Shadow AI – a silent threat to organizations

Article published in December 2024, updated on September 27, 2026: the section on the AI Act has been corrected (Article 4 deals with AI governance and applies to organizations whose employees use AI, including via Shadow AI) and incorporates omnibus regulation (EU) 2026/1744; references to the NIS2 directive have been clarified.

The use of artificial intelligence (AI) has become widespread. Access to AI applications like ChatGPT, among others, is easy and often free or inexpensive. Many organizations have not yet implemented AI policies or are generally unaware of the risks associated with their employees’ private use of AI for business purposes.

Shadow AI is a phenomenon of our times, comparable to some extent to the BYOD (Bring Your Own Device) issue in cybersecurity, which sparked a major governance debate a few years ago. The risks are partly comparable, but while BYOD can be managed technically to some extent, Shadow AI threats are much more difficult to control. Managing these threats requires a targeted approach.

Introduction

Artificial intelligence (AI) is transforming industries, unlocking new efficiencies and driving innovation across the public and private sectors. However, alongside this transformative potential lies a little-known risk for which few organizations are prepared: Shadow AI—the unauthorized and uncontrolled use of AI tools by employees or departments within an organization. These tools often operate without the knowledge or approval of IT or compliance teams, bypassing established governance frameworks and exposing organizations to significant risk.

Whether it’s employees using free generative AI platforms to write reports, analyze sensitive data, or use AI translation tools, Shadow AI introduces serious vulnerabilities. These risks are particularly pronounced in public and judicial governance, where mishandling of sensitive legal or administrative data can have serious consequences. However, the private sector is no less vulnerable, particularly because of its obligations to protect, among other things, customer information, trade secrets, and intellectual property. Moreover, all organizations run the risk of GDPR violations if sensitive private data is used in this context.

Consider an employee at a private law firm using an unauthorized AI tool to analyze client documents. Without proper oversight, sensitive information could be exposed to external systems or used to train AI algorithms outside the organization’s control. Similarly, in industries like finance, healthcare, or technology, unvetted AI tools could leak proprietary information, leading to reputational damage, legal liabilities, or competitive disadvantages.

The implications of Shadow AI extend far beyond operational inefficiencies. They touch on fundamental legal and ethical obligations, such as compliance with the General Data Protection Regulation (GDPR), which imposes strict controls on the processing of personal data, and NIS2, which requires robust cybersecurity measures to manage risks, including unauthorized technologies. For private organizations, these risks directly challenge their ability to maintain customer trust and protect their competitive position.

This article aims to alert public and private sector leaders to the urgency of addressing the Shadow AI problem. It will examine the risks posed by Shadow AI, how it is categorized in relevant regulatory frameworks, and the strategic and operational measures that organizations can implement to mitigate these risks.

It is crucial to emphasize that even organizations without approved AI applications must act now. Governance policies, training, and education are essential to building resilience against Shadow AI, protecting not only organizational data, but also public or customer trust and system integrity. Now is the time to raise awareness and take action. Shadow AI may be invisible, but its risks are very real.

Understanding Shadow AI: Definition, Examples and Risks

What is Shadow AI?

Shadow AI refers to the unauthorized use of artificial intelligence tools and applications within an organization. These tools are often deployed without the knowledge, approval, or explicit oversight of the organization’s IT, compliance, or governance teams. Shadow AI can take a variety of forms, from free online generative AI tools to advanced analytics or machine learning software downloaded and used by employees or teams. This can involve the organization’s devices or the personal devices of the affected individuals (hence the reference to BYOD).

While Shadow AI is often the result of employees’ efforts to improve efficiency or solve problems, its unregulated nature introduces risks that organizations are not necessarily equipped to manage. These risks include data privacy breaches, regulatory violations, security vulnerabilities, and operational inefficiencies.

How does Shadow AI appear?

