Preventing Shadow AI: Control Unauthorised AI Usage

Shadow AI is the AI equivalent of Shadow IT: employees use AI tools such as ChatGPT, DeepL or Claude without the knowledge or approval of the IT department. According to a Salesforce study, more than half of employees who use generative AI do so without official approval. Only a minority of organisations have a formal AI policy.

The result: company data flows uncontrolled to external AI services, GDPR violations occur unwittingly and the IT department has no visibility of the risks. Yet banning AI tools has proven counterproductive. This article explains why enablement is the better approach — and how pseudonymization as a technical protection layer enables safe AI usage.

What Is Shadow AI?

Definition, scope and typical manifestations

Shadow AI encompasses any use of AI tools by employees that is not approved, monitored or controlled by the IT department. Typical manifestations include:

Personal ChatGPT accounts: Employees use their personal OpenAI accounts to analyse company documents
Browser-based AI tools: Free AI services used directly in the browser — without a DPA, without oversight
AI extensions: Browser plugins and add-ins with AI capabilities installed without IT approval
Mobile AI apps: AI assistants on personal smartphones used for work tasks
AI in third-party software: AI features in tools like Notion, Canva or Grammarly that process company data

Figures: According to BlackBerry, 75% of organisations are implementing or considering ChatGPT bans (2023). At the same time, the amount of corporate data entered into AI tools grew by 485% within one year, 27.4% of it sensitive (Cyberhaven, 2024). The gap between usage and governance is alarming.

The Risks of Shadow AI

Why uncontrolled AI usage is dangerous

Data Leakage and GDPR Violations

When employees enter personal data into unauthorised AI tools, an uncontrolled data transfer occurs. Without a DPA and without adequate safeguards, this constitutes a GDPR violation — with potential fines of up to 4% of annual turnover.

Loss of Trade Secrets

Product ideas, strategy papers, source code, customer analyses — all of this information may flow into AI training data when entered via free versions of AI tools. Once lost, this data is irretrievably compromised.

Inconsistent Results

When different employees use different AI tools with different prompts and settings, inconsistent results emerge. Without standardised processes, there is no quality control over AI-generated content.

Lack of Traceability

The IT department does not know which data has been transferred to which AI tools. In the event of a data protection request or audit, the organisation cannot demonstrate where data was processed — a serious compliance issue.

Why Bans Do Not Work

Experience from Samsung, Apple and others shows: bans create more problems

Following the first high-profile data leaks, many companies banned AI tools. Samsung, Apple, JPMorgan Chase and others blocked ChatGPT internally. The results were sobering:

Employees Find Workarounds

Studies show that employees continue to use AI tools despite bans — simply via personal devices and accounts. Usage becomes invisible to IT, but the risk increases.

Competitive Disadvantage

Organisations that ban AI miss out on the productivity gains that competitors achieve through AI usage. In the long term, this leads to competitive disadvantages.

Innovation Brake

AI-savvy talent wants to work in organisations that enable modern tools. AI bans signal a backward IT culture and make talent acquisition more difficult.

Analogy: Shadow AI relates to AI bans as shadow relates to light: the stronger the ban, the deeper the shadow. The solution lies not in turning off the light, but in controlled illumination.

The Better Approach: Enablement Instead of Prohibition

5 measures for safe AI usage in your organisation

1. Create an AI Policy

Every organisation needs a clear AI policy that defines:

Which AI tools are approved (and which are not)
Which data may be processed with which tools
Obligation to pseudonymize personal data
Responsibilities and contacts
Consequences for violations

2. Define Approved Tools

Rather than banning everything, organisations should provide a list of approved AI tools with enterprise contracts and DPAs. This gives employees clear options and reduces the incentive to resort to personal tools.

3. Pseudonymization as a Technical Protection Layer

Pseudonymization software such as Docuflair Mask provides a technical protection layer: personal data is automatically replaced with pseudonyms before documents are submitted to AI tools. This enables productive AI usage without incurring data protection risks.

4. Conduct Training

Employees must understand why data protection matters in AI usage, what risks exist and how to use approved tools correctly. Regular training sessions and practical guides are essential.

5. Monitoring and Feedback

Organisations should monitor AI usage — not to surveil employees, but to identify risks and continuously improve the policy. Feedback loops help identify new AI use cases and bring them into approved usage.

Core principle: Enablement instead of prohibition. When employees have a safe, simple and approved method for using AI tools, the incentive for Shadow AI disappears on its own. Pseudonymization is the technical foundation that makes this possible.

Contain Shadow AI — Enable Safe AI Usage

Docuflair Mask gives your employees the ability to use AI tools safely. Pseudonymization as a technical protection layer — on-premises and GDPR-compliant. Experience it in 15 minutes.

Request Free Demo Discover Docuflair Mask

Frequently Asked Questions

Answers to the most important questions about Shadow AI

What is Shadow AI?

Shadow AI refers to the use of AI tools by employees without the knowledge or approval of the IT department. Analogous to Shadow IT, where employees use unauthorised software, Shadow AI involves employees using personal AI accounts (ChatGPT, DeepL, Claude) to process company data.

Why don't AI bans work?

Bans lead employees to resort to personal devices and accounts. AI usage becomes invisible to IT, but the risk increases. At the same time, the organisation loses productivity gains and risks talent attrition to competitors that enable AI.

How does pseudonymization help against Shadow AI?

Pseudonymization enables safe use of AI tools by replacing personal data with pseudonyms before handover. When employees have a safe, approved method to use AI tools, the incentive for uncontrolled Shadow AI usage drops drastically.

What elements should an AI policy contain?

An AI policy should define: approved AI tools and their purposes, data classification (which data may be processed with which tools), obligation to pseudonymize personal data, responsibilities, training requirements and consequences for violations.