Shadow AI: detect, reduce and replace unsanctioned use

As of 13 November 2026. General information, not legal advice.

What is shadow AI?

Shadow AI is the use of AI tools for work tasks that the organisation does not know about and has not approved. Typical cases are the private ChatGPT account on a work laptop, the free translator used for contracts, or a browser extension a team member installed on their own. Bad intent is rare; people want to work faster.

The risk lies in what is missing: a contract with the provider, a check of what happens to the inputs, a rule about which data may go in, and an overview of who enters what. How this affects personal data is covered in Is ChatGPT GDPR compliant?, and the everyday habits that reduce it are in Use AI at work without leaking company or personal data. The term is also defined in the glossary.

How common is shadow AI? What the German survey data shows

Reliable figures are scarce. We found no employee-level statistics from a credible source we could open and verify, and we do not cite vendor surveys. The best data we could check is German company-level survey data. The Bitkom study report "Künstliche Intelligenz in Deutschland", published in February 2026, asks companies whether staff access generative AI privately, outside the company's own offerings. Bitkom Research ran the survey by telephone in 2025 among 604 companies with 20 or more employees (calendar weeks 27 to 32).^[1]

These are self-assessments by companies, not measurements, and they come from Germany. A company that cannot see the use cannot report it. Other shadow-AI figures that circulate in blog posts and are attributed to Bitkom could not be confirmed in Bitkom's own documents, so they are not used here. A Bitkom press release of 14 September 2026 contains no shadow-AI figures.^[12]

Why do bans alone fail?

A ban without an alternative moves the use, it does not end it. People who find a tool useful reach for a private device and a private account, and that is exactly where the organisation can no longer see anything. This is a practical judgement, not a measurement. It matches the German data protection authorities' statement that without clear rules staff use AI on their own initiative, and that employers should provide work devices and work accounts so nobody has to use private ones.^[2]

Four things work better together: an AI acceptable use policy with an approved-tools list and data classes, work accounts on a suitable plan, a short training session and a simple way to request new tools. Bans stay right where they are specific: certain data classes or certain tools.

What risks does shadow AI create in practice?

The risk depends on the plan and the inputs, not on the name of the tool. On a private account, the terms of the consumer plan apply, and these differ from business plans.

• Training on inputs. On ChatGPT Free, Plus and Pro, OpenAI says data sharing is on by default for personal workspaces; it can be switched off in the settings.^[7] On Claude's consumer plans the user chooses whether chats may be used for training; if allowed, retention is up to five years.^[8] Business plans are treated differently: OpenAI does not use content from Business, Enterprise and the API for training by default, and Anthropic excludes Team, Enterprise and the API from its consumer terms.^[7][8] Plans change often; check the provider's page before relying on this, and see ChatGPT, Copilot, Claude and Gemini compared.
• No contract. OpenAI says it can conclude a data processing addendum for ChatGPT Business, ChatGPT Enterprise and the API; for the consumer plans it names none.^[11] A private account therefore has no contract that governs processing on your organisation's instructions.
• No trace inside the organisation. What happens on private accounts appears in no inventory. Access and deletion requests from data subjects are hard to answer if nobody knows where the data is.

The deeper problem is timing. Once a prompt has been sent from a private account, nobody in the organisation can see where the provider processes it, and nothing can be recalled; deleting the chat later acts on the future. That is why an approved tool and clear rules on what may be entered work better than a clean-up afterwards. The general argument is in where your data goes when you use an AI assistant.

How can you spot shadow AI without monitoring staff?

Most clues come from conversations and invoices, not from logs. That is a practical recommendation, and it also keeps the legal position simpler because no employee logs need to be analysed.

• Ask. An open, anonymous survey and a conversation in each team ("What do you use AI for, and what is missing?") tell you more than any technical analysis.
• Look at invoices. Cost centres, expense claims and company cards show paid AI subscriptions, where someone bills them to the organisation.
• Watch requests to IT. Questions about accounts, extensions and permissions show what teams want. Move these into a regular process.
• Treat odd text as a conversation starter. Wording that obviously came from an AI tool is not proof of a breach. It is a reason to talk, not to sanction.

Technical measures on work devices, such as block lists or centrally managed browser extensions, are possible but touch employee data and, depending on the design, co-determination. Clarify them before you introduce them.

How far may you go in monitoring employees?

You may detect use, but not without a legal basis and, in Germany where one exists, not without the works council. Any processing of employees' personal data, such as logs of visited websites or of inputs, needs one of the legal bases in Article 6(1) GDPR.^[6] The authorities also advise that staff should not have to use private accounts and that work accounts should carry functional names.^[2] Hamburg's data protection commissioner recommends business accounts without private use, strong authentication and switching off chat history on shared accounts.^[3]

Two points are disputed or open in Germany, so have them checked for your case.

• Works council. Under section 87(1) no. 6 of the Works Constitution Act, the works council has a right of co-determination when technical systems are introduced and used that are designed to monitor the behaviour or performance of employees.^[4] Whether a detection tool, for example one that analyses network logs, falls under it depends on the tool. Involve the works council before you introduce it.
• Section 26 of the Federal Data Protection Act (BDSG). After the CJEU judgment of 30 March 2023 (C-34/21) it is doubtful whether the general clause in section 26(1) sentence 1 BDSG can serve alone as a legal basis for processing employee data. The Hessian commissioner points in practice to Article 6(1)(b), (c) and (f) GDPR.^[5] The literature is divided. Do not rest monitoring on section 26 alone.

The practical consequence: the less personal employee data you have to process, the simpler the legal position. An anonymous survey, an approved-tools list and work accounts often achieve more than log analysis. We did not check whether a new German employee data protection act has since come into force; ask your legal adviser. Other EU countries have their own rules on workplace monitoring; this section does not cover them.

30-day plan against shadow AI

The plan needs no technical monitoring and can be run without a large IT department. Give every step a named owner.

1. Days 1 to 3: settle responsibility. One person leads the effort and reports to the management. Owner: managing director. Output: name, mandate, schedule.
2. Days 3 to 7: anonymous survey. Ask which AI tools staff use for which tasks and what they are missing. The survey is voluntary and anonymous, with no names and no IP analysis; agree it with the works council where there is one. Owner: IT or HR. Output: list of tools and tasks.
3. Days 7 to 12: assess the tools. For the tools named, check the plan, the data processing agreement and what happens to inputs regarding training. Owner: data protection officer or IT. Output: one assessment per tool.
4. Days 10 to 15: set the approved list. Choose one to three tools on business plans and set up work accounts. Owner: managing director and IT. Output: approved-tools list.
5. Days 12 to 18: write the policy. Start from the policy template and adapt tools and data classes. Involve the data protection officer and employee representatives. Owner: data protection officer. Output: adopted policy.
6. Days 18 to 24: brief the teams. Half an hour per team: approved tools, data classes, reporting route. Record attendance. Owner: HR and team leads. Output: attendance list.
7. Days 24 to 28: amnesty and reporting route. Announce that earlier private use can be reported without consequences, and name the contact person. Agree this promise with your legal adviser and the employee representatives. Owner: managing director. Output: message to everyone.
8. Days 28 to 30: schedule the repeat. Decide when the survey, the approved list and the policy are reviewed again, for example yearly. Owner: project lead. Output: date in the calendar.

If staff need texts that contain personal data, the data-class question remains. The rules are in the policy, and the background on removing identifying details is in Anonymise data before ChatGPT.

Next step

Start with the anonymous survey in step 2. It costs little, shows which tools are actually used and gives you the basis for the approved list. Before you send it, talk to your data protection officer and, if there is one, the works council about how the survey is designed.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.