Shadow AI in Family Offices: What It Is, Why It Is Already Happening, and How to Govern It

Last updated: October 27, 2026.

Quick Answer

Shadow AI in family offices is the use of AI tools on family or office data without the family office’s knowledge, approval, or controls, most often through personal accounts and free tiers of ChatGPT, Claude, Gemini, Copilot, or another AI assistant. It is already common: 58% of employees use AI at work and 57% hide some of that use from their employer, according to KPMG and the University of Melbourne, and IBM’s 2026 Cost of a Data Breach Report found shadow AI involved in 43% of the breaches it studied, up from 20% a year earlier. A ban moves it out of sight rather than removing it. The family offices that get ahead of shadow AI write a one-page policy and give staff a sanctioned path that is better than the paste, such as an enterprise AI assistant connected to a wealth platform like Aleta through a governed connection like MCP (Model Context Protocol) that inherits each user’s permissions and logs every query.

Key Takeaways

• Shadow AI is AI use that the family office has not approved and cannot see, and it includes the principal’s and the family’s own tools as well as staff accounts.

• 58% of employees use AI at work, 57% hide some of that use, and only 40% say their workplace has a generative AI policy, according to KPMG and the University of Melbourne’s 2025 study of more than 48,000 people in 47 countries.

• Shadow AI was involved in 43% of the breaches in IBM’s 2026 Cost of a Data Breach Report, up from 20% in 2025, at an average cost of $5.39 million, and 68% of breached organizations had no AI governance policy in place.

• 47% of people using generative AI at work do so through personal accounts, down from 78% a year earlier, which is the clearest evidence that an approved path pulls AI use back into view (Netskope, 2026).

• Family offices are more exposed than larger firms because one person often handles investments, accounting, and family matters with no layer of review in between, and because the family itself sits outside any staff policy.

• A written policy plus a governed connection to the wealth platform, such as Aleta’s two-way MCP layer, where the AI assistant inherits each user’s permissions and every query is logged, replaces the ungoverned paste rather than restricting it.

What Is Shadow AI in a Family Office?

Shadow AI is the use of AI tools, models, or AI features inside other software without the organization’s knowledge, approval, or controls. In a family office the definition needs one addition: it covers the principal and the family as well as the staff, because a family member summarizing a trust document in a consumer chatbot is outside any policy the family office has written.

The term descends from shadow IT, the older problem of unapproved hardware and software on a company network. A 2026 academic chapter by Brian Nussbaum and Kimberly Cornell of the University at Albany, Where the Money Is: Shadow AI Risks to Family Offices and the Wealth Management Sector, draws the line this way: shadow IT is unapproved hardware or software, shadow AI is the unsanctioned use of AI models or tools, and family offices carry the risks of any wealth manager plus their own, because of the breadth of tasks they perform and the family focus of the data. The practical difference is that shadow IT usually needs an installation someone could notice. Shadow AI only needs a browser tab.

In a family office shadow AI takes five forms. The first is a personal consumer account, free or paid, that a member of staff opened on their own and uses for work. The second is a subscription bought on a company card without anyone deciding which plan it is, which almost always means the consumer plan. The third is AI that arrives inside software the family office already uses, which Citi’s 2026 report AI in the Family Office calls access “through the back door via SaaS providers or daily devices they already use”: a meeting assistant that transcribes calls, a summarize button in the email client, an AI feature switched on by default in a document tool. The fourth is browser extensions and meeting bots that read whatever is on the screen or in the call. The fifth is the family’s own tools and their advisers’ tools, which handle family information under terms the family office has never seen.

All five share one feature. Nobody in the family office decided the terms under which the data is handled, so nobody knows whether it is retained, whether it is used for training, who at the provider can see it, or how to switch it off.

How Common Is Shadow AI in Family Offices?

Every large survey of workplace AI use since 2024 has found the same shape: most people use AI at work, a large minority hide it, and most organizations have no policy covering it. No survey yet isolates family offices, so the honest answer combines the general figures with the family office adoption data and with what we see in practice.

Table 1. Shadow AI by the numbers

Two readings of the table matter. The first is that the family office adoption figures and the employee figures measure different things. Citi’s 22% and Simple’s 34% count family offices that use AI as an organization. KPMG’s 58% counts people. The gap between them is where shadow AI lives: in the family offices that have not adopted AI, the people have.

The second is the direction of travel in the Netskope figure. Personal account use fell from 78% to 47% of generative AI users in a year, and the report attributes the shift to organizations rolling out approved tools. People move to the sanctioned tool when one exists. For a family office deciding how to respond, that shift is the figure to hold onto, and the section on bans below returns to it.

