Shadow AI
Shadow AI is the use of AI tools by employees without the organisation knowing or having agreed to it, such as pasting customer data into a public chatbot. It usually happens because people want to work faster and there is no approved option. A ban rarely helps. A clear policy, an approved tool and an AI register do.
What it looks like
An employee pastes a customer email into a free chatbot to write a reply faster. A colleague has a quote summarised through a personal account. Nobody means any harm, and nobody else knows. That is shadow AI: use that happens out of sight of the organisation, on tools nobody has made agreements about.
It is more common than most boards assume. In the 2024 Work Trend Index by Microsoft and LinkedIn, a survey of 31,000 people in 31 countries, 78% of AI users said they bring their own AI tools to work. At small and medium-sized companies it was 80%.
Why it happens
Two reasons keep coming back. People want to do their work faster and with less tedium, and the tools are free and one click away. And there is often no approved option, or nobody knows which one it is. Where there is no route, people pick their own. In the same survey, 52% of AI users said they were reluctant to admit using AI for their most important tasks. So the use stays hidden even when you ask about it.
What is at stake
| Risk | What happens |
|---|---|
| Data leaves the company | Text you enter ends up on the provider's servers, often without the employee knowing what happens to it there |
| GDPR | According to the Dutch Data Protection Authority, entering personal data against the agreements with your employer is a data breach, which often has to be reported |
| Confidentiality | Prices, contracts or information under a non-disclosure agreement end up with a third party |
| Unverifiable output | Nobody knows which work came out of a chatbot, so nobody checks it |
The Dutch Data Protection Authority received several notifications of such breaches in 2024. In one, an employee of a GP practice had entered patients' medical data into an AI chatbot. In another, an employee of a telecom company had entered a file that included customer addresses. Under the GDPR you report a breach to the supervisory authority within 72 hours where feasible.
Why a ban does not work
A ban without an alternative does not remove the need. The use carries on, only further out of view, and you lose the conversation about what is allowed.
What does work
- A short AI policy that says which tools are allowed and which data never goes into them
- An approved option: a tool with agreements in place with the provider, for example that entered data is not stored
- An AI register: a simple overview of which AI tools are in use, by whom, for what, and with which data
- Explanation for employees, so they know why the rules exist. That ties in with the duty of AI literacy under the AI Act
Start by finding out what is already in use, without it feeling like an inspection. Suppose you ask each team which tools they use and for what, and promise up front that nobody will be held to account for the answer. You will get a more honest picture than a ban ever gives you. How to set up a framework after that is covered in Drafting an AI policy: a framework for today.
Frequently asked questions
Sources
- Autoriteit Persoonsgegevens: Let op, gebruik AI-chatbot kan leiden tot datalekken (6 augustus 2024)— autoriteitpersoonsgegevens.nl ↗
- Microsoft en LinkedIn, Work Trend Index 2024: 78% van de AI-gebruikers neemt eigen AI-tools mee naar het werk— microsoft.com ↗
- AVG artikel 33: melding van een datalek aan de toezichthouder binnen 72 uur— gdpr-info.eu ↗