Jobs and Skills Australia report acknowledges that "worker-led 'shadow use' is an important part of adoption to date," with "grassroots enthusiasm" driving innovation. However, it warns: "In the absence of clear governance, shadow use may proliferate. This informal experimentation, while a source of innovation, can also fragment practices that are hard to scale or integrate later."
The strategic challenge for Australian organisations isn't whether to embrace AI (employees have already decided) but how to regain control whilst maintaining competitive advantage in the absence of clear national guidance.
Forward-thinking Australian organisations reframe shadow AI as a governance challenge. However, most organisations struggle with implementation. Insentra's research (published February 2025) notes that shadow AI typically emerges due to lack of awareness about risks, easy accessibility of SaaS AI platforms, and employee need to fulfil specific actions quickly.
The competitive dimension is clear: employees using AI to boost productivity report significant time savings. The challenge is channelling this innovation within safe guardrails before regulatory enforcement action materialises.
Regulatory and Financial Impact Specific to Australia
Privacy Act Penalties and Enforcement
Australian organisations face a tiered penalty structure under the amended Privacy Act:
- Serious interference: Up to $50 million for corporations
- Mid-tier breaches: Up to $3.13 million per contravention
- Low-tier violations: Up to $313,000 per breach
- Administrative failures: Up to $62,600 infringement notices for non-compliant privacy policies
The OAIC's enhanced powers mean Australian organisations can no longer rely on protracted litigation timelines. Infringement notices can be issued directly for specified breaches, creating immediate financial exposure.
Statutory Tort Litigation Exposure
The new tort (commenced 10 June 2025) creates unprecedented direct litigation risk for Australian organisations. Key exposures include:
- Individual claims up to $2.5 million for serious invasions
- No proof of loss required (unlike breach of confidence claims)
- Class action potential for data breaches affecting multiple individuals
- Coverage of "reckless" conduct (not just intentional breaches)
Australian organisations experiencing data breaches through shadow AI face particular vulnerability where:
- Known system weaknesses existed
- Employees repeatedly warned about shadow AI risks
- Technical controls were available but not implemented
- Privacy impact assessments weren't conducted
Sector-Specific Considerations
Healthcare organisations face heightened risks given 31% of healthcare workers upload sensitive data via shadow AI. Under state-based health privacy frameworks (NSW, Victoria, Queensland, ACT all have health-specific privacy legislation) plus Commonwealth requirements, shadow AI usage could trigger breaches across multiple jurisdictions simultaneously.
Financial services organisations (36% of finance workers upload sensitive data) must consider APRA's Prudential Standard CPS 234 Information Security requirements alongside Privacy Act obligations. Shadow AI usage that compromises information security could trigger both privacy and prudential breaches.
Expert Opinion & Analysis
My Take: The Australian Context
Prohibition strategies are fundamentally flawed for Australian organisations. The Jobs and Skills Australia report explicitly acknowledges shadow AI users are "driving bottom-up innovation," revealing these employees have found productivity solutions faster than IT departments can provide.
When 25% of Australian public servants use unauthorised AI tools, and one admits to doing "three people's jobs" with AI assistance, the message is clear: approved solutions either don't exist or don't meet needs. The Queensland public servant's admission reveals the core problem: employees choose efficiency over compliance when no practical alternatives exist.
The path forward for Australian organisations requires three parallel efforts: implement detection and monitoring for visibility; establish lightweight governance (not the "lengthy approval process" one employee complained about avoiding); and invest in sanctioned alternatives that genuinely compete with ChatGPT and similar tools.
Australian organisations face unique challenges given fragmented state/territory regulation and absence of clear national AI governance policy. As University of Melbourne Research Fellow Dr Guzyal Hill notes, some jobs have rules for using AI at work that "change as soon as you cross a state border within Australia." This creates compliance complexity that prohibition approaches cannot solve.
The historical parallel is clear: early cloud adoption saw employees using consumer file-sharing despite IT prohibitions. Australian organisations that responded with bans found themselves at competitive disadvantages. Those providing secure alternatives with reasonable governance succeeded. Shadow AI follows the same trajectory.
