The AI Your Staff Is Already Using
Shadow AI in associations is already happening: staff are using AI tools right now, with or without your knowledge. This is the concern underneath all the others, which is why it’s the one to close the series on.
Not maliciously. Someone found ChatGPT genuinely useful for drafting a member email or summarizing a board packet, and started using it the way anyone adopts a tool that saves real time — quietly, on their own initiative, without asking anyone first because there was no one to ask and no process to go through. No one approved it. No one’s tracking which tools, or how often, or what gets pasted in along the way. And a fair amount of what gets pasted in is member or donor data that was never meant to leave the building.
The issue was never that staff are using AI. Staff using AI thoughtfully is exactly what a well-run association should want — it’s often a sign the team is trying to do more with what it has. The actual issue is that leadership has zero visibility into how it’s happening, which means there’s no way to know where the real exposure is, which tools carry real risk, or which uses are already working well and worth formalizing.
What Shadow AI Looks Like Inside an Association
It rarely looks like a problem. It looks like a membership coordinator pasting a draft renewal notice into a free chatbot to tighten the wording. It looks like an events manager uploading last year’s attendee spreadsheet to build a follow-up survey, or a development associate asking an AI tool to summarize a donor call. Each one feels like a small, sensible shortcut.
The risk comes from what travels with the request. Member names, email addresses, payment history, donor notes, and board discussions can all end up in tools your association never reviewed, under terms nobody read. Free versions of many AI tools may use what you enter to improve their models, and most associations have no record of who is using which tool.
That’s why shadow AI in associations is a visibility problem before it’s a policy problem. A ban won’t solve it, because the use simply goes further underground. Staff who find AI useful will keep using it. The better move is to bring that use into the open, so the safe habits can be kept and the risky ones changed.
Start by asking staff what they already use, and make it clear the goal is learning, not discipline.
You Can't Govern what You Can't See
That’s precisely why this concern comes first, not last, in how it actually gets solved:
- Surface what’s already happening, tool by tool, team by team — not to punish anyone, but to see the real picture for the first time.
- Separate the genuinely risky from the genuinely fine. Most shadow AI in associations isn’t dangerous. Some of it is. The difference only becomes visible once it’s all on the table.
- Score it against real pillars — awareness and usage, operations and workflow, data and technology, policy and governance — so “we should be more careful” turns into something specific and measurable.
- Use the score as the starting line, not the finish line. It tells you exactly where the next four concerns in this series actually apply to your association, instead of guessing.
Everything else in this series… depends on first knowing where shadow AI in associations is showing up, and where yours stands. That’s what the AI Maturity Score is built to surface, in about ten minutes, before anything else gets decided.
Find out where your association stands: amsnow.io/score
