Shadow AI
Employees using AI tools without the company knowing or having authorised it.
Shadow AI refers to AI tools staff use on their own: free chat assistants, browser extensions, meeting transcribers or image generators nobody has reviewed. It usually starts with good intentions (saving time), but creates real risks.
The main ones: personal or confidential data leaving the company to external services; decisions based on outputs nobody has validated; GDPR and AI Act breaches the company does not even know about; and being unable to answer an authority asking which AI is in use.
Banning everything does not work. What works is detecting what is being used, offering approved alternatives, publishing an acceptable use policy and training staff. That way shadow AI ends up in the inventory.
Read more: Create your company's AI use policy for free in 2 minutes.
Reference: Arts. 4 y 26 AI Act; RGPD
Related terms
Take the free assessment and find out in a few minutes which obligations your company has and where to start.
← Back to the glossaryUpdated: October 2026 · Informational content, not legal advice.