Governance
Shadow AI: Data and Compliance Risks and How to Manage It
Editorial team Delphis · Published on · 6 min read
Shadow AI is the use of artificial intelligence tools by employees or teams without the company having assessed or authorized them, or even knowing they exist. The typical case is a person using an AI assistant on a personal account to summarize a document, write a text or analyze work data.
It is neither a marginal phenomenon nor, in the great majority of cases, an act of bad faith. It is the result of a real need that official channels have not yet met. Understanding this is the first step to managing it, and it must come before writing any ban.
Why shadow AI emerges
Shadow AI grows where the gap between what people want to do and what the company provides is widest. Four causes recur.
- Official tools absent or late. Purchasing and assessment processes are slower than the evolution of the tools, and anyone with an urgent task looks for something on their own.
- Licenses given to a few. When seats are assigned to part of the organization, those left out find free alternatives.
- Unclear rules. Without an understandable policy, each person decides for themselves what is acceptable.
- Ease of access. Many services can be used within seconds, with a browser and a personal email address.
The result is a share of use that happens on personal accounts and stays invisible to the admin consoles of company vendors. Any adoption estimate based only on official licenses is therefore incomplete, which is why adoption measurement should always include a survey.
What risks it creates for data and compliance
Risks depend on which information is entered and which service receives it. The regulatory content below is informational and is not legal advice.
Confidentiality and intellectual property
Internal documents, source code, commercial terms or strategies may be entered into services whose data-use terms the company does not know. Without a contract, there is no guarantee on retention, reuse or access to the information entered.
Personal data protection
If the information includes personal data of customers, candidates or colleagues, the GDPR (Regulation (EU) 2016/679) comes into play. The aspects to consider are the legal basis for processing (art. 6), general principles such as data minimization and purpose limitation (art. 5), information to data subjects (arts. 13 and 14), whether the vendor should be appointed as processor (art. 28) and transfers to third countries (Chapter V). For high-risk processing, an impact assessment may be needed (art. 35). With shadow AI, none of these steps is managed, because the company does not know the processing is happening. We cover this in GDPR and generative AI at work.
Security and supply chain
For entities within the scope of the NIS2 Directive (Directive (EU) 2022/2555, transposed in Italy by Legislative Decree no. 138 of 4 September 2024), digital service providers are part of the supply chain that must be overseen. An unrecorded AI service is an unassessed vendor, with unknown contract terms, security measures and processing locations. The link between NIS2 and AI calls for a dedicated assessment, which starts with a census of the tools actually in use.
The EU AI Act and quality of use
The EU AI Act (Regulation (EU) 2024/1689) sets an AI literacy obligation (article 4), applicable from 2 February 2025, and obligations for those deploying high-risk systems. If a use case escapes the census, the company cannot know whether it falls into one of these categories or whether its users have received adequate training. For the timetable of other obligations, it is wise to check for updates.
Quality of decisions
There is also a non-regulatory risk: unverified outputs, used without checks in documents or decisions, with responsibilities nobody has assigned. Models can produce plausible but wrong answers, and people working outside official channels have no guidance on how to verify them, nor anyone to report a problem to.
How to detect shadow AI
Detecting does not mean monitoring. Under the Italian Workers' Statute (Law no. 300 of 20 May 1970, article 4), remote monitoring is subject to limits and conditions, so the preferable approach is aggregated and declarative. The topic is developed in monitoring AI use and the Italian Workers' Statute.
Two sources work well together.
- Surveys. Short, anonymous or aggregated by department and role, they ask which tools are used, for which tasks, how often and why. They work if it is clear they are not meant to sanction anyone.
- Official vendor data. Admin consoles expose usage data to varying degrees. A department with low activity on official tools but survey answers reporting heavy use signals likely reliance on unauthorized alternatives.
Comparing the two is the most useful signal: the distance between declared use and official use shows where the phenomenon is concentrated. It also helps to read answers by use case, because they show which needs go unanswered.
How to manage it without banning everything
A blanket ban is the most common reaction and the least effective. It does not remove the need, it moves use to personal devices and makes the phenomenon even less visible. Sustainable management proceeds step by step.
- Listen. Run the survey and record the use cases that emerge, with no consequences for respondents.
- Classify. Separate low-risk uses (text without sensitive data) from those touching personal or confidential data or significant decisions.
- Offer official alternatives. Provide assessed tools, with adequate contracts, for the most widespread needs.
- Write simple rules. A short policy stating what is allowed, what must not be entered and whom to ask. See how to write a company AI policy.
- Train. Explain risks with concrete examples, in line with the AI literacy obligation in article 4 of the EU AI Act.
- Register use cases. Bring the cases that emerged into the register, assigning an owner.
- Measure again. Repeat the survey after a few months to check whether the gap between declared and official use is narrowing.
Step 3 weighs more than all the others: if the official tool is good and accessible, the incentive to look for others falls. It is also worth recognizing those who experimented first: use cases that emerged from shadow AI are often the best candidates for an official path, because they come from a concrete work problem.
Limits of the approach
No method gives a complete picture. Surveys depend on people's trust and may underestimate. Vendor data sees only official tools. The estimate of shadow AI therefore remains an order of magnitude useful for deciding, not an exact measure, and should be presented as such.
Where Delphis fits
Delphis is a vendor-independent platform that connects spend, adoption, impact and regulatory obligations. For shadow AI, it pairs vendor usage data with surveys aggregated by department and role, so it can estimate unofficial use without assessing people one by one. Regulatory mapping helps clarify obligations and gaps, but it is not legal advice. See the compliance page.
Sources
Frequently asked questions
- What is shadow AI?
- It is the use of AI tools by employees or teams without the company having authorized them or being aware of them, typically through personal accounts or free services.
- Why does banning all AI tools not work?
- A ban does not remove the need that pushes people to use AI. It moves use to personal devices and accounts and makes the phenomenon even less visible. Official alternatives and clear rules work better.
- How can you detect shadow AI without monitoring individual employees?
- With anonymous or department-level surveys and with usage data from official vendors, compared against what people report. The goal is to understand needs and risks, not to monitor individuals.
- What GDPR risks does shadow AI create?
- Personal data may be entered into services without an assessed legal basis, without a vendor agreement and without informing data subjects, with possible transfers to third countries. Each case needs its own assessment.
Want to see it on your own AI tools?
A demo on your use cases, with our team and no commitment.
Request your obligations map