Shadow AI and sensitive public data: the blue light problem hiding in plain sight

The protection of sensitive public data is reaching a critical point for police and fire services across the UK. As pressure on teams grows, so too does the use of ‘shadow’ AI – consumer tools such as ChatGPT adopted informally to help people work faster.

A recent Microsoft survey found that more than 70% of UK employees have used unauthorised AI tools at work, with around a quarter turning to unapproved tools for finance related tasks. The 2026 OneAdvanced Trends Report reflects the same trend, with organisations increasingly identifying shadow AI as a serious operational concern.

In blue light organisations, shadow AI rarely sits in one obvious place, but it often surfaces in finance, procurement and governance functions – areas where oversight, control and accountability matter most.

It appears in everyday moments: a finance colleague summarising a report under time pressure; a procurement lead refining tender language; a governance officer turning rough notes into a paper for sign off. Consumer AI tools offer fast, familiar answers.

The risk emerges once information is shared. When data is entered into unauthorised tools, organisations lose visibility over where it goes, how long it is retained and whether it is reused.

So how can blue light organisations reduce the risk of shadow AI without slowing people down?

There are two steps that make the biggest difference: practical training, and access to sector specific tools that reduce the need for workarounds.

Start with the right tools for the job

If blue light services are to benefit from AI without introducing unacceptable risk, they need more than general assurances of “security”. They need clarity – particularly around sovereign data handling – ensuring sensitive information remains under UK jurisdiction and is processed entirely within the UK.

Many providers reference UK data sovereignty while allowing processing to happen overseas. Even where storage is local, processing often isn’t. For police and fire services, this creates unnecessary exposure.

The baseline should be straightforward: sensitive data should stay in the UK, be processed in the UK, and never be used to train external large language models. This is where purpose built, sector specific AI becomes the safer option.

Introducing OneAdvanced AI

OneAdvanced AI is designed to streamline workflows and support decision making, with sector-specific AI agents and configurable privacy controls built in. All data is hosted, processed and controlled exclusively by OneAdvanced within the UK, with oversight aligned to public sector requirements.

At the core are the OneAdvanced Models, combining a large language model with sector specific small language models (SLMs). Alongside these, AI Agents for Automation support a range of tasks and processes, embedded directly in products or deployed as standalone capabilities using GenAI, natural language processing and machine learning.

Keep training light – and make safe use the default

Training plays an important role, but shouldn’t become a barrier. If the approved route feels slower or harder to use than consumer tools, people will look elsewhere.

OneAdvanced AI is designed to minimise that friction. The experience is intuitive, access-controlled and secure, allowing teams to get value quickly without needing to become AI specialists.

A key enabler is Private Spaces – secure environments for uploading and working with files that keep sensitive information contained while remaining usable. Built on the Model Context Protocol (MCP) framework, Private Spaces support context aware AI while prioritising security and scalability.

For finance, spend, and governance teams, this reduces uncertainty and supports consistent, safe use – embedding good practice into everyday work rather than correcting behaviour after the fact.

Making AI safe by making it usable

Shadow AI is not a failure of policy or intent. It reflects people trying to work faster and more effectively, without the right tools to do so safely.

For police and fire services, the challenge is to harness that momentum without losing control of the data and decisions that underpin public trust. That means ensuring “secure” includes UK-based processing, clear data boundaries and explicit assurances that sensitive information will not train external models or be handled overseas.

The organisations that navigate this well won’t be the ones that try to shut AI down. They’ll be the ones that put secure, intuitive tools in people’s hands, keep training practical, and design governance so it fits naturally into daily work.

When that happens, AI stops being a risk managed at the margins. It becomes a capability teams can use confidently, day in and day out.  

---

Don’t miss!

Designed for finance, spend and governance specialists in police and fire services, our blue light hub contains a wealth of useful resources – including blogs, webinars, guides and white papers – all kept up to date and aligned to the way you work.