Shadow AI at work: what to do when your team uses AI on personal accounts

In many small companies, AI is already at work on personal accounts. It has access to proposals, spreadsheets and customer email, it halves the time routine tasks take, and it comes with no agreement of any kind: none with the company, none about data processing, none inside the team about what never gets pasted. Nobody decided any of this, so nobody knows what is allowed. That is the shadow in shadow AI: the shadow of a decision nobody made.

My commentary on shadow AI ran in Wprost, a Polish business weekly, on 1 August 2026, the day before the main body of the EU AI Act started to apply. Today the rules apply, and the conversation they were supposed to start has not happened. This article is about having it in one afternoon.

Updated: October 2026. We clarified who Article 50 of the AI Act makes responsible for telling customers they are dealing with AI, corrected the IBM figures, attributed the 223-violations figure to Netskope and removed generalizations without a source.

What is shadow AI?

Shadow AI is AI used at work outside the company's knowledge and oversight, usually through a personal consumer account, with no alert and no log on the company's side. There is nothing to notice, because nothing looks like an incident. Nobody breaks into a system, nobody walks out with a file.

Someone opens a second browser tab and pastes in a piece of their work, and the company finds out months later, by accident.

The word "shadow" does the wrong job here. It sounds like something someone hid. Nobody is hiding anything.

The sales rep drafts proposals with a model at an open desk, the office manager summarizes meeting notes in a chat she mentions over coffee. The shadow is cast by the company, not by the employee. It is the shadow of a decision nobody made.

The older term is worth separating out. Shadow IT was unapproved software: an install, a license, a ticket somebody could refuse. Shadow AI is an approved-looking browser tab, which is why the old detection playbook finds so little to detect.

A typical scene, not a case from our work. Someone in accounts gets a spreadsheet of vendors to clean up and pastes it into a free chat because that is faster. Tax IDs, addresses and invoice amounts now sit on someone else's server and, on default consumer settings, may end up in model training. She did something sensible: she shortened a task she had to finish anyway. The person who did nothing is the owner who never said that spreadsheet does not get pasted anywhere.

Why is shadow AI a problem?

The damage comes in three layers at once: data that can feed someone else's model, the absence of a processing agreement, and a breach cost that rises where nobody controls access. AI on a personal account has nobody to sign a document with, because the account belongs to the person, not the company.

• Technical. Content pasted on a consumer account can feed model training. Netskope, which measures traffic rather than opinions, reports that 47% of GenAI users still access tools through personal, unmanaged accounts, down from 78% a year earlier (Netskope Cloud and Threat Report 2026). The direction is good, the level is still half.
• Legal. The company that employs the person in accounts remains the data controller, not the chat vendor she pasted the spreadsheet into. A personal account changes none of that. It adds one thing: the absence of a processing agreement under GDPR Article 28. Which plans do what with your data is covered in our piece on where your company data goes when you use AI.
• Financial. In the 2025 edition of IBM's study, one in five organizations (20%) reported a breach involving shadow AI. Organizations with high levels of shadow AI paid on average $670,000 more per breach than those with low levels or none. Among breached organizations that had an AI-related security incident, 97% lacked proper AI access controls, and 63% of breached organizations either had no AI governance policy or were still developing one (IBM Cost of a Data Breach Report 2025, Ponemon Institute, 600 organizations).

Netskope's 2026 report also counts an average of 223 GenAI-linked data policy violations per organization each month. To violate a policy you first have to have one, so in a company without a policy the counter reads zero, and zero is the worst possible reading.

Is it acceptable to use AI at work?

Yes, and the question is framed wrong. People reach for the tool because the task is due today, the tool halves it, and nobody has said "not that one, this one." The answer is not permission or a ban, it is a named tool and one rule. Supply the third and the first two stop being a problem.

"This is a big-company problem, we have twenty people" is the line that comes up most often and holds up least. A large company has an IT department that at least sees the traffic. A small company has an owner who uses a chat on a personal account himself and assumes that is normal. It is normal, nobody wrote it down. And twenty people on personal accounts is twenty separate privacy policies nobody has read.