Shadow AI generally develops due to the following factors:

• Access facility : Many AI tools are readily available online and offer free or low-cost versions.
• Employee autonomy : Employees may feel empowered to experiment with AI tools to optimize workflows or improve productivity without consulting IT teams.
• Lack of awareness : Organizations without clear AI policies leave employees in the dark about the risks associated with unauthorized tools.
• Failure of computer monitoring : IT departments may lack the resources to monitor and manage the proliferation of unsanctioned AI applications.

Real-world examples of Shadow AI

1. Generative AI for Document Writing : An employee uses a free generative AI tool, like ChatGPT, to draft sensitive contracts.
   • Risque : The AI ​​platform could retain the text, potentially exposing sensitive data or intellectual property to external parties.
2. AI Translation Tools : An official uses a translation tool to convert a confidential inter-agency communication into another language.
   • Risque : Data could be stored or exploited by the third-party provider, leading to leaks or privacy violations.
3. Machine learning for financial analysis : A financial analyst downloads a free AI model to analyze market trends or customer data.
   • Risque : Proprietary algorithms or customer financial data could be exposed, in violation of regulatory frameworks.
4. AI in the healthcare sector : Medical staff use unapproved AI-based diagnostic app to analyze patient scans.
   • Risque : Violation of GDPR due to unauthorized processing of sensitive data, with potentially inaccurate or unreliable results.
5. Marketing automation : A marketing team uses unauthorized AI tools to analyze customer behavior or send automated messages.
   • Risque : Non-compliance with data protection regulations (e.g. GDPR), leading to potential fines and reputational damage.

Exemplary risks associated with Shadow AI

1. Data Privacy and Security Risks : Unauthorized AI tools often process sensitive personal or organizational data, bypassing existing safeguards.
   • Example : Customer data entered into an AI platform could be retained by the vendor and used for training, in violation of GDPR.
2. Regulatory compliance risks : Shadow AI may lead to violations of regulations such as GDPR, NIS2 or industry-specific frameworks (e.g. DORA for finance).
   • Example : Using unapproved AI tools to analyze sensitive financial data could result in fines for non-compliance.
3. Operational risks : Shadow AI tools may not integrate well with existing systems, causing inefficiencies or errors.
   • Example : An unverified AI model used to analyze legal cases produces inaccurate results, wasting time and resources.
4. Reputational risks : Breaches caused by Shadow AI can harm the credibility and trust placed in an organization.
   • Example : A leak of sensitive data via an unauthorized AI translation tool could undermine public confidence in the justice system.
5. Cybersecurity risks : Shadow AI applications can introduce vulnerabilities, such as backdoors for cyberattacks or unauthorized access.
   • Example : An untrusted AI tool connected to an unsecured network creates an entry point for ransomware attacks.
6. Legal risks : Decisions or results generated by Shadow AI tools may lack legal validity or accountability.
   • Example : Decision made using unapproved AI software in public administration leads to legal dispute due to lack of documentation or supervision.

Shadow AI as a Cybersecurity and Operational Risk

Shadow AI is not just a regulatory compliance or operational inefficiency issue; it also represents a major cybersecurity risk, capable of disrupting organizational integrity, exposing sensitive data, and opening the door to malicious attacks. This risk is exacerbated by the operational challenges it introduces, undermining governance frameworks and fragmenting workflows. The importance of treating Shadow AI as both a cybersecurity and operational risk cannot be understated, particularly given the increasing reliance of public and private organizations on AI-driven systems.

