Shadow AI: The Compliance Risk Your Organisation Doesn't See
Half of employees use unapproved AI tools. Data, GDPR, AI Act: here is what you risk and how to regain control without banning everything.
Article written with the help of artificial intelligence — learn more about Article 50
Last updated: November 2026 · Reading time: 5 minutes
In short. Shadow AI means AI tools used by your teams without organisational approval. It exposes your data, puts you in breach of the GDPR and can push you, without your knowing it, into uses regulated, or even prohibited, by the AI Act. Banning does not work. Inventory, approved tools and training do.
What is shadow AI?
The term derives from shadow IT. It covers any professional use of AI that escapes management, the IT department or the data protection officer.
- A personal ChatGPT or Claude account used to draft client documents
- A browser extension that summarises pages or e-mails
- A transcription tool that joins video calls
- An agent connected to e-mail or the drive with a single authorisation click
- An AI feature enabled by default in software already in place, which nobody re-assessed
That last case is the most underestimated. Shadow AI is not always a new tool; sometimes it is an update to your CRM.
A massive phenomenon, more pronounced in France
According to a BlackFog survey of 2,000 employees of companies with more than 500 people, 49% use AI tools without their employer's approval. Of those, 58% turn to free versions.
The ESSCA Business AI and Sustainability Barometer, conducted in March 2026 among 826 professionals in four European countries, points the same way. Two-thirds of respondents see shadow AI in their organisation. In France, one company in five describes it as widespread, against one in ten in the United Kingdom, Germany and Spain, and fewer than one in two trains its employees in AI.
What you concretely risk
Your data leaves without a contract
An employee who pastes a contract, a client file or a payslip into a consumer tool sends that data to a provider with whom you have signed no processing contract. Free versions may reuse content to train their models, and servers are often outside the EU. This is a GDPR breach for which the employer, as controller, remains accountable.
You cannot bring into compliance what you don't know about
The AI Act reasons by use. A harmless tool can serve a regulated use without anyone knowing.
- Prohibited practice. Analysing a candidate's emotions during a video interview amounts to emotion recognition at work, prohibited since 2 February 2025.
- High-risk. A manager who asks a general-purpose assistant to rank applications is carrying out an Annex III use. On a strict reading of Article 25, diverting a general-purpose system to a high-risk use can even make the organisation its provider.
- Transparency. Generated text published to inform the public, such as a local authority communication, must be flagged, unless it has undergone human review under assumed editorial responsibility.
- AI literacy. Article 4 covers your staff and anyone using systems on your behalf. Without an inventory, training cannot be adapted to the tools actually used.
Errors, security and liability
A made-up figure in a client deliverable engages your liability, not the tool's. Extensions and agents connected through OAuth authorisation also open lasting access to your mailboxes and files, outside any control.
Is the organisation responsible for a tool it doesn't know about?
The AI Act defines the deployer as whoever uses a system under its authority. A hidden use that breaches internal rules therefore raises a genuine question of interpretation, which the authorities have not yet settled. It does not protect you for all that. The GDPR, contractual confidentiality and the Article 4 training obligation apply regardless, and having no policy at all is hard to defend.
Why banning is not enough
The ESSCA barometer finds that one company in eight sees shadow AI despite a clear ban. Employees use AI because it saves them time. A ban without an alternative moves the usage to personal phones, which are even less visible.
The six-step plan
- Take inventory. An anonymous questionnaire to teams, a review of software already in use and its AI features, an analysis of the permissions granted to third-party applications.
- Qualify each use. Prohibited, high-risk, transparency or minimal risk, and the data involved.
- Provide approved tools. Business accounts with a processing contract, no reuse of data, and hosting in the EU or in a country recognised as adequate.
- Write a usage policy. Prohibited data, prohibited uses, mandatory review before any external distribution.
- Train and keep records. Training adapted to the chosen tools, with a record of sessions, to meet Article 4.
- Keep a living register. A simple channel to declare a new tool without fear of sanction, and a quarterly review.
A note on employment law. A policy annexed to internal rules requires consulting the works council where one exists, and any monitoring of usage must be proportionate and announced to employees.
FAQ
What is shadow AI?
The use by employees of AI tools that are not approved or governed by their organisation, including AI features enabled in existing software.
Is shadow AI illegal?
Not in itself. It becomes a problem when it involves personal data without a contract, confidential information or a use regulated by the AI Act.
Should ChatGPT be banned at work?
A ban alone moves the usage without removing it. It is better to offer an approved tool and a clear policy.
What is the link with the AI Act?
The AI Act requires you to know your uses so as to avoid prohibited practices, identify high-risk and train users. Shadow AI makes all three obligations impossible to meet.
Read also
- Am I Covered by the AI Act? The Four-Question Test
- Agentic AI vs Generative AI: What Changes for Your Compliance
- OCR, LLMs and the AI Act: Must You Tell Your Client?
What now?
Inventory is the first step. With the free DILAIG audit, each use you list is qualified and then joins the inventory of your AI systems, included in the free plan. To spot a prohibited use in two minutes, the free tool Is My AI Prohibited? requires no account.
If you launched an anonymous questionnaire tomorrow, how many tools do you think you would discover?
Sources
Take action
Is your AI system compliant?
Free audit in 20 minutes. Detailed report, no commitment.
Start the audit →Keep reading
Practical guides, regulatory analysis, DILAIG news.