Shadow AI: the AI your team already uses without the company deciding it

It's using AI tools at work without the company having decided or approved it. You'll probably recognise this: someone pastes a contract to get a summary, or someone else uploads a customer list to clean it up. And a third person asks for help with a delicate email and, while they're at it, copies in the whole thread.

There is rarely bad intent behind these cases, because people use whatever saves them work. The problem is that the company doesn't know what information leaves, where it goes or what is done with it.

The first risk is that customer, employee or contract data ends up in personal accounts the company doesn't control. If it's personal data, GDPR applies. And if it's confidential, it affects your agreements and your customers.

The second is trusting an answer without checking it, because AI writes confidently even when it's wrong. So if your team hasn't learned to review it, the mistake reaches the customer with perfect spelling, mind you.

And the third is that there's no shared standard, so each person decides alone what is acceptable and each one decides something different.

The European AI regulation, the AI Act, includes an AI literacy obligation in its Article 4. In other words, organisations that develop or use AI systems must take measures so their staff know enough about them. And it has applied since 2 February 2025.

I don't give legal advice, but I think it's a good reason for something worth doing anyway. I mean making sure your team knows what AI does, where it fails and which data it shouldn't be given.

The usual reaction is to ban it, but that rarely works. Would you stop using a tool that saves you work just because someone told you not to? Most people keep using it out of sight, so you lose visibility and the risk is still there.

What works is bringing order, that is, giving your team a better option than the one each person found on their own.

The first piece is an approved tool, with a company account and clear terms on what happens to the data. And it should be convenient, because that makes it easier for people to drop their own.

The second, a brief usage policy that takes five minutes to read: what it's for, what it's not for and what to do when in doubt. The third, simple data rules on which information doesn't go into an AI tool and which can.

And the fourth is hands-on training built on your team's real cases, with no generic talks about the future. The point is learning to use AI well every day and to review what it produces. With these four pieces, your team uses AI in the open and by your rules, and you know what data leaves and where it goes.

I train teams to use AI at work, in line with Article 4: which tool to approve, which usage policy to write and how to protect data. I also teach at EDEM, a business school, as a visiting lecturer. There I cover part of the AI subjects in the Master's in UX/UI Design, AI and Digital Strategy.

I'm telling you this from the inside, because in 2021, before ChatGPT existed, I co-founded and led Chat Ergo Bot, a startup working on conversational AI. Today I am Head of AI GTM Engineering at Sesame HR, with a mandate over the internal AI projects of the whole company. And that has taught me how useful AI is and where it breaks.