Shadow AI: What It Is and How to Bring It Under Control

Shadow AI is any AI tool your people use for work that the company has not approved. Often it is a chatbot such as ChatGPT or Claude, used on a personal account. You bring it under control in four steps. See which tools are in use, give people a company account, close personal accounts on the company network, and write one page of rules.

Picture a controller on a Thursday evening. The board pack is due in the morning. The month’s figures, with customer names, go into the chatbot they use at home. The comment is written in two minutes. Nobody is alerted. The chat stays in a private account, and it leaves the company when the controller does.

Nobody in that story meant harm. The private tool was faster than the official way, or there was no official way. That is why the German Economic Institute (IW) calls shadow AI a sign of demand.^[2] This guide is for companies in Europe with 200 to 2,000 people.

Key takeaways

Shadow AI is common. In a 2026 survey in Germany, 29.1% of employees who use AI at work used tools their employer had not provided. That does not have to mean secret or forbidden.^[2]
The main risk is the data. It leaves with no contract and no log. The company cannot delete it when someone leaves.
Microsoft 365 can show you which AI apps are in use. Blocking them needs higher licences, and a block without an alternative can push the use to private phones.
Claude Enterprise and ChatGPT Enterprise can each shut out personal accounts on the company network. Do it once people have a company account they like.

What is shadow AI?

IBM defines it as “the unsanctioned use of any artificial intelligence (AI) tool or application by employees or end users without the formal approval or oversight of the information technology (IT) department”.^[1] Microsoft puts it more narrowly: consumer AI apps and standalone agents “deployed across your organization without IT visibility or approval”.^[3]

In a normal company it takes five forms:

Chat assistants on personal accounts. ChatGPT, Claude, Gemini or Perplexity, signed in with a private email address.
Meeting note-takers. A tool that joins the call, records it and writes the summary.
Browser extensions. Writing helpers that read the page you are working on.
AI features inside software you already pay for. Switched on by a user, often without IT knowing.
Home-built automations and agents. A small workflow a colleague built and connected to the mailbox with their own login.

How common is shadow AI in Europe?

The newest numbers come from Germany, and they point the same way.

Almost three in ten. The IW asked almost 5,000 employees in March and April 2026. Of those who use AI at work, 29.1% use tools their employer did not provide. The IW notes that this does not have to mean secret or forbidden.^[2]
Less in larger firms. The share is 33.5% in companies under 50 people and 25.5% in companies of 250 or more, which provide AI tools more often.^[2]
More where AI skills are promoted. Where employees say their employer strongly builds AI skills, 44.5% use shadow AI. Where employers do nothing, it is 21.3%.^[2] The IW suggests both may come from the same thing: work where AI is useful.
Few companies supply the tools. In a Bitkom survey of 604 German companies in 2025, only 26% gave their staff access to generative AI, and 23% had rules for AI tools.^[4]

The habit has a name. Microsoft and LinkedIn called it “bring your own AI” (BYOAI) in 2024. In their survey of 31,000 people, 78% of AI users brought their own tools to work.^[5]

For a company, the lesson is practical. When you train people on AI, give them the tool at the same time.

Why shadow AI is a risk for a European company

A personal AI account compared with a company account: contract, training on the data, logs and what happens when someone leaves

1. The data leaves without a contract

On a business plan, your company signs the contract. On Claude Team and Enterprise, for example, your company is the controller under data protection law. Anthropic acts as the processor.^[8] A personal account is a contract between one employee and the vendor. Your company is not part of it, so there is no processor agreement for the company data that goes in.

2. The data may train the model

Consumer plans work differently. On Claude Free, Pro and Max, chats are kept for five years if the user allows them to be used for training.^[6] On the business plans, Anthropic and OpenAI both say they do not train on your data by default.^[10]^[11]

3. Nothing is logged, and nothing is handed over

IT cannot see a private account. Nobody can search it after an incident. When someone leaves, the chats, the prompts and the files leave with them.

