When an employee leaves a business, the offboarding checklist usually feels familiar.

Disable email. Collect the laptop. Remove access to shared files. Change important passwords. Make sure someone else can receive important client communications.

But artificial intelligence has added another category that may not appear on that checklist at all.

An employee may have created an AI account independently, connected an AI service to company systems, uploaded business information, or built part of their workflow around a tool nobody formally approved.

That is part of the broader Shadow AI risk businesses are beginning to manage. AI services can be inexpensive, browser-based, and adopted directly by employees without traditional procurement or technical approval. ETG’s existing Shadow AI content identifies this lack of visibility as a governance problem for organizations across Eugene, Springfield, and Lane County.

The issue becomes considerably more practical when that employee leaves.

Who controls the AI account? What business information went into it? What systems can it still reach? And does anyone remaining at the company even know it exists?

For law firms, engineering companies, professional services firms, nonprofits, and other small and midsize organizations, AI needs to become part of the employee offboarding conversation.

The New Offboarding Gap Is Bigger Than a User Account

Employee offboarding was already getting more complicated before AI entered the picture.

Employees may have access to Microsoft 365, accounting platforms, customer relationship management systems, remote access tools, vendor portals, cloud storage, industry-specific software, collaboration platforms, and other SaaS applications.

ETG’s existing guidance on former employee access points out an important problem: department-managed SaaS applications can be missed during normal offboarding because they may never appear on a central software inventory.

AI fits directly into that blind spot.

An employee might use an AI service through:

• An organization-managed account
• An account created with a work email address
• A personal account used for business purposes
• An AI service purchased independently
• An integration connected to another cloud application
• An approved business platform that includes AI functionality

These distinctions matter because traditional account deactivation does not necessarily account for every external service an employee used.

The Cloud Security Alliance has specifically identified this challenge in SaaS and AI environments. Its guidance notes that disabling a user in an identity provider may not address SaaS tools outside SSO, local accounts, accounts associated with personal email, SaaS-to-SaaS and generative AI integrations, or external file shares.

The better offboarding question is no longer simply:

Did we disable the employee’s account?

It is:

Did we identify the systems the employee used to access, create, store, share, or process business information?

1. Add AI Services to the Application Inventory

You cannot reliably offboard an application you do not know exists.

That sounds obvious, but it is one of the defining challenges of unmanaged AI use.

AI services are often easy for employees to adopt independently. ETG’s existing Shadow AI guidance notes that browser-based AI tools may not require formal procurement, installation, or technical approval.

That makes application inventory the logical place to start.

Organizations should consider documenting:

• Which AI platforms are being used
• Who uses them
• Whether accounts are company-managed or individually managed
• Who owns the administrative or billing relationship
• What types of business information are involved
• Whether an AI service connects to other company systems

The goal is not to create unnecessary bureaucracy around AI.

It is to establish enough visibility that AI can be managed like other technology the organization relies on.

That same principle already applies to SaaS offboarding risks. ETG’s broader offboarding guidance recommends maintaining a current inventory of applications, platforms, vendor portals, and cloud services employees may access.

AI should be part of that inventory.

2. Identify Employee-Created AI Accounts

Company-managed AI services are generally easier to account for because leadership and IT know those services exist.

Employee-created AI accounts are harder.

Imagine an engineer who discovers an AI tool that helps with documentation. An administrative employee finds one that makes summarizing documents faster. Someone at a nonprofit starts using a service to help prepare routine communications.

The intention may simply be to work more efficiently.

But if nobody records that application, the organization can lose visibility into it when the employee leaves.

That creates two separate questions:

Does the former employee retain access to something the business used?

And:

Does business information remain inside a service the organization does not administer?

Those questions are related, but they are not identical.

CISA specifically warns that extraneous and stale accounts can create security risk and notes that former employees whose accounts remain active can pose additional risk. CISA recommends organizations identify and follow account de-provisioning procedures. [cisa.gov]

AI expands that established account-management problem beyond the applications organizations traditionally think about during departure procedures.

3. Separate Company-Managed AI From Personal AI

One of the most useful questions an owner or operations manager can ask about an AI service is:

Who actually controls this account?

There is an important difference between an AI platform purchased and administered by the organization and one that an employee started independently.

ETG’s approach to AI tools outside IT oversight emphasizes bringing AI into the same governance structure as other business technology, including defined ownership, data-handling expectations, and clear approved uses.

Offboarding is one reason that distinction becomes important.

When individually adopted AI services are not documented, the organization may have difficulty determining:

• Which services were used
• What company information was entered
• Whether important business information remains in a service
• Whether an AI service was connected to another business application
• Whether a business workflow needs to be transferred to another employee

That last question makes AI offboarding an operational issue as well as a security issue.

If an employee has incorporated AI into documentation, proposals, research, administrative work, or another repeatable business process, leadership should understand what needs to remain with the company when that employee leaves.

The goal is not to prohibit employees from using useful technology.

It is to make sure business processes do not quietly become dependent on accounts or services the organization does not understand or control.

4. Include AI in Departure Procedures

AI should become an explicit category in employee departure procedures.

That does not mean every departure requires an extensive AI investigation.

It means the normal employee offboarding process should account for the possibility that AI services have become part of how the employee works. ETG already applies this broader approach to offboarding by looking beyond primary accounts to business applications, vendor access, mobile devices, business records, and transfer of responsibilities.

For AI, a practical departure review should consider several areas.

