Shadow AI in the Enterprise: How Employees Unknowingly Leak Business Data

Shadow AI is the use of artificial intelligence tools, such as ChatGPT, Gemini, or free AI translators, without the knowledge or approval of the IT department or management. In most companies, this is already happening: employees paste quotes, contracts, customer emails, and even source code into AI tools — often into free versions that may use the entered data for model training.

TL;DR — Key Takeaways

• Research shows that more than half of employees use AI tools that have not been approved by the company.
• The biggest risk is the leakage of trade secrets and personal data into public AI services.
• Banning does not work — employees will continue to use AI, just in secret.
• The solution is a combination of approved tools, clear policies, and technical controls (DLP, Entra ID, Intune).

Why Shadow AI is Dangerous

Classic "shadow IT" involved unapproved Dropbox or WhatsApp usage. With AI, the risk is higher because employees voluntarily provide content — not just a file, but summaries, context, and often entire customer correspondence.

How to Determine if You Have Shadow AI

If you do not have control over network traffic and cloud applications, the answer is almost certainly: yes. Signs include visits to AI service domains in firewall logs, OAuth consents for unknown applications in Microsoft Entra ID, and browser extensions on company computers.

5 Steps to Controlled AI Usage

1. Inventory: Use firewall logs and Microsoft Defender for Cloud Apps to identify which AI tools are actually being used.
2. Approved Tool: Offer employees a secure alternative, such as Microsoft 365 Copilot or Copilot Chat with enterprise data protection.
3. Policy: Adopt a brief company AI policy that specifies which data is prohibited from being entered.
4. Technical Controls: Block risky AI services, restrict OAuth consents, and implement DLP rules.
5. Training: Starting February 2025, the AI Act requires employee AI literacy.

EU AI Act: What Companies Need to KnowObligations, deadlines, and fines for businesses.

Frequently Asked Questions

Is the use of ChatGPT at work prohibited?

No, the law does not prohibit it. However, the company must ensure that personal data and trade secrets are not processed unlawfully and provide AI literacy for employees.

Can we simply block shadow AI?

Technically yes, but a total ban usually leads to usage on private phones. It is better to offer an approved tool and block only risky services.

What is the fastest first step?

Reviewing firewall logs and Entra ID applications — you can get a clear picture of what is happening in a single day.