What is shadow AI? Risks, detection and what to do about it

What is shadow AI?

Shadow AI is any use of AI for work outside what your organisation has approved. It is a kind of shadow IT, with one difference: with cloud AI tools, every prompt sends text or a file to an outside vendor. Common examples:

• Personal accounts with ChatGPT, Claude, Gemini or DeepL, free or paid.
• AI features in software you already use, such as a summarise button in your CRM or video-call tool. Sometimes the vendor switches them on.
• AI browser extensions that read the pages someone opens, including webmail and customer systems.
• Meeting bots that join online calls, record them and send round a summary.
• AI apps that someone gives access to work email, calendar or files through "Sign in with Microsoft" or "Sign in with Google".

Why do employees use AI tools without permission?

Because it gets work done faster and nothing approved is available, or the approved tool is worse. According to Statistics Netherlands figures for 2025, 43 percent of Dutch working adults use AI in their work, and 56 percent of those with a university or higher vocational degree. CBS does not measure whether the employer approved that use.

A vendor survey gives an indication: in the 2024 Work Trend Index from Microsoft and LinkedIn, 78 percent of the knowledge workers who use AI said they bring their own AI tools to work. That is not the same as unapproved use, and Microsoft sells the business alternative. Only 39 percent of AI users had AI training from their employer.

What are the risks of shadow AI?

The main risk is personal data or confidential information reaching a vendor you have no agreement with. What OpenAI does with input per plan, and how the Dutch data protection authority and the city of Eindhoven handled such breaches, is in our guide on whether ChatGPT is safe for business.

• No data processing agreement. On a personal account the vendor decides what happens to the input, and on free plans that can include training.
• Too much access. A connected app or extension can read a whole mailbox or folder, and keeps that access until someone revokes it or closes the account.
• Client agreements. Confidentiality clauses and professional secrecy also cover what someone pastes into a chat window.
• No record. If a client or regulator asks where data went, you cannot answer. The chats sit in a personal account that leaves with the employee.
• Unchecked output. Nobody agreed that AI-written text gets reviewed before it reaches a client.

How do you find out which AI tools employees use?

Ask first, then look in systems you already have. A short anonymous survey or a team discussion works best when you say upfront that honest answers have no consequences.

In Microsoft Entra, Enterprise apps shows which apps can reach work accounts, and per app which permissions users or admins granted. With Microsoft's default consent setting, most apps now need admin approval to read mail, calendars or shared files. Tenants with an older or custom setting can still allow it, so check which one yours uses. In the Google Workspace Admin console, the same list is under Security, Access and data control, API controls, as Accessed apps.

Can you monitor which AI tools employees use?

Yes, within limits. Under the GDPR you need a lawful basis, and the monitoring must be necessary and proportionate. Record that first, with who sees the logs and how long you keep them. The Dutch data protection authority says an employer may set rules for internet use and check them, but must tell staff the rules and that checks can happen. In the Netherlands a works council has a consent right on any system that monitors staff behaviour or performance (Article 27 of the Works Councils Act), so ask its consent for the logging arrangement before you start. Elsewhere, check your own country's consultation rules.

Look at tools, not people. "Twenty people use an AI meeting bot" is enough to make a decision. Tracking who typed what costs you the trust you need for honest answers.

How do you prevent shadow AI?

Provide an approved tool that works at least as well. Then set the rules, and explain them.

• Pick a tool per task with a work account and a data processing agreement. ChatGPT Business usually starts at two users, Copilot Chat comes at no extra cost with eligible Microsoft 365 plans, and seef also answers from your own documents.
• Write down which tools are allowed and what never goes in. Our AI policy template is ready to copy.
• Route new app connections through IT: restrict user consent and switch on an approval request flow, so a request gets a yes or no within days.
• Explain why. The AI Act requires measures for AI literacy, and people follow rules they understand.
• Make reporting safe: nobody gets penalised for reporting their own mistake.
• Review app connections every quarter, and ask people what they are missing.

Does banning ChatGPT work?

Usually only with an alternative next to it. A block on the company network does not reach phones or home networks, so use moves out of sight. Block a tool that leaks sensitive data at once; for the rest, offer the approved tool first. Defender for Cloud Apps can also show a warning for an unsanctioned app instead of blocking it.

seef is one such alternative when staff paste contracts, procedures or client files into personal accounts. For the risks above, seef offers a data processing agreement, a knowledge base that holds only what you add, chat history kept in your company's environment instead of personal accounts, and answers that show their sources. People sign in with their Microsoft 365 or Google Workspace account, and you choose the models with us.