What Australian Leaders Should Watch
OAIC Enforcement Patterns: Australian Privacy Commissioner Carly Kind has signalled 2025 will bring increased enforcement. Watch the OAIC's approach to shadow AI-related breaches in early enforcement actions. Recent cases like the Grubisa companies investigation (November 2024) and Bunnings matter show the OAIC is actively pursuing privacy failures. Shadow AI creating data breaches will likely attract similar scrutiny.
Statutory Tort Litigation: Monitor early cases under the new tort (commenced 10 June 2025) to understand judicial interpretation of "serious invasion," "reckless conduct," and damages assessment. Early precedents will define the landscape for shadow AI-related litigation risk.
State/Territory Regulatory Divergence: Track whether states and territories introduce AI-specific requirements (particularly in healthcare, education, and government sectors) that create additional compliance complexity. The absence of national coordination means organisations may face increasing jurisdictional fragmentation.
Children's Online Privacy Code Development: OAIC is developing a Children's Online Privacy Code, with age-specific worksheets released in May 2025 and an Issues Paper in June 2025. Public consultation expected in 2026. Australian organisations serving children must monitor this development, as shadow AI usage could violate Code requirements once enacted.
Automated Decision-Making Disclosure Requirements: Privacy policy disclosures about AI-based automated decision-making commence 10 December 2026. Australian organisations should prepare now, as shadow AI complicates ability to disclose and explain AI usage in decision-making processes.
Actionable Insights for Australian Organisations:
These suggestions should be used as a guide only:
Immediate Actions (Next 30 Days)
Conduct Australian Privacy Act Compliance Assessment: Review current shadow AI exposure against new Privacy Act requirements. Identify gaps in APP 11 "technical and organisational measures" for protecting personal information. Assess statutory tort risk where system weaknesses are known. Expected outcome: Documented compliance gaps, priority remediation list, and initial risk quantification for board reporting.
Establish Cross-Functional AI Governance Working Group: Form team with IT security, legal (including privacy specialist familiar with 2024 amendments), HR, and business units. Define mandate including Privacy Act compliance, statutory tort risk mitigation, and state/territory regulatory mapping. Expected outcome: Functioning working group with executive sponsorship, 90-day roadmap, and board-level visibility.
Implement Interim Risk Mitigation Aligned with Australian Requirements: Deploy data loss prevention rules targeting known AI platforms. Establish browser monitoring that logs AI tool usage (ensuring monitoring complies with workplace surveillance laws in relevant states). Create emergency response procedure for suspected data exposure that aligns with notifiable data breach scheme requirements. Expected outcome: Reduced Privacy Act breach risk during governance development, visibility into high-risk shadow AI usage patterns.
Medium-term Strategy (3-6 Months)
Deploy Enterprise AI Alternatives with Australian Data Residency: Procure sanctioned tools with Australian data centre options or on-premises deployment. Josys's report shows employees want tools for drafting reports, presentations, and communications. Provide approved alternatives meeting these needs whilst ensuring APP 8 cross-border disclosure compliance. Key metrics: Adoption rates of sanctioned tools, reduced traffic to unapproved platforms, employee satisfaction, Australian data residency confirmation.
Develop Privacy Act-Compliant AI Usage Policies: Create formal policies defining acceptable usage, classifying tools by risk (approved, limited-use, prohibited), specifying data handling requirements aligned with APPs, and establishing consequences. Implement mandatory training covering Privacy Act obligations, statutory tort risks, and state/territory requirements where applicable. Address automated decision-making disclosure requirements (effective December 2026). Key metrics: Policy acknowledgment completion, reduction in ambiguous usage scenarios, decreased approval time for new tools.
Implement Continuous AI Monitoring and DLP: Deploy solutions providing visibility into AI usage, enforcing data protection in real-time, and integrating with SIEM systems. Australian organisations should prioritise solutions detecting cross-border data transfers to AI platforms. Consider solutions like those mentioned in IT Brief Australia's reporting on Netskope's capabilities for shadow AI detection. Key metrics: Percentage of AI interactions with visibility, time-to-detect new unauthorised tools, false positive rates on data exposure alerts, cross-border transfer detection accuracy.