Our own observation runs in a more encouraging direction than the surveys. Family offices are taking ownership of their AI. Clients now ask for MCP connections by name, so they can point Claude, ChatGPT, or their own agents at their consolidated wealth data, and security leads the conversation: permissions, audit trails, and where the data goes come up before any question about features. At Aleta we believe the family should choose its AI, not the vendor, and seeing openness and security being built together is a very good sign for the industry.

That ownership is also the answer to shadow AI. Staff will use AI tools, or try to, whether or not anyone has approved them. The family offices getting this right treat that as a given: they adopt a use case policy that says which tools and which data are allowed, put every AI assistant staff use on an enterprise license so the family office can limit how its data is used, and, where they want more control, explore running a local model. The governed path becomes the easy path, and use comes back into view.

Why Are Family Offices More Exposed to Shadow AI Than Larger Firms?

A family office has less shadow AI than a bank in absolute terms and more exposure per instance, because there is nothing between the personal account and the family’s data.

David Chie of Maple Drive Talent Partners put the structural point plainly in the UBS Family Office Quarterly for the second quarter of 2026: at a large institution a weak analyst “is absorbed by the system,” with layers of review and compliance around them, while “at a six-person family office, a mediocre hire is the system.” He draws the same conclusion for AI: where a single employee might handle lifestyle accounting, deal flow, and portfolio analysis, “the exposure compounds rapidly.” The person pasting a capital call notice into a chatbot to summarize it is the same person who books it, pays it, and reports it to the family.

Three further things make the family office case distinct. The first is that the user population is wider than the staff. The principal, the next generation, and the family’s outside advisers all handle family information, and none of them is covered by an employee handbook. The second is the absence of an IT function. Deloitte’s 2026 family business cybersecurity report, a survey of family businesses rather than family offices, found that only 32% of respondents rely on vendor governance as a security control, and third-party risk featured in 40% of the attacks they experienced in the past two years. The family office version of that picture is a team with no IT function at all, and a family office that does not govern its custodian and administrator relationships formally is unlikely to be governing a consumer AI subscription. The third is where the enthusiasm sits. Citi’s 2026 interviews found that “junior staff have a tendency to try out AI tools first,” and the same report records that 57% of family offices cite a lack of internal expertise as their biggest barrier to adoption. Experimentation runs ahead of oversight because the people experimenting are not the people who set policy.

Mr. Family Office’s audit example shows how this plays out. A principal and an executive believed their family office had no shadow AI. The review found 11 AI tools in use, six on desktops and five on mobile devices, none with controls for family office data, more than three quarters on free accounts, and one of them used by the CFO, who had access to the sensitive financial systems. Nobody had acted in bad faith. As the author puts it, “users rarely act with bad intentions; they simply want to work faster.”

What Does Shadow AI Put at Risk in a Family Office?

Four exposures follow from an ungoverned AI tool, and each has a mechanism rather than a mood.

The first is the terms. Consumer and free tiers of the major AI assistants generally reserve the right to use conversations to improve their models unless the user opts out, and retention follows the provider’s defaults rather than the family office’s. The enterprise tiers offer written exclusions from training, retention the family office controls, an administrator, and an audit log. None of that exists on the account a member of staff opened on a Sunday evening. The distinction between consumer and enterprise terms, and the question of de-identified data that even enterprise terms sometimes leave open, is covered in our AI vendor security due diligence questions for family offices.

The second is visibility and revocation. A governed tool logs who asked what, and access can be switched off. A personal account leaves no record the family office can see, and when the member of staff leaves, the conversations, the uploaded statements, and whatever the provider retained leave with them. This is the gap that turns a data-handling question into an employment question.

The third is accuracy. KPMG’s study found that 66% of employees rely on AI output without checking it and 56% have made mistakes at work because of it. In a family office the output in question is a performance figure, a liquidity estimate, or a summary of a fund document, and the person who produced it may be the only person who sees it before it reaches the family. An AI assistant working on fragmented or unreconciled data fills the gaps and sounds equally confident about every answer, which is why the data foundation underneath matters as much as the policy on top; our article on the state of AI in family offices covers that side.

The fourth is legal. The moment family information reaches an AI provider, that provider is a processor under GDPR or a service provider under US state privacy laws such as California’s, and the family office is responsible for the contract that should govern the relationship. With a personal account there is no such contract. IBM’s 2026 report found that about one in five shadow AI incidents drew a regulatory fine. Francois Botha of Simple, writing in the National Law Review, makes the broader point that liability is moving from the makers of AI to the organizations that use it, and that family offices “may not be the target of new compliance laws, but they’re certainly within range.”

