The use of generative artificial intelligence tools has become the norm at a pace that most organisations have been unable to keep up with. The result is a phenomenon that now has a name: shadow AI, the unauthorised use of AI within the company. This article explains what it is, why it happens and what the HR or L&D department can do to manage this.
What is shadow AI and why is it appearing in companies?
The shadow AI is the use of generative artificial intelligence tools by employees without the company’s knowledge, authorisation or supervision. It is not a case of bad faith: employees turn to these tools because they save them time and the company does not offer an approved alternative.
It is the same dynamic as the well-known ‘shadow IT’, but with one key difference: generative AI tools not only access data, but also process it, store it and, in some cases, use it to train models.
Examples of shadow AI in everyday life
Shadow AI is not limited to extreme applications. It crops up in everyday situations:
- Pasting customer or contract details into a public chatbot to summarise or analyse documents.
- Using unauthorised AI extensions to summarise meetings or draft emails directly from the corporate browser.
- Translate confidential content using external tools without going through the authorised channels.
- Generate reports or code using public models with internal information as context.
In all these cases, the data leaves the company’s controlled environment without anyone realising it.
What risks does shadow AI pose to a business?
The risks are grouped into four areas:
- Leak of confidential data. Information entered into external tools may be stored, processed or used to train models. Once it is out of our hands, we have no control over it.
- Non-compliance with regulations. The GDPR and the European AI Act set out obligations regarding the processing of personal data and the use of high-risk AI systems. Unauthorised use may result in infringements without the company even realising it.
- Unchecked errors. The outputs of generative AI are not infallible. Without human review, errors in reports, contracts or communications reach the end recipient directly.
- Lack of traceability. If you don’t know which tools are being used or what data they are processing, you cannot audit, rectify or demonstrate regulatory compliance in the event of an inspection.
How can you detect ‘shadow AI’ without monitoring staff?
The aim is not control, but visibility. Some practical ways to achieve this:
- Anonymous surveys on AI tools used in day-to-day work. Employees are more honest when they do not feel they are being monitored.
- Review of connected tools corporate accounts (Google Workspace, Microsoft 365) to identify unauthorised extensions or integrations.
- Open consultation channel where employees can ask whether a tool is suitable without fear of repercussions. If the only option is to use something without asking, shadow AI grows.
Ban or channel? What works in practice?
Banning the use of generative AI tends to push the problem into the shadows rather than solving it. What works is channel: to provide approved tools as a genuine alternative and to establish clear rules for each type of data and use case.
An effective AI usage policy is not a list of prohibitions. It is a framework that sets out what is permitted, what is not, and why.
How to draft an AI usage policy for a website
A policy on the operational use of AI should include, as a minimum:
- Which tools are approved? and for what specific purposes.
- What data cannot be entered in external tools (personal data, contractual information, intellectual property).
- Who checks the outputs? before they reach customers, suppliers or business decisions.
- Who to contact in the event of any doubts or unforeseen circumstances.
The more specific and concise it is, the more likely it is to be read and put into practice.
The role of training in reducing shadow AI
Shadow AI is not just a technological problem: it is a skills issue. Employees who know how to evaluate an output, identify the risk of a data breach or choose the right tool for each task make better decisions, even when there is no one supervising them.
Training teams in the safe and ethical use of AI is the most sustainable way to reduce exposure. At Educa.Pro, you’ll find specific training to tackle this challenge: from ethics and the responsible use of AI up to the democratisation of artificial intelligence for non-technical users. You can also explore the full catalogue of AI training courses.
Frequently asked questions about Shadow AI
Is shadow AI illegal?
Not in itself, but it can lead to breaches. Entering personal data into an external tool without a legal basis or adequate security measures may breach the GDPR. The legal risk It is not about the use of AI, but about the processing of data that such use entails.
How does it differ from shadow IT?
Shadow IT refers to the use of unauthorised software or systems. Shadow AI is a specific type of shadow IT, with the added complication that generative AI tools actively process the content they receive, thereby increasing the risk of data leaks.
What should I do if I have already discovered unauthorised use?
Assess what data was shared, using which tool, and for how long. If personal data is involved, consider whether you should notify the data protection authority. From there, use the incident to update the policy and strengthen training, without turning it into a disciplinary process that discourages future transparency.