Shadow AI as a Cybersecurity Risk

1. Unverified entry points for cyber attacks : Shadow AI tools often bypass IT approvals and organizational security protocols, creating vulnerabilities in the network.
   • Example : An employee integrates an unauthorized AI application into internal systems, accidentally opening a backdoor for cybercriminals.
2. Exposure and misuse of data : Many AI tools require users to enter sensitive data, which may then be stored, processed, or retained by third-party vendors without adequate security measures.
   • Example : Personal customer information or trade secrets fed into a generative AI platform could be retained for training purposes, leading to GDPR violations and data leaks.
3. Ransomware and Malware Risks : Unauthorized AI applications can include malicious code or serve as gateways for ransomware attacks, threatening business continuity.
   • Example : Free AI tool downloaded by employee contains hidden malware, compromising entire IT infrastructure.
4. Lack of monitoring and incident response : Shadow AI tools operate outside of official IT systems, making it difficult for organizations to detect, mitigate, or respond to the incidents they cause.
   • Example : A breach caused by an untrusted AI system remains undetected until significant damage is observed.

Shadow AI as an operational risk

1. Workflow Fragmentation : Shadow AI tools often don’t integrate well with existing systems, causing inefficiencies and duplicated efforts.
   • Example : An employee uses an unauthorized AI tool for data analysis, leading to inconsistent results and project delays.
2. Weakening governance and accountability : Lack of oversight of Shadow AI applications compromises organizational governance frameworks and blurs responsibilities in decision-making.
   • Example : Decisions made using unauthorized AI tools cannot be properly audited, exposing organizations to legal disputes.
3. Inaccurate or biased results : Shadow AI tools are not subject to organizational quality controls, increasing the risks of inaccuracy or bias in their results.
   • Example : An unverified AI model produces erroneous predictions for a public health program, leading to suboptimal allocation of resources.
4. Disruption of essential operations : Reliance on Shadow AI for critical functions, without backup plans, can disrupt operations if the tool becomes unavailable or unreliable.
   • Example : A jurisdiction relies on an unapproved AI translation tool to handle multilingual cases, but the tool suddenly goes down, causing delays.

Regulatory frameworks addressing cybersecurity risks

Why does Article 4 of the AI Act also apply to Shadow AI?

Article 4 of the AI Act does not concern conformity assessments, which fall under the regime for high-risk systems, but rather AI proficiency. Since February 2, 2025, it has required companies that provide or use AI systems to take measures to develop their employees' AI proficiency, taking into account their role and the context of use. Omnibus Regulation (EU) 2026/1744, in force since July 27, 2026, has made this an obligation of means: it no longer requires guaranteeing a "sufficient level" for each individual, and the Commission and Member States must support these efforts, particularly those of SMEs. Enforcement has been the responsibility of national authorities since August 2, 2026.

This obligation applies to organizations whose employees use AI in their work, including when they use tools that the organization has not approved. Shadow AI is therefore not exempt from Article 4: it is often a sign that AI management has not yet been sufficiently developed. Training teams on the risks of unauthorized tools, offering them validated alternatives, and documenting these actions are among the expected measures. However, the AI Act is not sufficient to address Shadow AI from a cybersecurity perspective: that is the role of the NIS2 directive.

Relevance of the NIS2 directive (articles 20, 21 and 23)

In addition to the AI Act, the NIS2 directive, particularly Articles 20 (governance), 21 (risk management measures), and 23 (incident notification), provides a framework for addressing risks in the context of cybersecurity. NIS2 emphasizes cybersecurity risk management and incident response, making it particularly applicable for detecting and managing unauthorized technologies such as Shadow AI.

Key aspects of NIS2 include:

• Responsibility of governing bodies (Article 20) They approve cybersecurity risk management measures, oversee their implementation and must undergo training in this area.
• Risk identification and mitigation (Article 21) : Organizations must proactively identify risks within their IT systems, including unauthorized use of tools like Shadow AI.
• Incident response and reporting (Article 23) : Security breaches related to Shadow AI tools must be reported to the relevant authorities, ensuring transparency and accountability.
• Cross-sector application : While the AI Act focuses on specific systems, NIS2 applies broadly to all cybersecurity risks, making it particularly relevant for managing unauthorized applications.