Most companies now have a workforce that taught itself to use AI on its own accounts. That is a head start nobody has claimed, and an account alone does not claim it, which is why AI training for your team belongs next to the account rather than after it.

Polish data, illustrative for the EU rather than global: 38.4% of workers in Poland use AI at work regularly against a European average of 29.3% (SD Worx, "2026 HR and Payroll Pulse", 16,500 workers, 16 countries), while 27% of Polish companies have formal rules for it (Cyberportret polskiego biznesu 2026, ESET and DAGMA, survey by ARC Rynek i Opinia, n=1,026). Usage runs well ahead of rules, and there is no reason to think that gap is a peculiarly Polish habit.

How to avoid shadow AI without banning it?

A ban without a company account is not a security policy. It is a memo that says "keep doing it, just on your own phone." What works instead is a pair: one licensed tool on a business plan, plus one rule about what never gets pasted. The account gives people somewhere safe to go and the rule tells them what stays out of it.

People say this themselves. In the Polish survey above, 35% of AI users would try to get around a company block, and 26% would generate the content on a personal device and email it to their work inbox. Read that as instructions rather than as a threat: a ban does not remove the behavior, it moves it where the company sees even less.

Banning AI in a company that gave nobody a company account is like banning phone calls in a company that has no phone. People will not stop calling. They will call from personal numbers, and the customer will not know who is on the line.

Companies ran this exact experiment ten years ago under the name shadow IT: personal Dropbox, personal Gmail for large files, a spreadsheet on someone's own Google account. Most reached the same conclusion: you cannot ban convenience, you can supply it.

One difference matters: Dropbox stored the file, while a language model on a consumer account may train on it. A leak in shadow IT was an event. In shadow AI it can be a default setting, cast by the same decision nobody made.

A tool never taught anyone caution either, so the account comes with training or with the same habits on a better plan. Our guide to an AI policy for business covers what the one-page version needs to say.

What changed on 2 August 2026?

From that date the main body of the EU AI Act applies, including the Article 50 transparency duty. The regulation entered into force on 1 August 2024; 2 August 2026 is when these provisions started to apply.

In my commentary in Wprost I wrote that the headlines would read "penalties begin" and that this was wrong. With hindsight I would add one thing: for a small company on off-the-shelf tools, transparency costs less to satisfy than any schedule of fines.

Poland shows what this looks like where the law has landed. It passed a national AI act on 3 July 2026, in force since 11 August 2026, and is standing up a supervisory body that has not started work. Member states are adding national layers, and liability arrives before the regulator does.

If the chat on your website promises a customer something that is not on your price list, pointing at the vendor will not help. Air Canada tried that argument, and a tribunal in British Columbia held the airline liable for what its chatbot said, in February 2024, for CAD 650.88. The amount is small, the principle is not. You can delegate work to a model, not liability.

Article 4 gets almost no attention. It has applied since 2 February 2025 and, after the Digital Omnibus (Regulation (EU) 2026/1744), speaks of supporting AI literacy among the people who use these tools on the company's behalf. No form and no agency, just an expectation that people understand the tool they work with, and shadow AI is the state in which a company cannot know whether they do. The rest is in what the EU AI Act requires of your company.

How to spot shadow AI in your company in a week

Three questions and one sheet of paper. Inventory first, policy second. Most companies do it the other way round and end up with a document describing a company that does not exist: it bans tools nobody uses and says nothing about the ones the team has worked in for a year. Collecting the answers takes an afternoon and writing them down takes another. That is the whole audit, on no budget.

1. Which AI tools do our people use? Ask it so you get an honest answer. Not "do you use AI," which sounds like an interrogation and gets a "no." Ask "where does AI save you time," which sounds like interest and gets you a list.
2. What must never be pasted into them? Three categories are enough: customer personal data, contracts, financials.
3. Who checks the output before it reaches a customer? One name per document type, not a two-page procedure.

A typical result in a 20-person company, a scenario rather than a measurement: several tools, some the owner has never heard of, all on personal accounts, none on a business plan. That is not a disaster, it is the baseline, and you cannot count anything until you know where zero is.

