Shadow AI is the situation where employees use artificial intelligence tools without the company's knowledge and approval, usually through private accounts. It happens almost everywhere, and banning it does not solve the problem, only pushes it deeper. The risk is not in the use itself, but in what gets entered into the tools – contracts, price lists, clients' personal data, undisclosed financial data or source code. You can detect it by combining an anonymous survey among teams, a review of company payments and subscriptions, and a list of applications connected to company accounts. The solution is to provide an approved alternative that is at least as good, to clearly state what must not be entered, and to introduce a simple procedure for approving a new tool.
See also: Register of AI systems, Internal AI usage policy, Employee AI Literacy.