Why Does Banning AI Make Shadow AI Worse?

A ban removes the sanctioned use and leaves the unsanctioned use in place, which is the opposite of what the family office wanted.

Mr. Family Office and Simple, whose guides on the subject are compared later in this article, agree on this from different directions. Mr. Family Office states that “a strict ban can drive AI use out of sight” and that “good governance should allow helpful use within clear boundaries.” Simple’s AI strategy and governance guide records that several firms have had to “ban employees from pasting client data into public AI tools,” and in the same breath warns that an adoption gap “leads to ‘shadow AI,’ where staff use public models without approval.” The numbers say the same thing. KPMG found 57% of employees hiding their AI use, and Microsoft’s Work Trend Index found 52% of AI users reluctant to admit using it for their most important tasks. People who are told not to use a tool that saves them an hour a day keep using it and stop telling anyone.

The Netskope figure closes the argument. When personal account use among generative AI users fell from 78% to 47% in a year, the cause was organizations deploying approved tools that people preferred, rather than enforcement. The lesson for a family office is that the policy only holds if the sanctioned path is at least as good as the paste, and ideally better. Our conversations point the same way: a family office that rules AI out usually ends up with it anyway, on personal accounts, and the governed alternative is the only decision that changes the outcome.

That reframes the risk. The question most family offices ask is whether connecting AI to their data is safe. The question underneath it is whether AI is already connected to their data through a dozen personal accounts, with no permissions, no log, and nothing anyone can switch off. On that reading, a governed connection reduces a risk the family office is already carrying, which is the argument of our article on whether it is safe to connect an AI assistant to family office data.

Governed vs. Ungoverned AI Use in a Family Office

The difference between shadow AI and governed AI is a short list of controls, and each one answers a question the family office cannot otherwise answer.

Table 2. Ungoverned and governed AI use in a family office

The third column is a different kind of thing from the first two. Enterprise terms govern what happens to data after it reaches the AI provider. A governed connection governs what reaches the provider in the first place: the AI assistant sends a question to the wealth platform, the platform checks the user’s permissions, and only the answer to that question goes back. The family office keeps its data set where it was and gains a log it never had. The two work together, since the family office still needs enterprise terms for the answers that do travel, and the two sides of that connection are set out in Aleta’s description of how the connection works.

What Do the Best Guides on Shadow AI in Family Offices Say?

Several good pieces on shadow AI in family offices have appeared since 2025, and a reader who wants the full picture should not have to read all of them. This section summarizes what each adds, so the overview sits in one place.

Table 3. Guides to shadow AI in family offices, and what each adds

Where the guides agree is worth stating, because agreement across a law firm, a consultancy, a research platform, and two academics is rare. All of them put visibility before control: the family office cannot govern what it does not know is in use. All of them reject a ban as a strategy. All of them want a named owner, an inventory, and a written policy that says what is approved and what data is off limits.

Where they stop is the same place. Each ends at policy and monitoring, and none addresses what the sanctioned path looks like in practice or where the family’s data sits underneath it. A policy that says “use the enterprise tool” works only if the enterprise tool can do what the personal account was doing, and a personal account was usually being used on exported statements and spreadsheets because that was the only way to get the data in front of the AI. That is the gap the rest of this article fills.

How Do You Find Shadow AI in Your Family Office?

Discovery comes before policy, and in a family office it takes an afternoon.

Five checks find most of it. Ask, with no penalty attached: a short conversation with each member of staff about which AI tools they use and for what turns up more than any scan, provided the answer cannot get anyone into trouble. Read the card and expense statements for AI subscriptions, since a paid consumer plan on a company card is the most common form. Check single sign-on and the email domain for sign-ups to AI services, which most identity providers can list. Open the settings of the software the family office already uses and look for AI features that are switched on, including meeting assistants, email summarization, and document tools. And look at phones and browsers, since the Mr. Family Office audit found five of its 11 instances on mobile devices and extensions read whatever is on the screen.

The output is an inventory: each tool, who uses it, on which plan, for what, and with access to which data. Mr. Family Office calls this an AI governance register and recommends keeping it current with a review cycle. The register is also the input to the policy, because the family office now knows what it is deciding about.

What Should a Family Office AI Policy Include?

Six parts are enough for a policy that fits on one page, and one page is the length that gets read.

1. Approved tools and the tier for each. Name the AI assistants staff may use and state that wealth data goes only into enterprise accounts with training excluded and retention controlled in writing. Consumer accounts are for nothing that identifies the family or its holdings.