You do not have to start the rules from a blank page either. Our free AI policy template has fields for exactly those three answers, so you can fill it in the same afternoon you do the inventory.

What are shadow agents, and how are they different from shadow AI?

A chat on a personal account reads what someone pastes into it and hands back text. An agent holds its own keys and acts: it opens the mailbox, replies to a customer, updates a CRM record, issues a document, fires every hour. It keeps running at night, and long after the person who set it up has left. The industry calls that a shadow agent. The difference for your company is one thing and it is a big one: with a chat you risk data, with an agent you also risk decisions taken in your name, on your permissions.

Nobody rolls these out formally. They grow out of tools the company already pays for, the moment those tools get an agent mode. That can be a scenario in n8n or Zapier, an assistant built in Copilot Studio, a browser extension that clicks on its own, or an account on someone else's platform wired to the company drive with an API key. Cisco's State of AI Security 2026 reports that 83% of the organizations surveyed had planned to deploy agentic AI capabilities into their business functions, while only 29% felt they were truly ready. That gap does not stay empty. It gets filled by people who had a task due yesterday and a tool within reach.

Five signs an agent is running in your company without anyone owning it

1. Someone on the team says "that part happens by itself" and cannot show you where it is set up.
2. Entries appear in the mailbox or the CRM outside working hours, with no human on the other side.
3. The connected-app list in Google Workspace or Microsoft 365 holds an app with mailbox or drive access nobody recognizes.
4. A customer got an answer nobody in the company wrote or approved.
5. Someone who left a quarter ago still runs something here: their API key outlived their contract.

A one-page agent inventory

The same sheet you used for the tools, with six columns. The rows below are a worked example, not a measurement from a real company.

The blanks in the last row are the finding, not a gap in the table. Until a name goes where the owner and the off switch belong, that agent runs on permissions the company never knowingly granted. The order is the same as it was for chats: first you know what runs, then you write the rule. Once there is more than one agent and they reach customer data, this review is part of an AI Trust Layer audit.

Rogue AI agents vs shadow agents

Both sound like an agent out of control, and they are not the same problem. A rogue agent breaks out of the boundaries its own makers set for it. In July 2026 around 700 AI agents took part in an attack on Hugging Face, and PBS NewsHour reported that "it took days for Hugging Face to detect the attack". Across OpenAI systems, roughly 1,200 bots communicated on unsanctioned channels and sent 70,000 messages in a single week. That is a frontier-lab problem on frontier-lab budgets. A shadow agent is the small-company version: nothing breaks out, because nothing was ever fenced in. The agent does exactly what somebody told it to do, on credentials nobody wrote down.

Ban it or organize it - what works in a small company?

In a small company the answer is a pair, not a choice: one licensed tool on a business plan plus one rule about what never gets pasted. Each half fails on its own. A ban with no company account pushes the behavior onto personal laptops, and an account with no rule gives people a safe tool they will paste everything into anyway. A business plan is not a comfort purchase. It is the line between "the data stays with us" and "the data trains someone else's model."

The rule has to fit in three lines: customer personal data, contracts, financials. One sheet, not a twenty-page document. The test of a good rule is whether a new hire can repeat it in their first week without opening the file. If not, it is not a rule. It is an attachment.

Where to start this week

Three moves, each of which fits in an afternoon and none of which needs a budget. Ask the team where AI saves them time and write the answers on one sheet. Buy one business plan for the tool that came up most often. Announce three lines about what never gets pasted. A quarter is what it takes to pretend the problem is technical and needs an implementation.

The afternoon is not enough in one case: when customer data moves through several tools at once, there is a chat on the website, and nobody knows what that chat promises. Then you need someone from outside to check the state of things instead of guessing at it. That is what an AI Trust Layer audit is: an independent check of where data goes, who has access, what your chat says, and where you stand on Article 50, ending in a report that lists the gaps in the order to fix them. We audit, we do not build the controls.

The closing question is not "do my people use AI." They do. The question is whether the company has said out loud what it uses and what it never pastes. The day that gets said, AI at work gets an agreement, a rule and a person responsible, and the shadow of a decision nobody made is gone, because someone turned the light on.

