The Automation Nobody Approved: When Employees Build AI Workflows on Their Own
AI risk doesn’t begin and end with what an employee types into a chatbot. It can also start with a workflow someone quietly builds on a personal automation account: a new customer arrives in a form, an AI tool classifies the request, a connector updates the CRM, and an email goes out automatically.
Each step may seem useful. Together, they can move company and customer data across systems without a clear owner, review process, or reliable way to see what happened when something goes wrong.
This is shadow IT in a newer form: employee-built automations and AI agents that connect business apps without formal approval. The goal isn’t to stop employees from improving their work. It’s to make sure useful shortcuts don’t become business risks that nobody is responsible for managing.
Automation is already part of everyday work
A Zapier survey conducted by Centiment on May 19–20, 2026, collected 508 completed responses from U.S. business owners and operators at companies with fewer than 500 employees. The survey reported that 76% had adopted some form of automation: 38% used rule-based app-to-app workflows, 52% used AI features built into tools they already use, and 30% used AI-powered automation that makes decisions across multiple systems with limited human input. These categories can overlap.
Among automation users, 74% said automated processes run daily or support many core processes. And 94% reported benefits, including fewer errors or improved consistency (44%), cost savings (44%), and more time for higher-value work (43%).
That’s a strong case for making automation useful, not for treating it as inherently unsafe. But the same survey points to the operational stakes: 29% of respondents worried about errors happening while nobody was watching. In the past year, 35% said someone worked beyond scheduled hours to keep a critical process running, while 27% said a manual-process error cost time or money.
The survey’s margin of error was approximately ±4 percentage points at a 95% confidence level. It is a self-reported snapshot of SMB owners and operators; it does not tell us how many workflows were built without approval. Still, it shows that automation is already embedded in business operations, and that oversight and reliability matter.
Identify what’s running, and who owns it
A spreadsheet of approved software may not reveal the automation layer employees have added themselves. Start by asking how work actually moves between your systems.
For a practical inventory, identify:
- Who builds automations? Ask employees and managers which tools they use, including personal accounts and free plans. Make the conversation about understanding and support, not blame.
- Which business apps are connected? Look for links between email, CRM, file storage, accounting, forms, messaging, and other tools. A workflow may cross several services even if each connection seems harmless on its own.
- What keeps running without its builder? Document automations tied to a person’s login, personal email address, or individual subscription. These may stop working, or remain active without oversight, when that employee changes roles or leaves.
- Where are AI agents or multi-step flows taking action? Distinguish between a tool that suggests a draft and a workflow that can send it, change a record, move a file, or trigger a financial process with little human input.
A personal account is not just an administrative inconvenience. It can make it hard for the business to manage access, preserve records, recover a workflow, or transfer responsibility. Record each workflow’s business purpose, connected apps, account owner, and backup contact.
Quantify the exposure in business terms
A list of connected apps tells you where a workflow goes. It does not tell you what could happen if the workflow makes a mistake, leaks information, or stops without warning.
For each automation, answer two questions: What information moves through it, and what can it do?
Information may include client details, invoices, employee or HR records, internal documents, or credentials. Actions may include sending email, messaging a client, editing or deleting files, changing CRM records, or initiating a payment-related step. A workflow handling routine public information has a different risk profile from one that processes sensitive employee data or makes decisions affecting customers.
Then consider the blast radius. If the workflow misclassifies a request, how many customers might receive the wrong response? If it changes a record incorrectly, who depends on that record next? If a connection fails silently, how long before someone notices, and what work will need to be repeated?
The cost may be more than a technical fix. It can mean delayed service, inaccurate billing, lost records, staff time spent reconstructing work, or customers losing confidence. A workflow that saves a few minutes per task can create a much larger burden if it fails at scale.
Mitigate with simple, usable guardrails
A policy that employees cannot understand, or cannot follow while doing their work, will encourage workarounds. Keep the rules short, specific, and easy to find. A one-page AI and automation policy should cover:
- Approved tools: Name the automation platforms and AI features employees may use for business work, and explain how to request review of a new tool.
- Data guidelines: State what information may not be entered or routed through an unapproved tool. Be clear about customer, financial, employee, and other sensitive data.
- Named ownership: Require every business workflow to have a business owner and a backup. The builder can be the owner, but the workflow should not depend solely on one person’s personal account.
- Error reporting: Give employees a clear channel to report a workflow that behaves unexpectedly, sends the wrong output, or stops running.
- Human review: Specify which outputs require a person to check them before they reach a client or affect sensitive information, records, or decisions.
- Review schedule: Set a regular time to confirm that the workflow is still needed, working as intended, and using approved connections.
For any automation that touches business data, use a company-controlled account rather than an employee’s personal account. Apply human-in-the-loop checkpoints at client-facing decisions and sensitive-data steps. Keep enough logging to answer basic questions: what ran, what data it handled, what action it took, and who reviewed the result. The appropriate controls depend on the workflow’s purpose and potential impact.
Monitor, transfer, and learn
Approval is not a one-time event. Review active workflows periodically, with higher-impact automations checked more often. Confirm that the owner is still responsible, the connected accounts are still appropriate, and the workflow still produces the result the business expects.
When someone leaves or changes roles, include workflow ownership in the handoff. Transfer the account and documentation to an authorized business owner, or disable the automation if it is no longer needed. Don’t assume a process has disappeared just because its builder has.
Revisit the policy when tools introduce new AI capabilities. A connector that once moved information according to fixed rules may gain features that interpret content, make recommendations, or take additional actions. The risk profile can change even when employees continue using the same product.
Finally, treat workarounds as useful information. If several employees independently build automations to solve the same problem, that may reveal a process worth formalizing. Ask what they were trying to improve, then decide whether the business should adopt a supported version with an owner and appropriate controls. The objective is not to punish initiative; it is to make reliable improvements part of the business rather than a hidden dependency.
Turn hidden workflows into managed business processes
Employee-built automations can save time and reduce repetitive work. They can also move sensitive data, take consequential actions, and fail outside anyone’s view. The difference is whether the business knows what is running, understands its impact, and assigns someone to oversee it.
Start with a low-pressure inventory: ask teams what they have connected, document the most important workflows, and prioritize those that handle sensitive information or act on behalf of the business. For more practical guidance, explore the B&R Computers resource hub.
If you want help assessing how technology risks, including unmanaged workflows, could affect your operations, request a Business Review or Strategy Session.