Shadow AI

Shadow AI refers to the use of AI tools within a company that is neither approved nor known — neither to the IT department nor to management. An employee simply opens a chatbot in the browser, pastes in confidential company data, and has an analysis generated. This costs nothing, requires no installation, and leaves no trace in the company’s software systems. That is exactly why it happens so often. The term is modeled on “Shadow IT” — the older term for any software that employees use without IT’s permission, such as private cloud storage or unapproved apps.

The risk for companies

The central problem is data control. Anyone who enters confidential customer data or trade secrets into an external chatbot sends that data to the servers of an outside company. What happens to it there — whether the data is used to train new models, who can access it — is beyond the company’s control.

This is not an abstract problem. In Europe, the General Data Protection Regulation (GDPR) precisely stipulates how personal data may be processed. If these rules are broken through Shadow AI, the company is held liable — not the individual employee who used the chatbot. In 2023, it became known that employees of the electronics manufacturer Samsung had entered confidential source code into ChatGPT. Samsung responded with an internal ban.

Another risk is the lack of quality control. AI models make mistakes. If no one in the company knows that a tool is being used, no one can check whether the results are reliable. Incorrect analyses or flawed texts can thus find their way into decisions unnoticed.

Why Shadow AI arises

Older software required installation, a license, and often approval from the IT department. Modern AI tools work in the browser, are free or very cheap, and deliver useful results within seconds. The barrier to entry has thus nearly disappeared.

Employees often use these tools not out of carelessness, but because they want to work more productively and are waiting for an official solution that either takes too long to arrive or never comes at all. Studies from 2023 and 2024 show that a significant proportion of office workers use AI tools without reporting it to their employer — in some surveys, over 50 percent of respondents admitted to this.

This creates a structural problem: the more useful AI tools become, the greater the incentive to use them — and the wider the gap grows between what companies officially deploy and what is actually happening.

Shadow AI in practice and in the news

In media coverage, Shadow AI mainly appears in three contexts: data protection scandals, when companies only discover after the fact that sensitive data has leaked out; new corporate policies, when companies respond to the trend by introducing clear rules for AI use; and product announcements, when companies like Microsoft or Google emphasize that their business versions of AI tools keep data within the corporate environment, aiming to make Shadow AI unnecessary.

For IT departments, Shadow AI has by now become its own area of responsibility. Some companies deploy specialized software that monitors network traffic and detects when employees access known AI services. Others take a different approach: they provide their own approved AI tools that are fast and useful enough that employees no longer have a reason to turn to external services.

Shadow AI is thus also a sign of how quickly AI technology is spreading — faster than companies and regulators can react.