A guide for executives, IT departments and CISOs

Shadow AI: when your teams use AI without telling you, and what to do about it

Shadow AI (or shadow IA, ghost AI) means using AI tools at work without the company's approval or knowledge: ChatGPT on a personal account, an extension installed on your own, a contract pasted into a chatbot. It is not primarily misconduct, it is an unmet need. The answer: equip, don't ban.

Book 20 minutes with us See the 5 steps

01The definition

Shadow AI, ghost AI, unsanctioned AI: what are we talking about?

All three terms mean the same thing: uses of generative AI that the company has not chosen, seen or governed. Shadow AI is a form of shadow IT, with an extra risk.

CriterionShadow ITShadow AI
What slips out of controlsoftware or a service that hasn't been approvedan AI tool, and above all what people feed it
What goes outfiles stored elsewherethe substance of the work: text, figures, code
What comes backnothing newmachine-generated text, sometimes wrong, reused as is
Cost of entrya subscription, often visibleoften zero: a browser is enough

02The causes

Why shadow AI is spreading

Shadow AI is spreading because the tools are free and immediately useful, while company rules arrive after people have started using them, if they arrive at all.

  • A consumer tool can be up and running in two minutes, with no purchase and no approval.
  • The need is real: writing, summarizing, translating, searching faster.
  • Nobody really knows what is allowed, so everyone decides on their own.

According to the Microsoft and LinkedIn Work Trend Index (31,000 people surveyed in 31 countries, published May 8, 2024), 78% of AI users at work bring their own tools, and 80% in SMEs. And 52% are reluctant to admit using it for their most important tasks.

03The risks

The real risks of shadow AI, and the overrated ones

The risk of shadow AI is not the tool: it is what people send to it without rules, and what they reuse without checking.

Data going out

Contracts, figures or code sent from a personal account: the company knows neither where they are, nor whether they can be used to train a model.

Trade secrets

The CNIL, France's data protection authority, recommends prohibiting confidential data depending on the tool, and avoiding accounts created with a personal email address.

Unchecked quality

A made-up figure ends up in a client proposal. Nobody checks it, since nobody knows AI was involved.

Compliance

Personal data: what the GDPR says is clear, you remain the data controller. The AI Act (Article 4) also requires you to build your teams' AI literacy: hard to do for uses nobody can see.

What's overrated: the tool itself. On their enterprise plans, Anthropic, OpenAI and Microsoft do not train their models on your data by default. The danger comes from personal accounts and the lack of rules.

This content is not legal advice. Have your rules validated by your lawyer or your DPO.

04The method

Banning doesn't work: 5 steps to take back control

Taking back control of shadow AI means moving hidden uses to official tools that are more convenient than personal accounts.

  1. Take inventory, with no sanctions

    An anonymous questionnaire and team-by-team conversations: which tools, for which tasks, with which data. Announce up front that no answer will be sanctioned.

    The IT department adds what it already sees: network logs, extensions, expense reports, a DLP tool such as Microsoft Purview.

  2. Sort by use and by data

    For each use found: useful or not, and what level of data it touches. The risk lies where the two meet.

  3. Roll out official tools

    Replace personal accounts with business accounts, for example by moving to Claude Team. If the official tool is more convenient, the hidden tool disappears.

  4. Write a one-page rule

    Allowed uses, permitted data, who approves. Start from our AI usage policy template rather than a blank page.

  5. Train and follow up

    Training teams on the official tools, using their real files, is what drives adoption. Repeat the inventory six months later.

We can take the inventory with you, with no detection tool to sell.

Book 20 minutes

05The roles

AI governance: who decides what

AI governance means knowing who chooses the tools, who sets the data rules and who answers the teams. Without named owners, shadow AI comes back.

  • Leadership: owns the decision and weighs use against risk.
  • IT department: approves tools, opens accounts, manages access.
  • CISO: sets the security rules and tracks incidents.
  • DPO: says which personal data can go where.
  • Business teams: report their needs and test on their own files.

Our method ends with a written decision: for each use, the chosen tool, the permitted data and the owner, captured in an AI usage policy. Kailli, an applied AI transformation firm, brings an outside perspective on how you use AI and sells no tools.

Written by Rémi Carbonnefounder and CTO of Kailli

Frequently asked questions about shadow AI

What is shadow AI?

Shadow AI is the use of AI tools at work without the company's approval or knowledge. The most common case: ChatGPT or Claude on a personal account, with work documents.

What is the difference between shadow AI and shadow IT?

Shadow IT refers to any software used without the IT department's approval. Shadow AI is one form of it, with an extra risk: AI-generated text enters the work without any review.

Is shadow AI illegal?

Using an AI tool is not illegal in itself. The risk comes from what you put into it: personal data creates liability for the company under the GDPR, and confidential data can breach a contract.

How do you detect shadow AI in a company?

Ask first, with no sanctions: an anonymous questionnaire reveals more uses than a tool. Then add network logs, installed extensions and expense reports.

Should ChatGPT be banned at work?

A ban with no alternative pushes usage onto phones and personal accounts. It is better to roll out a business tool and say clearly what can be put into it.

Who is responsible for AI governance?

Leadership owns the decision. The IT department chooses the tools, the CISO sets security, the DPO rules on personal data, and business teams report their needs.

Twenty minutes. And you'll know whether we can help.

No sales pitch. You tell us where you stand with AI, we tell you how far you can go.

Book 20 minutes Prepare for the call