2. Permitted data by class. Public information, internal working material, and family or client data, with a plain statement of which classes may go into which tool. Account numbers, beneficiary details, and whole statements stay out of any personal account, go into an enterprise AI assistant only where the contract excludes training and retention and the policy says so, and never need to be pasted at all where the AI assistant reaches the wealth platform through a governed connection.

3. Who reviews what. Any AI output that informs a decision, reaches the family, or goes to a counterparty is reviewed by a named person before it does.

4. How connections to the wealth platform are granted and revoked. Who may connect an AI assistant to the family office’s data, through which connection, and who can switch it off. The connection should inherit the user’s permissions and log every query.

5. How staff report a mistake without penalty. The policy fails the first time someone hides an error.

6. Training. Staff who use AI at work should be trained to use it responsibly; in the EU the AI literacy duty has applied since February 2, 2025, and in the US the same expectation sits inside existing cybersecurity and books-and-records obligations for family offices that are registered advisers.

Citi’s 2026 report describes the lightest possible start: an employee handbook that staff sign, requiring them to ask for approval for AI use cases, which “creates accountability without requiring extensive policy infrastructure,” and basic usage guidelines that document approved tools and improve over time rather than waiting for a perfect policy.

Aleta’s own policy for staff follows the same outline. Aleta employees use AI assistants on enterprise accounts under contracts that exclude training and retention, from an approved list, and client data never enters a personal account. New tools are approved before use. The policy fits on a page, and it is the same one we suggest to the family offices we work with.

How Does a Governed Connection Replace Shadow AI?

The replacement for the paste is a path that does more than the paste did, with the controls built in.

In practice that path has two parts. The first is an enterprise AI assistant, so the answers that do travel are covered by written terms. The second is a governed connection between that assistant and the wealth platform, so the data does not have to be exported to be used. Most such connections use MCP, an open standard introduced by Anthropic and since adopted by OpenAI, Google, Microsoft, and AWS, through which an AI assistant can query a system that holds data. Our MCP explainer covers it in plain language. The AI assistant sends a question, the platform checks the user’s permissions, and the answer comes back. Nothing is downloaded or uploaded, so there is no spreadsheet on a desktop waiting to be pasted into the wrong window.

For example, Aleta’s two-way MCP layer lets an AI assistant read the family office’s data within the connected user’s permissions and act on it only after explicit approval, with every query audit-logged and access revocable at any time. The questions staff were taking to a personal account, what changed in total wealth this week, how much liquidity is available, how concentrated the portfolio is in a single name, are answered from reconciled data in seconds, and the capital call example in our article on real AI prompts family offices run shows what approval looks like: the AI assistant reads five notices, prepares the postings, and waits for a person before anything is booked.

The governed path wins on the same grounds the personal account won on. It is faster, because the data is already there and already reconciled, and with an MCP connection it does not have to be copy-pasted. It is more useful, because the AI assistant can act, under approval, rather than only summarize. And it is the version the family office can see, log, and switch off, which the personal account never was. Where the AI model itself should run, from an enterprise tier to the family office’s own cloud account or a local model, is covered in our guide to local vs. cloud AI models for family offices.

How Does Aleta Help Family Offices Govern AI Use?

Aleta takes the wealth platform side of the governed connection described in the previous section, and publishes its commitments so a family office can read them before connecting anything.

On the platform side, the commitments are specific. Aleta does not use client data to train AI models, and nothing about connecting an AI assistant to the platform requires it: a query runs against the family office’s data within the user’s permissions, returns an answer, and ends there, with no training copy kept. An AI assistant connected to Aleta sees only what the connected user can see, anything beyond reading requires explicit approval, every query the AI assistant runs against the platform is logged, and the family office can revoke the connection at any time. Aleta Intelligence, the platform’s suite of AI tools, is covered by the same commitment, so client data is never used to train models or shared with AI vendors for training. It reads capital calls, distribution notices, and fund statements into structured data inside the platform, so the documents that most often ended up in a personal chatbot never need to leave it. The data underneath is consolidated and reconciled daily, which is what makes an AI answer checkable against the platform rather than against a spreadsheet.

What Aleta cannot do is govern the AI assistant side. Once an answer reaches ChatGPT, Claude, or Copilot, the family office’s contract with that provider is the only thing that governs it, which is why the policy above requires enterprise terms. The questions to put to those providers, with what a good answer sounds like, are in our AI vendor security due diligence questions for family offices, and the full data path is set out in our article Is it safe to connect an AI assistant to family office data?