Shadow AI

Typical forms include a personal chat assistant account, a browser extension that rewrites text, a meeting transcription app, or an AI feature that arrived through an update to long-established software. What they share is that company data leaves the organization without anyone knowing where it goes, on what terms, and whether the vendor stores it or uses it to train its models.

The term derives from shadow IT, meaning software and cloud services that departments use without going through IT. Shadow AI adds something new: content is sent to a model as input and processed, and the output often flows back into the work without review. Germany's Data Protection Conference (DSK), the body of its data protection authorities, stated in its AI guidance of May 6, 2024, that employees' unauthorized, uncontrolled use of AI is a reality in many companies and agencies.

For executives, shadow AI is more than an IT issue. Leadership is accountable for how personal data and trade secrets are handled and answers for results that leave the company. Shadow AI also shows what employees need AI for. Banning, tolerating or providing a tool is therefore a decision about budget and how the company works.

Where shadow AI comes from.

Shadow AI rarely starts with carelessness. Most tools take minutes to set up, cost little or nothing and need no purchasing process. They take over exactly the work many people find tedious: shortening text, drafting emails, analyzing spreadsheets, summarizing meeting notes.

On the other side, an approved route is often missing. Either the company offers no AI tool at all, or the one it offers is clumsier than a personal account. Clear rules are often missing too, so nobody knows what is allowed.

A third source is less visible: AI features that vendors add through updates to software the company already uses. The program is approved, but the new feature was never reviewed on its own. Release notes and updated vendor terms offer clues.

Above all, shadow AI is a demand signal. Treating it only as a violation misses which tasks employees want AI for, and those are the obvious candidates for an approved tool.

How widespread shadow AI is.

Two surveys from Germany look at the issue from two sides. The digital industry association Bitkom surveyed 604 companies with 20 or more employees in July and August 2025. By their own assessment, use of personal AI accounts for work was widespread in 8 percent, 17 percent reported isolated cases, and another 17 percent suspected it. 26 percent offered employees an AI tool of their own, and 23 percent had rules for AI use.

The German Economic Institute (IW) surveyed just under 5,000 employees in March and April 2026. Among respondents who use AI at work, 29.1 percent said they use tools their employer did not provide. Where employees said their employer strongly supports building AI skills, the share was 44.5 percent, more than double the 21.3 percent among those who saw no such support.

The authors read this as a provision gap: training creates demand, and when the matching tool is missing, use moves outside. They note that the data show a correlation, not causation. The two studies also measure different things: Bitkom asks companies for their impression, the IW asks employees what they do.

What the risks are.

The first risk is data protection. If an input contains personal data, such as customer names or job applications, processing needs a legal basis under the GDPR, and usually a data processing agreement with the vendor (Art. 28 GDPR). A personal account has none. On consumer plans, vendors may also use inputs for training unless the user turns that off; OpenAI and Anthropic say they exclude this by default for their business plans and their API. The DSK recommends switching training off from the start on company accounts.

The second risk concerns trade secrets. Under Germany's Trade Secrets Act, information is only protected if its owner has taken reasonable measures to keep it secret. Letting pricing or draft contracts flow into outside tools unchecked weakens that protection.

The third risk lies in the output. What a model produces can be wrong or made up. Unchecked, such output ends up in proposals and reports.

The EU AI Act adds obligations. Article 4 requires companies that use AI to take measures for their staff's AI literacy. Using a tool to screen job applications can fall into an area the Act classifies as high-risk; after the July 2026 amendment, those obligations apply from December 2, 2027.

Why a ban alone changes little.

A ban looks safe. But the need remains, and use moves to personal devices and networks the company cannot see. The risk stays; only the ability to spot it goes. The IW reaches a similar conclusion: outright bans would mainly hit the most engaged employees.

The DSK relies on three building blocks. First, clear, documented instructions on which AI applications may be used, under what conditions and for what purposes, ideally with examples of permitted and prohibited uses. Second, devices and accounts provided by the employer, so employees don't have to work with personal ones. Third, training, guidelines and conversations.

The DSK also suggests setting the framework through a work instruction or a works council agreement, and notes that introducing an AI application can trigger co-determination rights under German law.

A ban can still be right for specific tools or types of data, for example vendors without a data processing agreement or especially sensitive data. It works when it comes paired with an approved route for the same purpose.

How companies bring shadow AI into view.

The simplest starting point is a survey across departments that explicitly carries no penalties: which tools are used, for what and with which data?

Existing traces help too. Expense reports and credit card statements reveal AI subscriptions. The admin console of office software shows which third-party apps employees have granted access to mail, calendars or files. Browser extensions can be listed centrally. Network and security tools, such as a cloud access security broker (CASB) or data loss prevention (DLP), detect connections to known AI services.

Technical monitoring has limits. Tools that can track employee behavior affect employees' privacy and, in German companies with a works council, are subject to its co-determination (Section 87(1) No. 6 of the Works Constitution Act). Looking at services rather than individuals is usually enough.

The results go into a register: tool, purpose, types of data, account, contract, decision. Each tool is then approved with company accounts, replaced by an approved one, or prohibited. The register needs upkeep, because new tools keep appearing.

What good handling looks like.

Good handling makes the approved route at least as convenient as the personal one. For the most common purposes there is a tool with company accounts, a data processing agreement and training use switched off.

The rules fit on one page and give examples: which data may go into which tool, who reviews results before they leave the company, and where to report an error. There is an intake process for new tools with a short turnaround. If a review takes months, shadow use comes back.

Training uses real tasks from each department and explains why each rule exists. The yardstick is the share of AI use that runs through approved tools, not the number of bans issued.

When choosing a vendor, ask: Are inputs used for training, and can that be excluded by contract? Where is the data processed and how long is it stored? Is there a data processing agreement? Can administrators see who uses the tool, and can accounts be locked centrally?

Where the term stops working

Shadow AI ends where a tool has been provided or approved: someone who puts data into an approved tool that doesn't belong there breaks a rule but isn't using shadow AI. Not provided doesn't always mean secret: some companies knowingly tolerate the use as a trial. The term is distinct from AI governance, which sets the rules for using AI, and from the EU AI Act, which sets legal obligations.