In May 2026 Hospitality Net published an article by Terence Ronson on Shadow AI: staff using public AI tools with no approval or policy.
Terence Ronson at Hospitality Net published an article this week on Shadow AI - staff using public chatbots and writing assistants to get through the day, with no approval, no policy, and no data controls. It’s worth reading.
His central point: the most sensitive operational data in a hotel is the most likely to be shared with a tool that has no data residency controls, no enterprise agreement, and no deletion guarantee. Not because staff are careless, but because the tools are useful and the work is hard.
Two things worth adding from a restaurant and multi-site perspective.
First, this isn’t a hotel problem. Restaurant groups have exactly the same exposure with different data - allergen records, complaint correspondence, supplier disputes, staff disciplinary notes. Anywhere a manager is under time pressure and a chatbot is one tab away, this is bound to happen.
Second, this is now a board-level concern, not an IT housekeeping one. The RH-ISAC and IANS 2026 CISO Benchmark Report, based on more than 200 security leaders across retail and hospitality, found that 71% now rank AI as their primary concern, ahead of ransomware and phishing. The reasons given were data leakage, insider misuse, and insufficient governance controls. None of those are vendor problems, they’re operator problems.
Terence’s solution - Acceptable Use Policy, sanctioned alternatives, training - is the right one. The question for operators is whether you can answer his closing prompt honestly. Do you know what AI tools your team is already using? And do you know what guest data has already left your systems through them? If the answer to either is no, Terence’s piece is the place to start.