Long-term Considerations (12+ Months)
Establish AI Innovation Sandboxes with Australian Data Controls: Create secure environments for experimentation using synthetic datasets that mirror real business data. Ensure sandboxes operate within Australian data centres or have explicit controls preventing personal information transfer offshore. Implement automated security scanning for AI-generated code and streamlined processes for promoting successful experiments to production. Impact: Channel innovation into secure environments whilst maintaining Privacy Act compliance. Preparation: Infrastructure investment in Australian-hosted environments, sandbox graduation criteria, governance framework integration.
Develop AI Literacy as Core Competency for Australian Workforce: Move beyond one-time training to ongoing competency development. Cover technical skills (prompt engineering, AI tool selection), ethical and legal considerations (Australian Privacy Principles, statutory tort risks, state/territory variations), and leadership capabilities for managing AI-augmented teams. Include real examples of shadow AI privacy breaches in Australian context. Impact: Employees make better decisions about tool usage, reducing shadow AI appeal and Privacy Act breach risk. Preparation: Partner with learning and development teams, engage Australian privacy law experts, develop competency metrics.
Build Governance Maturity Aligned with Australian Privacy Framework: Progress from informal to optimised governance. Establish formal risk assessment processes for AI tools that consider Privacy Act compliance, statutory tort exposure, and sector-specific requirements. Implement model cards and documentation standards. Create AI ethics review boards for high-risk applications. Develop relationships with OAIC and prepare for potential additional Privacy Act reforms flagged in government's "agreed in principle" proposals. Impact: Mature governance enables faster, compliant decisions and provides defence against enforcement action and statutory tort claims. Preparation: Multi-year commitment to governance as strategic priority, dedicated resources, persistent executive sponsorship, board-level reporting.
The Bottom Line
Shadow AI is the new normal for Australian organisations. With up to 27% of workers using unauthorised tools and 36% of professionals uploading sensitive data, prohibition strategies fail. The Jobs and Skills Australia report explicitly acknowledges shadow AI users are "driving bottom-up innovation" in sectors, revealing the genuine productivity value employees have discovered.
Your immediate priority is twofold: gain visibility into shadow AI usage and ensure Privacy Act compliance. Deploy detection tools, assess employee AI usage honestly, and understand why approved alternatives fall short. From that foundation, build governance balancing innovation with the enhanced regulatory requirements now in force.
With Privacy Act penalties reaching $50 million, statutory tort claims enabling direct litigation, and OAIC enforcement ramping up in 2025, Australian organisations cannot afford delayed action. The window for establishing effective governance whilst maintaining employee trust is narrowing. Start now.
References & Further Reading
Primary Australian Sources
- Our Gen AI Transition: Implications for Work and Skills - Jobs and Skills Australia (Australian Government) - August 2025 - 124-page report finding 21-27% of workers use shadow AI, describes users as "driving bottom-up innovation in some sectors" - https://techxplore.com/news/2025-08-australians-secretly-ai-clearer-shadow.html and https://www.startupdaily.net/topic/artificial-intelligence-machine-learning/a-new-study-reveals-around-a-quarter-of-workers-are-using-shadow-ai-without-their-boss-knowing/
- Shadow AI Report 2025 - Josys (in collaboration with Censuswide) - September 2025 - Survey of 500 Australian technology decision makers showing 36% upload sensitive data, 44% strategic plans, 24% customer PII - https://www.josys.com/news/shadow-ai-report-australia
- Shadow AI: A Second Hidden Risk - Analysis of Jobs and Skills Australia report - September 2025 - Details 25% of Australian public servants using unauthorised AI, Queensland public servant doing "three people's jobs" with AI - https://aitkenblog.com.au/2025/09/08/shadow-ai-a-second-hidden-risk/