Thus, the NIS2 Directive provides the necessary legal framework to address Shadow AI as a cybersecurity risk, where unauthorized tools introduce vulnerabilities that could disrupt operations or compromise sensitive data.

Obligations under the GDPR

Shadow AI applications that process personal data may also violate GDPR requirements for data minimization, purpose limitation, and lawful processing.

By viewing Shadow AI as a cybersecurity risk, organizations align with existing regulatory mandates while proactively addressing the vulnerabilities it presents.

Operational Risk Mitigation Strategies

To minimize operational risks related to Shadow AI, organizations must adopt proactive measures integrated into their governance frameworks:

1. Regular audits : Identify unauthorized AI tools in use and assess their impact on workflows and compliance.
   • Example: Perform a systems audit to detect connections to unapproved external AI platforms.
2. Establishing robust governance frameworks : Establish clear policies prohibiting the use of unapproved AI tools, accompanied by employee awareness.
   • Example: Include specific clauses on Shadow AI in IT policies and disseminate internal communications on risks.
3. Systems integration : Encourage the use of permissioned AI tools that seamlessly integrate with existing systems to improve efficiency.
   • Example: Propose a validated and secure alternative to ChatGPT for organizational needs.
4. Contingency plans : Create backup workflows to ensure business continuity if unauthorized tools are discovered and removed.
   • Example: Establish a procedure to quickly switch to compliant tools in the event of Shadow AI detection.

Building Resilience Against Shadow AI: Governance, Education and Literacy

Building organizational resilience against Shadow AI requires establishing strong defenses, implementing relevant policies, and developing appropriate control mechanisms. However, with Shadow AI, the key lies in adequate stakeholder training.

The importance of AI literacy

AI literacy is crucial to combating Shadow AI because technology alone is not enough to mitigate the risks associated with unauthorized use of applications. Without awareness, employees may unwittingly introduce or rely on unapproved AI tools, bypassing governance protocols. Literacy training helps build a proactive organizational culture to address these risks.

1. Risk identification : Employees with good knowledge of AI are more likely to recognize unauthorized tools and understand their potential impact on security, privacy, and compliance.
2. Encouragement of compliance : Informed teams are more likely to follow governance policies, choose approved tools, and report unauthorized applications.
3. Strengthening resilience : Training teams on the legal, ethical and operational dimensions of using AI ensures a more secure and technology-compliant approach.

Governance and operational measures

To complete AI literacy, organizations must implement robust governance protocols and operational measures. Even entities not currently using any AI tools must prepare for the possibility of Shadow AI appearing in their systems.

• Proactive governance : Write clear policies prohibiting unauthorized tools. Integrate Shadow AI detection into IT audits and governance frameworks.
• Operational monitoring : Deploy tools to detect AI-related activities within the network. Establish escalation procedures to report and address incidents.
• Alignment with NIS2 directive : Treat Shadow AI as a critical risk requiring immediate attention, within the framework of risk management measures (Article 21) and incident notification obligations (Article 23) of the directive.

Need for Urgent Action – A Call to Action

Shadow AI poses a unique dual threat, combining cybersecurity vulnerabilities with operational inefficiencies. Its decentralized nature makes it difficult to detect, while its risks—ranging from data breaches to workflow disruptions—can have significant implications for public governance and private enterprise.

Recognizing Shadow AI as a risk category in its own right underscores the urgency to act through comprehensive policies, educational initiatives, and technical measures.

The message is clear: Managing Shadow AI is not an option — it is a necessity to protect organizational integrity in the AI ​​era and to remain compliant with applicable regulations.

Sources. European Union, Regulation (EU) 2024/1689 (AI Act), article 4; Regulation (EU) 2026/1744 (omnibus IA), in force since 27 July 2026; European Commission, AI Literacy, Questions & Answers ; directive (EU) 2022/2555 (NIS2), articles 20, 21 and 23.

To go further: this overview of risks extends our article on digital responsibility and the war for talent et our guide to designing responsible generative AI.