Knowledge base
Shadow AI in your SME: staff using AI without you knowing
By Bob Biesemans · published on
Staff often use AI tools the company doesn't know about or hasn't approved. What are the risks of shadow AI, how do you map it, and why does a ban rarely work?
Short answer
Shadow AI is AI that staff use at work without the company knowing, such as a free chatbot or a browser extension. The risk lies in data reaching services without agreements and in AI texts nobody checks. Map it openly and without sanctions, offer a good business tool and measure whether people work safely.
What shadow AI is
Shadow AI is AI that staff use at work without the company knowing or agreeing: a free chatbot on a phone, a browser extension that rewrites emails, a translation tool that customer documents end up in. Usually with good intentions, to work faster.
The risks
Data: customer or staff data ends up with a service without agreements, while the GDPR still applies.
Quality: nobody checks whether the AI text is right, because nobody knows AI was involved.
Evidence: what you don't know about, you can't include in your measures under Article 4 of the AI Act.
Mapping it without a witch hunt
Ask openly and without sanctions which AI tools people use and for what. Answers are more honest when it is clear the aim is better rules, not punishment. Add what your IT management or software list shows.
Then measure in realistic situations whether staff recognise sensitive data and check AI output. That shows where the real risk is.
Why a ban rarely works
A blanket ban pushes use further out of sight. What works better: offering a good business tool, clear rules on data, and teaching people to use AI safely. Record what you did and measure whether it helped. General information, not legal advice.
Frequently asked questions
How do I know which AI tools my staff use?
Ask openly and without sanctions, and add what your IT management or software list shows. People answer more honestly when the aim is better rules.
Is shadow AI illegal?
Not in itself, but if personal data ends up in a service without agreements, it can be a problem under the GDPR.
Does a ban help?
Rarely. It pushes use further out of sight. An approved tool, clear rules and training work better.