- Privacy and Other Legislation Amendment Act 2024 (Cth) - Australian Parliament - November 2024 (Royal Assent 10 December 2024) - Introduces penalties up to $50 million, statutory tort for serious invasions of privacy, OAIC infringement notice powers - Multiple legal firm analyses including Norton Rose Fulbright https://www.nortonrosefulbright.com/en/knowledge/publications/be98b0ff/australian-privacy-alert-parliament-passes-major-and-meaningful-privacy-law-reform
- Australia's New Privacy Law - Wrays IP - June 2025 - Details statutory tort commenced 10 June 2025, penalties up to $2.5 million for individuals, $50 million for corporations - https://wrays.com.au/insights/industry-insights/australias-new-privacy-law/
- Shadow AI surge heightens enterprise security risks - IT Brief Australia - August 2025 - Netskope research showing over half of AI adoption falls under shadow AI category, 34% using local LLM interfaces - https://itbrief.com.au/story/shadow-ai-surge-heightens-enterprise-security-risks-study-finds
- What is Shadow AI and How Do You Prevent It? - Insentra - February 2025 - Australian context on shadow AI emergence, notes 37% of employees share sensitive work information without permission - https://www.insentragroup.com/au/insights/geek-speak/secure-workplace/what-is-shadow-ai-and-how-to-prevent-it/
Additional Australian Resources
Changes to Australian privacy laws now in force - Johnson Winter Slattery - Detailed analysis of Privacy Act amendments including enhanced OAIC powers, tiered penalty structure, and compliance requirements - https://jws.com.au/what-we-think/changes-to-australian-privacy-laws-now-in-force/
New Privacy Laws in Australia - 2025 - Prosper Law - September 2025 - Practical guide for Australian businesses on compliance with reformed Privacy Act, right to deletion, breach notification - https://prosperlaw.com.au/new-privacy-laws-in-australia-2025/
Privacy and AI Regulations: 2024 review & 2025 outlook - Spruson & Ferguson - January 2025 - Review of 2024 changes and outlook for 2025 Australian privacy and AI regulation landscape - https://www.spruson.com/privacy-and-ai-regulations-2024-review-2025-outlook/
Australia's ongoing privacy reforms - Corrs Chambers Westgarth - Analysis of Privacy Act reforms, Children's Online Privacy Code development, connected vehicles issues - https://www.corrs.com.au/insights/australias-ongoing-privacy-reforms-bolstering-australias-privacy-regulatory-framework
Implications of New Privacy Rules on Automated Decision-Making - LegalVision - March 2025 - Covers requirements for AI-based automated decision-making disclosures (effective December 2026), penalties over $50,000 per contravention - https://legalvision.com.au/automated-decision-making-new-privacy-rules/
Upcoming Privacy Changes In Australia 2025 - Sprintlaw - October 2025 - Practical preparation guide for Australian businesses covering consent, data rights, breach response - https://sprintlaw.com.au/articles/upcoming-privacy-changes-australia/
Industry Reports (Including Australian Data)
State of AI in Business 2025 - MIT Project NANDA - August 2025 - Global findings relevant to Australian context on shadow AI delivering better ROI than formal initiatives - https://fortune.com/2025/08/19/shadow-ai-economy-mit-study-genai-divide-llm-chatbots/
Cloud and Threat Report: Shadow AI and Agentic AI 2025 - Netskope - October 2025 - Technical findings on AI agent frameworks, on-premises AI risks, includes Australian enterprise data - https://www.netskope.com/resources/reports-guides/cloud-and-threat-report-shadow-ai-and-agentic-ai-2025
About This Analysis
This analysis draws on Australian government research, privacy law reforms, and deployment data from 2025 to provide Australian business leaders with practical shadow AI management strategies. The focus on Australian regulatory context reflects the unique challenges organisations face with enhanced Privacy Act penalties, the new statutory tort, and fragmented state/territory governance. My background in Python development and Linux systems administration informs the technical aspects whilst my interest in AI governance and Australian privacy law shapes the strategic recommendations. The goal is actionable insights balancing innovation with Australia's enhanced privacy framework.
Keywords: shadow-AI-Australia, Australian-privacy-act-2025, AI-governance-Australia, shadow-AI-detection, unauthorised-AI-usage-Australia, privacy-act-compliance, statutory-tort-privacy, oaic-enforcement, Australian-AI-policy, enterprise-AI-security-Australia
Meta Description: Shadow AI affects up to 27% of Australian workers. Learn detection methods, Privacy Act compliance strategies, and governance frameworks to protect data under Australia's new $50M penalty regime.tart writing here...