Want to know where you stand? Book an AI Trust Layer audit, or start on your own with the free AI policy template.

Frequently asked questions

Can my employer tell if I use AI?

Usually not, if it is a personal account on a personal device. Larger organizations see AI traffic in network logs and run DLP or CASB tools; in the Polish survey cited above, 25% of companies have them. For a 20-person company that is a sledgehammer to crack a nut. A conversation works faster and does not make the team feel like suspects.

Is ChatGPT shadow AI?

The tool is not the problem. The account and the missing rule are. The same ChatGPT on a business plan, covered by a data processing agreement and named in a one-line policy, is not shadow AI. On a private login, with the same spreadsheet pasted into it, it is.

Who owns the 30% under shadow AI?

Nobody, and that is the problem: the 30% rule assumes a person keeps the judgment and the sign-off, but under shadow AI no one has been named for it. What the rule actually means and where the number comes from is in what the 30% rule in AI means.

Is shadow AI a GDPR problem?

It becomes one the moment customer personal data goes into a tool the company has no processing agreement with (Article 28). A personal account cannot sign one, because it belongs to the person. Which plans keep data out of training is covered in where your company data goes when you use AI.

Who is liable for what an AI tool says?

The company using it. Article 50 of the AI Act puts the duty to tell customers they are talking to AI on the provider of the system, and a company that builds its own chat and runs it under its own brand is that provider. Air Canada argued before a tribunal that its chatbot answered for itself, and lost in February 2024. More in what the EU AI Act requires of your company.

Does a policy fix it or do you need an audit?

A policy says what is not allowed. An audit says what is happening today. The order is inventory, then policy, then review. For a company using one or two tools for text and spreadsheets, the inventory and three lines of rules are the fix. An AI Trust Layer audit pays for itself when customer data crosses several tools, a chat talks to customers, or someone built an automation nobody else understands.

What is a shadow agent?

A shadow agent is an AI agent running inside a company that nobody approved, documented or owns. It differs from shadow AI in the thing that matters most: access. A chat on a personal account processes what someone pastes into it. An agent holds credentials and acts on them, reading the mailbox, updating records and sending messages on the company's behalf, including when nobody is watching. Cisco's State of AI Security 2026 reports that 83% of the organizations surveyed had planned to deploy agentic AI capabilities into their business functions while only 29% felt truly ready. Shadow agents live in that gap.

How do I find shadow agents in my company?

Start with the systems, not the people. Open the connected-app list in Google Workspace or Microsoft 365 and look for apps with mailbox or drive access nobody recognizes. Check the automation tools you already pay for, n8n, Zapier, Power Automate or Copilot Studio, for scenarios still running on a former employee's login. Then ask the team one question: where does something happen by itself? Write every answer into a one-page inventory with a name in the column for who can switch it off. An empty column there is the finding, not a gap in the table.

Sources

1. Netskope, Cloud and Threat Report 2026 - netskope.com
2. IBM, Cost of a Data Breach Report 2025 (Ponemon Institute, 600 organizations) - ibm.com
3. ESET and DAGMA, Cyberportret polskiego biznesu 2026 (survey by ARC Rynek i Opinia, n=1,026, 15 June 2026) - purepc.pl
4. SD Worx, "2026 HR and Payroll Pulse", 17 July 2026 (16,500 workers, 16 countries) - sdworx.com
5. Mikołaj Motel, commentary on AI in Polish companies, Wprost, 1 August 2026 - biznes.wprost.pl
6. Regulation (EU) 2024/1689 (EU AI Act), Articles 4 and 50 - eur-lex.europa.eu
7. Polish Act of 3 July 2026 on artificial intelligence systems, Journal of Laws 2026 item 1003; Regulation (EU) 2026/1744 (Digital Omnibus)
8. Moffatt v. Air Canada, Civil Resolution Tribunal of British Columbia, February 2024 - canlii.org
9. Cisco, State of AI Security 2026 (Cisco blog, 19 February 2026) - blogs.cisco.com
10. PBS NewsHour, "AI agents are hacking systems without any input from humans" - pbs.org