Shadow AI: the AI your team already uses without anyone deciding it

It's using AI tools at work without the company having decided or approved it. Someone pastes a contract to get a summary. Someone else uploads a customer list to clean it up. A third person asks for help with a delicate email and copies in the whole thread.

There is almost never bad intent. People use whatever saves them work. The problem is that nobody knows what information leaves the company, where it goes or what is done with it.

First, data leaves. Customer, employee or contract data ends up in personal accounts the company doesn't control. If it's personal data, GDPR applies. If it's confidential, it affects your agreements and your customers.

Second, people trust answers nobody has checked. AI writes confidently even when it's wrong. If nobody has learned to review it, the mistake reaches the customer with perfect spelling.

Third, there is no shared standard. Each person decides alone what is acceptable, and each one decides something different.

The European AI regulation, the AI Act, includes an AI literacy obligation in its Article 4. Organisations that develop or use AI systems must take measures so their staff know enough about them. It has applied since 2 February 2025.

I don't give legal advice. But it's a good reason to do something worth doing anyway: make sure your team knows what AI does, where it fails and which data it should never be given.

The usual reaction is to ban it. But if the tool saves work, people will keep using it out of sight. You lose visibility and the risk stays.

What works is bringing order: giving your team a better option than the one each person found on their own.

An approved tool, with a company account and clear terms on what happens to the data. When the official option is convenient, it's easier for people to drop their own.

A short usage policy that takes five minutes to read: what it's for, what it's not for and what to do when in doubt. And simple data rules: which information never goes into an AI tool and which can.

And hands-on training built on your team's real cases. No generic talks about the future: how to use it well every day and how to review what it produces. With these four pieces, your team uses AI in the open and by your rules. And you know what data leaves and where it goes.

I train teams to use AI at work, in line with what Article 4 asks for: which tool to approve, which usage policy to write and how to protect data. I am also a visiting lecturer at EDEM business school. There I teach some of the AI subjects in the Master's in UX/UI Design, AI and Digital Strategy.

I speak from the inside. In 2021 I co-founded Chat Ergo Bot, a conversational AI startup I led, before ChatGPT existed. Today I am Head of AI GTM Engineering at Sesame HR, with a mandate over the internal AI projects of the whole company. I know how useful AI is and I know where it breaks.