When an Employee Leaves, Their AI Doesn't: Offboarding in the Age of Shadow AI
Your offboarding checklist probably looks the same as it did five years ago. Collect the laptop. Disable the login. Forward the email. Archive the files.
That list misses a whole category of information. Your departing employee didn't just leave a mailbox behind. They left chat histories, custom assistants, saved prompts, AI notetaker transcripts, and tools connected to your data. In many organizations, nobody owns any of it.
The Records Nobody Inventoried
Start with how AI got into your business. Microsoft and LinkedIn's 2024 Work Trend Index found that 80% of AI users at small and midsize companies bring their own AI tools to work. Some of those tools sit on personal accounts. IT never provisioned them, so IT never deprovisions them.
Now picture a sales manager who resigns on a Friday. Over two years, she built a custom assistant loaded with your pricing playbook. She saved prompts that pull client notes into proposals. Her AI notetaker joined every pipeline call. And she connected a chatbot to your shared drive to summarize contracts.
On Monday, her account is disabled. The assistant, the prompts, and the transcripts may sit in a personal account you can't reach. The connection to your drive may still work. And nobody can tell you what was in any of it.
That's not a security footnote. It's a records problem.
Why This Is a Records Problem
Prompts, outputs, and transcripts can be records, depending on what they contain. They are also electronically stored information, so discovery and legal holds can reach them.
Even inside approved platforms, the clock is running. Microsoft documents that most Teams meeting recordings save to the organizer's OneDrive. Channel meeting recordings go to the team's SharePoint site instead. When you delete a user, Microsoft's OneDrive retention default is 30 days, unless you change it or a retention policy applies. After that, the files are on their way out. If a manager or secondary owner is set, Microsoft emails them access, along with notice that the OneDrive will be deleted.
So the default outcome for a departing organizer's recordings is simple. Someone gets a short window, or the content disappears. And new Teams meeting recordings expire after 120 days by default, departure or not. Neither one is a decision. Both are accidents.
The downside of ungoverned AI is real money. IBM's 2026 Cost of a Data Breach Report found that security incidents involving shadow AI more than doubled, to 43% from 20%, and averaged $5.39 million in breach costs.
The Ownership Gap
Here's the pattern I see. HR owns the offboarding process. IT owns the accounts. Legal owns holds. Department heads own the work.
Nobody owns the AI layer. So everyone assumes someone else handled it. ARMA International's Generally Accepted Recordkeeping Principles, updated in October 2025, include Accountability: senior leadership owns oversight of records. In ARMA's words, "Records and information are key evidence of, and essential tools to support, organizational accountability." If no named person owns a category of records, that category isn't governed.
A Short AI Offboarding Checklist
You don't need a new department. You need four steps added to the process you already run.
Inventory. Before the last day, ask the employee and their manager to list every AI tool they used for work. Include chat tools, custom assistants or GPTs, saved prompt libraries, notetakers, and browser extensions. Note which accounts are company-managed and which are personal. Note every tool connected to company email, calendars, drives, or your CRM.
Transfer ownership. Move anything with ongoing business value to a named owner. That means shared assistants, prompt libraries, and recurring meeting series. In Microsoft 365, set a manager or secondary owner before you delete the account. Then a person gets access and the deletion warnings. They still need to move what matters to a SharePoint site before the retention window closes.
Keep or delete per retention. Treat AI content like any other record. Apply your retention schedule to transcripts, outputs, and chat histories. Check for active legal holds first. If content is under hold, preserve it. If it has met its retention period and no hold applies, dispose of it and document that you did.
Revoke access. Disable company accounts, then go further. Remove third-party app connections and API keys tied to the departing user. If no hold applies, ask the employee to delete company data from personal AI accounts, and get that confirmation in writing. If a hold applies, talk with counsel first.
Then close the loop at the front of the process. Add AI tools to onboarding, so the next inventory is shorter.
Why This Fits a Fractional Model
Most mid-market organizations don't need a full-time AI records manager. They need someone to set up the inventory, write the retention rules, and connect HR, IT, and legal. Then your team runs it.
That's the kind of foundation work behind getting AI to deliver value. If you're weighing outside help for a business your size, here's why the fractional model works.
This post is general information, not legal advice. Talk with your counsel about your specific situation.
Not sure what AI your last departing employee left behind? Let's build an offboarding process that catches it. Let's talk. No obligation. Just a straight conversation about where you are and what it would take to get where you need to be.
Comments