Why do employees use unapproved AI tools?

Employees use shadow AI because the sanctioned tool is worse than mainstream AI assistants, or because nothing has been approved at all. Usage patterns only change when the official tool is genuinely worth using and when executives model compliant behaviour themselves.

Does shadow AI violate the GDPR?

It can. When an employee pastes personal data, such as client records, into a public AI tool, the organisation may face a personal data breach requiring notification to the supervisory authority within 72 hours, and it breaks contractual commitments made to clients.

How does the AI Act regulate shadow AI?

Under the AI Act, an organisation qualifies as a deployer as soon as employees use an AI system professionally, whether approved or not. Article 4 imposes an AI literacy obligation since February 2025, and high-risk use cases trigger full deployer obligations from August 2026.

Qu'est-ce que le shadow AI ?

Le shadow AI désigne l'usage d'outils d'intelligence artificielle par les collaborateurs sans validation de la DSI ou de la sécurité. Il expose l'organisation à des fuites de données, des dépendances juridiques non maîtrisées et des non-conformités au regard du RGPD, de NIS2, de DORA et du règlement IA.

Pourquoi les salariés utilisent-ils des IA non approuvées ?

Les salariés utilisent le shadow AI parce que l'outil fourni est moins bon que les assistants IA grand public, ou parce que rien n'a été approuvé. Les usages ne changent que lorsque l'outil officiel vaut réellement la peine d'être utilisé et que les dirigeants montrent eux-mêmes l'exemple.

Le shadow AI viole-t-il le RGPD ?

Il peut le violer. Lorsqu'un salarié colle des données personnelles, comme un fichier clients, dans un outil d'IA public, l'organisation peut faire face à une violation de données imposant une notification à la CNIL sous 72 heures, et elle rompt les engagements contractuels pris envers ses clients.

Comment le règlement IA encadre-t-il le shadow AI ?

Au sens du règlement européen sur l'IA, une organisation devient déployeur dès que ses salariés utilisent un système d'IA dans un cadre professionnel, approuvé ou non. L'article 4 impose une obligation de maîtrise de l'IA depuis février 2025, et les cas d'usage à haut risque déclenchent l'ensemble des obligations du déployeur à partir d'août 2026.

July 19, 2026

Shadow AI : Regain Control Without Blocking Everything

Shadow AI governance has become a board-level issue, yet most organisations still treat it as an employee discipline problem. In reality, unapproved AI use is the symptom of an official tool that is missing or disappointing. Meanwhile, client data quietly flows into public LLMs, often pasted in seconds by well-intentioned staff. This article sets out a pragmatic path: understand the risk, understand the cause, then choose the right mix of solutions.

What Is Shadow AI and Why Are Your Clients at Risk?

Shadow AI is the use of artificial intelligence tools by employees without validation from the IT or security department. It exposes the organisation to data leakage, unmanaged legal dependencies and regulatory non-compliance.

The internal risk is well known: prompts, files and source code leave the company perimeter and may feed third-party models. However, the client-side risk is often underestimated. When an employee pastes customer records into a public LLM, the company potentially triggers a personal data breach under the GDPR, with a 72-hour notification obligation to the supervisory authority. Consequently, the incident is no longer an internal matter: it breaks the contractual promise made to clients.

For regulated organisations, the stakes are higher still. A data processor under the GDPR, or an ICT provider under DORA, that lets client data reach unapproved AI tools becomes the weak link in its own customers’ supply chain. In other words, shadow AI turns you into someone else’s third-party risk. The financial impact is measurable: according to the IBM Cost of a Data Breach Report, breaches involving shadow AI cost significantly more than average, adding roughly 670,000 dollars per incident (source: IBM, 2025).

Concrete example: a sales representative pastes a client file into a free AI assistant to draft a mailing campaign. Personal data of hundreds of individuals has just left the company perimeter, without any trace, contract or safeguard.

Why Your Teams Use Shadow AI (and Why It Is Not Their Fault)

Employees turn to unapproved AI tools for a simple reason: the sanctioned tool is worse than mainstream AI assistants, or nothing has been approved at all. Nothing changes until the official tool is genuinely worth using.

