Topic guide

Employee use of AI tools (shadow AI)

Staff using AI tools at work that the organization has not approved or even seen.

For reference purposes only. Not legal advice.

SimplifiedGeneral guidance. Legal duties differ by region; see the region pages and confirm with counsel.Source: European Commission: AI Act overview · Checked 3 Oct 2026

Overview

Staff will use AI tools whether or not they are approved. A clear policy, an approved list and an easy way to ask are more effective than a ban, and a short discovery exercise usually finds more use than leaders expect.

Key risks

Confidential data in public tools
Unchecked output reaching customers
No record of what is used
Inconsistent rules

What to do now

Run the shadow AI survey with a no-blame message.
Publish an approved-tools list and a quick request route.
Train everyone.
Report on it.

Questions to ask

What AI tools are staff already using?
Which data is being pasted into them?
Is there an approved alternative for common tasks?
Does the policy say what is allowed in plain words?
How do staff ask for a new tool to be approved?

Related tools

Region rules: EU · US · UK · India · Global standards.

Reviewed 3 Oct 2026. Sources: European Commission: AI Act overview.

Was this page useful? Tell us what is missing or wrong ↗ · Report a correction