Known AI Services

Identify organization-approved AI platforms associated with the departing employee.

Individually Created Services

Identify AI accounts the employee established independently for business purposes.

Business Information

Determine whether organizational information was used with those services, particularly sensitive client, project, donor, financial, legal, or other business information.

Connected Access

Review known AI services or automation tools that have been connected to other business applications.

Ownership and Continuity

Determine whether the employee created AI-supported workflows or resources that need to remain available to the organization after departure.

The important part is consistency.

AI should not exist as an exception to the normal technology lifecycle simply because it is newer.

AI Connections Can Outlive the Offboarding Conversation

There is another issue businesses should consider: integrations.

AI services do not always exist as isolated websites.

The Cloud Security Alliance specifically identifies SaaS-to-SaaS and generative AI integrations among the access paths security teams can overlook during offboarding.

That means organizations should avoid assuming that addressing an employee’s main account automatically addresses every AI-related service associated with that employee.

This is where identity management, application inventory, and AI governance begin to converge.

The technology may be new, but the governance questions are familiar:

Who has access?

What information is involved?

What systems are connected?

Who owns the service?

What changes when the employee leaves?

Those are not really AI questions.

They are business governance questions.

5. Make AI Part of Recurring Access Reviews

Good employee offboarding should not depend entirely on what everyone remembers on someone’s final day.

Recurring account and access reviews give organizations another opportunity to find applications and permissions that have fallen outside normal oversight.

CISA recommends auditing extraneous and stale accounts because these accounts can provide opportunities for adversary access and may include accounts associated with former employees.

ETG’s existing content on offboarding security risks similarly discusses periodic security auditing as a way to uncover inactive accounts, excessive permissions, outdated access rights, and systems outside normal oversight.

AI should become part of those reviews.

Organizations can ask:

• Have employees introduced new AI services?
• Are the AI tools currently being used known to leadership or IT?
• Are old AI accounts still required?
• Have AI services been connected to other business applications?
• Does the application inventory still reflect how employees actually work?
• Have employee departures or role changes created unnecessary access?

A recurring review turns AI governance into part of normal business technology management instead of a one-time policy exercise.

AI Offboarding Is Really a Visibility Problem

The biggest lesson here is not that departing employees are inherently a security threat.

It is that an organization cannot properly manage technology it cannot see.

That is the common thread connecting Shadow AI risk with employee offboarding.

Employees can adopt useful AI services faster than policies, inventories, and operational procedures catch up. ETG’s existing AI governance content focuses on making AI use visible and intentional rather than allowing it to operate as a parallel environment outside normal oversight.

Employee departures expose the practical consequences when that visibility is missing.

For a law firm, the concern may include sensitive or confidential information being used with an AI service. ETG’s guidance on AI governance for law firms discusses the importance of permissions, confidentiality, retention, vendor oversight, and knowing how AI is being used around sensitive information.

For an engineering or professional services company, an employee may have incorporated an AI service into an important workflow without documenting it.

For a nonprofit, the question may be whether organizational information has been used with an individually controlled service.

The specific considerations vary by organization.

The operating principle does not:

If AI is being used for company work, it belongs in the company’s technology lifecycle.

That includes adoption, governance, access reviews, employee role changes, and eventually offboarding.

A Better Question for Eugene and Springfield Business Leaders

Instead of asking:

“Did we shut down the employee’s accounts?”

Ask:

“Have we accounted for the places this employee used to access, create, store, share, or process business information?”

That broader question naturally includes email, SaaS applications, vendor systems, devices, and now AI.

For small and midsize organizations across Eugene, Springfield, Lane County, and the broader Willamette Valley, the answer does not need to be an enterprise-scale governance program.

It starts with visibility.

Maintain an application inventory. Establish ownership. Build a repeatable offboarding process. Review access periodically. And make sure AI is included rather than assuming it lives somewhere outside the traditional IT environment.

AI governance and employee offboarding are becoming parts of the same conversation.

If your organization is unsure which AI and SaaS services employees are using, or whether those applications are accounted for when someone leaves, Emerald Technology Group can help evaluate AI governance and employee access as part of a broader managed IT and cybersecurity strategy.

The goal is not simply to remove access.

It is to make sure the organization maintains control of its information and technology as employees, applications, and business processes change.

FAQ

What is AI offboarding?

AI offboarding is the process of accounting for AI services, accounts, access, information, integrations, and AI-supported business workflows associated with an employee who is leaving an organization.

Should AI tools be included in an employee offboarding checklist?

Yes. When employees use AI services for business purposes, those services should be considered alongside other SaaS applications and business systems during offboarding. Current Cloud Security Alliance guidance specifically identifies AI and SaaS access that can exist outside centralized identity management as an offboarding concern.

Why are employee-created AI accounts a concern?

Employee-created AI accounts may operate outside the organization’s normal application inventory and oversight. ETG’s existing Shadow AI guidance discusses how employees can adopt browser-based AI services without traditional procurement or technical approval, creating visibility and governance challenges.

Is disabling Microsoft 365 enough when an employee leaves?

Organizations may have additional systems to consider. ETG’s existing offboarding content identifies accounting applications, CRM systems, remote-access tools, vendor portals, cloud storage, industry-specific applications, collaboration platforms, and other SaaS services as potential parts of an employee’s access footprint.

How often should businesses review AI access?

The appropriate frequency depends on the organization’s policies and risk profile. As a practical approach, AI accounts and services can be incorporated into the organization’s existing recurring account, application, and access reviews.