Speed beats security in daily arbitrations. Faced with a deadline, most employees will choose the tool that answers in three seconds over the procedure that takes three weeks. Furthermore, this behaviour is not limited to junior staff: executives are among the heaviest users of unapproved AI.

The C-suite case deserves particular attention. When the CEO uses a public chatbot on a personal phone, the CISO rarely has the authority to object. Yet governance only works when it is modelled from the top. For a leadership team, exemplarity is therefore the first security measure, and it costs nothing. Before deploying any tool, aligning the executive committee on approved AI usage sends a stronger signal than any policy document.

Which Solutions Help Enforce Shadow AI Governance?

Four families of solutions address shadow AI, and they should be combined according to maturity and budget, always starting with an attractive official alternative. Before comparing vendors, however, it helps to see the full landscape in one view.

Solution family	Examples	Strengths	Limits
Official enterprise AI	Mistral The Vibes Enterprise, Microsoft Copilot, Claude Enterprise, sovereign SaaS offers hosted in France	Treats the cause, contractually framed data, no model training on your inputs	Never covers 100% of residual usage; adoption depends on tool quality
Native capabilities of your existing stack	Microsoft Defender for Cloud Apps, Purview DLP, Entra ID OAuth consent inventory	Near-zero marginal cost, fast to activate	Visibility limited to the tenant perimeter; misses personal accounts and unmanaged devices
Dedicated discovery and governance platforms	Avanoo (European), Nudge Security (US)	Continuous inventory, SaaS-to-AI integration mapping, NIS2 and DORA alignment	Structural blind spots and privacy trade-offs (see below)
Enterprise browsers	Prisma Browser (Palo Alto), Island	Last-mile control, real-time DLP in AI prompts, covers agentic AI	Cost, heavy change management, US-based telemetry

The Limits of Discovery Platforms, Beyond the Jurisdiction Question

Discovery platforms are useful, yet none of them sees everything. Detection based on machine-generated emails, for instance, only catches accounts created with a corporate address: an employee using a personal Gmail account on a work laptop remains invisible. Browser extensions close part of that gap, but they must be deployed on every browser and every device, which rarely covers BYOD and contractor equipment.

Moreover, monitoring AI conversations raises its own compliance questions. Under French law, inspecting what employees type into a chatbot requires proportionality analysis, employee information and, in most cases, consultation of the works council. A tool bought to fix a GDPR risk can therefore create a new one.

Operational limits matter as well. Alert fatigue sets in quickly when every new AI signup triggers a notification, and inventories of SaaS-to-AI integrations depend entirely on the identity provider scope you connect. Finally, for entities regulated under NIS2 or DORA, entrusting the surveillance of internal AI conversations to a vendor subject to extraterritorial legislation deserves, at minimum, a documented risk analysis. European alternatives now exist and should be part of any shortlist.

What the AI Act Changes Right Now

Since February 2025, the AI Act makes your organisation responsible for its employees’ AI usage, whether known or not. As soon as a member of staff uses an AI system in a professional context, the company qualifies as a deployer within the meaning of the regulation.

Two consequences follow. First, Article 4 imposes an AI literacy obligation: staff must be trained to a sufficient level, which is impossible to demonstrate without knowing which tools they actually use. Additionally, if an unapproved tool falls into a high-risk category, such as CV screening, the full deployer obligations apply from August 2026, on a system the IT department has never heard of. The full text of the regulation is available on eur-lex.europa.eu.

Key takeaway: without a map of real AI usage, neither AI Act compliance nor NIS2 and DORA third-party risk management can be demonstrated. Discovery is not a nice-to-have; it is the prerequisite.

Start With an Honest Inventory

Mastering shadow AI starts with an honest assessment: who uses what, with which data, and why the official tool does not suffice. From there, the sequence is clear: provide a genuinely useful enterprise AI, activate the visibility you already own, complete it with a European discovery layer where needed, and anchor everything in governance.

Stroople supports regulated mid-sized organisations through this exact sequence: a compliance audit to map real AI usage against NIS2, DORA and AI Act requirements, a compliance programme to close the gaps, and tailored training that answers the Article 4 literacy obligation directly.