Custom GPTs and Agent Builder are closing. What should you do with the tools you built?
Custom GPTs are scheduled to retire on 11 Dec and Agent Builder on 30 Nov. A simple test for each tool: migrate it, or rebuild it as yours.
Strategy
Which AI tools are already connected to your systems, and who owns them?
To find out which AI tools are connected to your systems, list every app, agent and automation with access to your email, CRM, documents and finance systems, then give each one a named owner and check what it can reach.
Anything still connected that nobody owns is ghost AI. For each tool, decide whether to keep it, fix it or retire it, and remove access from anything you retire.
What ghost AI is, and how it differs from shadow AI.
Ghost AI is an AI tool, agent or automation that is still connected to your systems after the person or project behind it has moved on. It was often set up for a good reason: a trial that worked, a project that finished, a feature switched on in software you already use. It keeps running, and keeps its access, but nobody owns it.
Shadow AI is the better-known problem: staff using AI tools the business hasn't approved. Bradley Collis of Planet IT, an IT services firm, puts the difference simply: "Shadow AI is AI that enters the business without approval. Ghost AI is AI that stays in the business without ownership."
Interest in the topic is growing. Planet IT's analysis of UK Google search data found searches for "Shadow AI" up 85% year on year and searches for "What is Shadow AI?" up 191%, based on search volumes from September 2025 to August 2026.
Source: UK businesses warned over ghost AI governance risk, ITBrief, 26 October 2026.
Why it happens.
Connecting a tool takes minutes. Someone signs in, clicks "allow", and the tool can read the shared inbox, update the CRM or post to the accounts system. Nobody records it, because at the time it felt like a small step.
Then things move on. The person who set it up changes role or leaves. The project ends, but the automation keeps running. A supplier adds AI to software you already pay for, and it inherits the access the software had. Tools built on someone else's platform change on that platform's timetable, as custom GPTs retiring shows.
Smaller firms are building more of these connections themselves. Pax8's SMB AI Pulse Report surveyed 1,150 business leaders at firms with 5 to 499 employees in four countries, 350 of them in the UK. Among the UK firms already engaged with AI, 24% said they had discovered unapproved AI tools, workflows or agents operating in their business in the previous six months. Only 23% of UK firms said they had a formal, documented review process for AI they had built themselves.
Source: UK small firms race to build AI tools without oversight, ITBrief, 26 October 2026.
What's at risk.
The main risk is access, not the AI itself. A tool set up in a hurry is often given broad permissions because that was easier, and those permissions stay in place long after the original need has passed. A connection that can read every email or every customer record can still do so when nobody is watching.
There is also the work that depends on it. If an unowned automation sends invoices or updates records, nobody notices when it stops, or when it starts doing something slightly different. And if a tool handles personal data, your UK GDPR obligations still apply to it whether or not anyone remembers it is there. That is a question to take legal advice on, not one to guess.
None of this needs alarm. It needs someone to look.
Keep, fix or retire: one decision per tool.
Most tools fall clearly into one column. The ones that don't are the ones to fix.
Fix it or retire it
It has drifted, or nobody needs it
- No named owner Nobody will answer for what it does.
- More access than its job needs It can change or reach things it never uses.
- Set up by someone who has left There is no record of how it works or why it was connected.
- Nobody would notice if it stopped No process depends on it any more.
Keep it, with a named owner
It earns its place and someone answers for it
- A named owner One person who decides what it does and can switch it off.
- Access limited to its job Read-only where it only needs to read.
- A process depends on it It does real work the business would miss.
- Reviewed on a set date Its access and purpose are checked, not assumed.
Fix a tool the business needs but which fails one of the keep checks: give it an owner, cut its access to what it uses and set a review date. Retire anything nobody would miss. Remove its access first, then close the account. If a tool you depend on keeps failing the checks, it may be time to rebuild it as something you own.
A simple stocktake in four steps.
To reach that decision, work through every system that holds your email, customer records, documents or financial data. For each connected tool, agent or automation, answer four questions.
- Owner. Who is responsible for it now? Name a person, not a team. If nobody will put their name to it, write that down: it is an answer.
- Access. What can it reach, and can it change things or only read them? Check the permissions it holds today, not the ones it was meant to have.
- Data. What information passes through it, and where does that information go? Note anything involving personal, financial or client data.
- Decision. Keep it, fix it or retire it, using the two columns above. Put a date on the decision, and a date to review the tools you keep.
A shared spreadsheet is enough for most firms. The point is a list someone keeps up to date, not a new piece of software.
How we handle this in a bespoke build.
Every tool we build is designed to be owned from day one, with no licences and no vendor lock-in.
- A named owner on your side. We agree who owns each tool before it goes live, and that person signs off what it is allowed to do.
- Only the access its job needs. Each tool gets its own identity and permissions scoped to its task. It can read before it can change anything, and a person still signs off where it matters.
- Connections documented. What the tool connects to, and how to switch it off, is written down and kept with you, so it doesn't leave with the person who built it.
- Records in your own systems. What the tool reads, changes and sends is recorded where you can see it, and you know who to call for support.
See how we approach bespoke AI development.
Every tool you rely on should have a named owner.
If you already know which tools need fixing or rebuilding, bring us the project and book a call. If you'd like an outside view first, the AI Opportunity Audit scores your highest-impact processes and gives a clear build, buy or leave call on each. Fixed price, and credited against your build.
FAQs
Frequently asked questions.
What is shadow AI?
Shadow AI is AI that staff bring into the business without approval, such as a chatbot or an add-on used for work. Ghost AI is the opposite problem: tools that were set up and connected, often with approval, but that nobody owns any more. You find both the same way, by listing what is in use and what it is connected to.
How do we find out which AI tools are connected to our systems?
Start with the admin settings in your email, CRM, document storage and finance systems, which list the apps and integrations that have been granted access. Add your automation platforms and any API keys, then ask each team what they use. Anything nobody recognises goes to the top of the list.
Who should own an AI tool?
The person who runs the process the tool supports, rather than whoever happened to set it up. The owner decides what the tool is for, approves its access, reviews it on a set date and can switch it off. If nobody will take that on, the tool is probably a candidate for retirement.
What should we do with a tool nobody owns?
Find out what it does and what it can reach before you switch anything off, because a process may depend on it. If one does, give the tool an owner and cut its access to what the job needs. If nothing does, remove its access, close the account and record what you removed and when.