4. It costs more when something goes wrong

IBM’s 2025 report studied 600 organisations that had a data breach. One in five reported a breach due to shadow AI. Where shadow AI was high, a breach cost about $670,000 more.^[7] In the same study, 63% of the breached organisations had no AI governance policy or were still writing one.^[7]

And the law expects you to act

The EU AI Act asks companies that use AI to “take measures to support the development of AI literacy” of their staff. This duty has applied since 2 February 2025.^[12] Knowing which tools your people use is a sensible first measure. Our guide to EU AI Act Article 4 explains the July 2026 changes. In Switzerland, the data protection commissioner says the data protection act applies directly to AI.^[13]

One honest limit: a personal account is not always a breach. If someone asks a chatbot to rephrase a public press release, little is at stake. The problem is that you cannot tell which case you are in, and you cannot prove it later.

This is a summary of public sources and not legal advice. Ask your data protection officer how it applies to you.

Four steps to bring shadow AI under control

The order matters. A block without an alternative leaves people with their private phones, where the company sees nothing. So the company account comes before the block.

Step 1: See which tools are in use

If your company runs Microsoft 365, start there. Four places are worth knowing.

Where Microsoft 365 shows shadow AI, and what Microsoft says you need (October 2026)
Where, and what you need	What it shows or does
Cloud app discovery Included in Entra ID P1, EMS E3 and Microsoft 365 E3. It reads firewall or proxy logs that you upload.^[14]	Which cloud apps are used. The catalogue holds more than 1,000 generative AI apps.^[15] Discovery straight from devices needs the full Defender for Cloud Apps with Defender for Endpoint.^[14]
Marking an app “unsanctioned” Defender for Cloud Apps with Defender for Endpoint, or Microsoft 365 E5, with network protection in block mode^[18]	Blocks the app on devices onboarded to Defender for Endpoint.^[17] It can take up to three hours to apply.^[18]
Purview, data security for AI Set up with endpoint data loss prevention (DLP)^[19]	Detects sensitive information pasted or uploaded into AI websites^[19]
Shadow AI page, Microsoft 365 admin centre Public preview. Microsoft 365 E5, Defender for Endpoint and Intune^[3]	Detects desktop apps such as ChatGPT and Claude. It can block only one app, OpenClaw.

Three things to know before you open the reports. Discovery shows use and blocks nothing on its own. It works from traffic records, so it shows the app and leaves open which account was used, which step 3 deals with. And the history covers 90 days, so look at it once a quarter.^[16]

Without Microsoft’s tools, three sources still work. Firewall, proxy or DNS logs show the AI sites people visit. Card statements and expense claims show the AI subscriptions people pay for themselves. And a short, anonymous question to your teams tells you what the logs cannot. Which work do they use AI for? Why did the official way not fit?

Step 2: Give people a company account they want to use

Data protection authorities point the same way. The German authorities, writing together, say that employers should provide devices and accounts for the work use of AI.^[21] The Hamburg authority puts it from the other side: “Employees should not create an account on their own using private data.” Without internal rules, it adds, the employer may be liable for what staff do with these tools.^[9] The French authority, the CNIL, advises against accounts created with personal email addresses and asks for internal rules that list the allowed and forbidden uses.^[22]

Pick the tool by the work, starting with the tools on your list from step 1. The main choices are Claude Enterprise, ChatGPT Enterprise and Microsoft 365 Copilot. Our guides compare them: ChatGPT Enterprise vs Claude Enterprise, Claude Enterprise pricing and ChatGPT Enterprise pricing.

People switch when the company account is better. On a company account, IT connects the company’s systems once, such as the CRM, email, the calendar and your documents. Each person sees only what their permissions allow. Nobody connects a private account to company data. See how Claude Enterprise works inside your systems or how ChatGPT Enterprise is set up.

