Because even if an organisation hasn't rolled out generative AI tools and policies centrally yet, individuals might just use their personal plans anyway (potentially in violation with their contract)? I believe that's called "shadow AI".

Correct. Where I work we are only "allowed" to use AI since December 2025.

But obviously people were copy/pasting content to ChatGPT and Claude long before that.