Step 3: Close personal accounts on the company network

Personal accounts are a large share of the problem. Cyberhaven, a security vendor, looked at its own customers’ data. It found that 32.3% of ChatGPT use ran through personal accounts.^[24] Both vendors offer a way to shut them out on the company network.

Claude: Tenant Restrictions. Your proxy adds a header, anthropic-allowed-org-ids, to traffic to Claude. Anyone who tries a personal account gets the message “Access restricted by network policy. Contact IT Administrator.” It is available on Enterprise plans and needs TLS inspection on your network.^[20]
ChatGPT: Workspace Blocking. Your network adds the header ChatGPT-Allowed-Workspace-Id with your workspace ID. Every other workspace, including personal ones, is filtered out. It is a ChatGPT Enterprise feature and needs SSL inspection. Use without any account needs a separate block.^[23]
Other AI apps. Mark them unsanctioned in Microsoft Defender, as in step 1, or block them in your firewall.

One limit: these controls see only traffic that passes your inspecting proxy. ChatGPT’s desktop and mobile apps also need your own certificates added through device management.^[23] A private phone on mobile data stays outside. That is one more reason the company account has to be the better option.

Step 4: Write one page of rules

An AI use policy fits on one page. It answers six questions:

Which tools? Name them, and say that work happens on company accounts.
Which data? Three classes are enough: public, internal and restricted, with one line on where each may go.
What never goes in? For example, health data, passwords and anything under a confidentiality agreement.
Who checks? A person reads what AI wrote before it leaves the company.
Where do new tools go? One place to ask, with an answer within days. If the answer takes months, people will not wait.
How do people learn it? A short training when the account is switched on, and a reminder each quarter.

Our guide to the AI governance framework for mid-sized companies turns this into five decisions on one page, each with an owner.

What it looks like in practice

In PromptPartner’s method, the rules come in the second step, before anything goes live. Legal, IT and the brand owner decide the approved tools, the data classes and the approval steps once. Then the company accounts are switched on, and the first use cases go live inside the systems your team already uses. See the method, from assessment to rollout.

If you do not yet know which uses of AI pay off, start one step earlier. An AI assessment shows which use cases are worth it. It also lists the AI tools your people already use, and what company data they put into them. Then the company account arrives with work people want to do in it.

Frequently asked questions

What is shadow AI?

Shadow AI is any AI tool that people use for work without the company’s approval. A common case is a chatbot such as ChatGPT or Claude on a personal account. Meeting note-takers, browser extensions and home-built automations count too.

Why is shadow AI a problem?

Company data goes into an account that the company has no contract for, cannot see and cannot close. On some consumer plans the data may be used to train models. In IBM’s 2025 study of 600 organisations that had a data breach, one in five reported a breach due to shadow AI.

How do you detect shadow AI?

In Microsoft 365, cloud app discovery shows which AI apps are used. The version included in Entra ID P1, EMS E3 and Microsoft 365 E3 reads firewall or proxy logs that you upload. Expense claims and a short anonymous staff survey fill the gaps.

How do you stop shadow AI?

You bring it under control in four steps. See which tools are in use, give people a company account they want to use, close personal accounts on the company network, and write one page of rules with training. The company account comes first. A block without an alternative moves the use to private phones.

What is the difference between shadow AI and shadow IT?

Shadow IT is any software or device used without IT’s approval. Shadow AI is the part that concerns AI tools. The difference is the data: text typed into a free AI plan may be kept and used to train models, depending on the plan and its settings.

Is using a personal ChatGPT account at work a GDPR problem?

It can be, when personal data goes in, because your company has no processor agreement for a private account. The German, Hamburg and French data protection authorities all steer employers towards company accounts. Ask your data protection officer how it applies to you.

What is BYOAI?

BYOAI means “bring your own AI”: people using their own AI tools at work. Microsoft and LinkedIn used the term in 2024, when 78% of AI users in their survey said they did so.