Skip to content
Optim-AI

Shadow AI

Shadow AI: detecting and governing undeclared use

Up to date as of 10 October 2026. Shadow AI refers to the artificial intelligence tools your employees use for work without the company having decided it or knowing about it. It is common: in France, 49% of employees who use generative AI at work have not told their line manager (Ifop for Talan, March 2025). The main risk is data leaving the company. The answer is not a ban. It is an inventory without sanctions, approved tools and a short rule.

Definition

What shadow AI is

An employee finds a useful tool, uses it, and nobody has approved it. Shadow AI takes three forms.

  • Consumer assistants, used with a personal account: chat assistants, online translators, transcription tools.
  • Browser extensions that summarise a page, draft an email or correct a text.
  • AI features added to software already in place, switched on without anyone having read the new terms.

The actions are ordinary. A salesperson pastes a contract into an assistant to summarise it. A developer pastes proprietary code into it. An assistant has a board meeting transcribed. A project manager has a client document translated. None of it is malicious. None of it is recorded.

The phenomenon goes beyond the official figures. Insee, the French statistics office, reports that 18% of companies with 10 or more employees say they used AI in 2025, and specifies that this measure excludes employees' individual use (Insee Première No. 2120, July 2026). What employees do on their own therefore appears in no company statistics.

Risks

Why it is a risk

Your data leaves without anyone having decided it. This is the most likely risk. Depending on the contract, what is entered into a consumer tool may be used to improve the service. ANSSI, the French national cybersecurity agency, says so plainly: sending sensitive data to consumer tools on the Internet “is to be ruled out” (April 2024).

Your decisions rest on outputs nobody has checked. A wrong answer arrives with the same confidence as a right one. When the tool is not known, nobody knows it needs reviewing.

You depend on a tool you do not control. A process can end up relying on an employee's personal account. If that person leaves, or if the tool changes its terms, the process stops.

You cannot meet your obligations. The EU AI Act requires companies to take measures to support their teams' AI literacy. You cannot train people on a tool you do not know exists. See our page on the EU AI Act for SMEs.

Banning

Why a ban does not work

A ban does not remove the need. The employee who was saving an hour a day carries on, but stops talking about it. The use goes underground, and so out of control.

The gap is already there. Only 15% of the employees surveyed by Ifop say their company encourages them and trains them in AI (March 2025). A vendor survey points the same way: according to Microsoft and LinkedIn's 2024 Work Trend Index (May 2024), 78% of AI users at work in France use their own tools. Microsoft sells AI tools: this figure should be read in that light.

A site blocked on the network is still accessible from a personal phone.

Detection

How to detect it

Detecting shadow AI does not mean monitoring employees. In France, any system for monitoring activity must be proportionate to its purpose. In companies with at least 50 employees, it requires prior information and consultation of the works council (comité social et économique, CSE). In all cases, employees must be told about it before it is put in place. The CNIL, the French data protection authority, generally considers permanent monitoring excessive, and gives the keylogger as an example of a disproportionate system (guidance of 9 July 2026). Software installed without employees' knowledge to detect their AI use would not meet these conditions.

Three sources are enough.

The signals already visible

  • Subscriptions to AI tools on expense claims or on a company card.
  • Browser extensions installed on workstations, known to the IT department.
  • AI features switched on in your software, visible in its administration settings.

The questions to ask your teams

  • Which tools do you use to write, summarise, translate or code?
  • With which account: personal or the company's?
  • Which documents have you already put into them?
  • What would you miss if the tool disappeared tomorrow?

The conditions for getting honest answers

Announce that the inventory will not lead to any sanction. Say how the answers will be presented to management. Present the exercise as preparing approved tools, not as an investigation.

Governance

How to govern it

The CNIL recommends defining a list of permitted and prohibited uses, training users and putting suitable governance in place (July 2024). For an SME, this comes down to four measures.

  1. Approved tools.

    At least one tool under a business contract, checked on one specific point: is your data used for training. It must be as convenient as the consumer tool, otherwise the rule will be circumvented.

  2. A short rule.

    What may be entered, what must never be (personal data, client data, code, unpublished figures), and what requires human review. One page is enough. See our page on the AI usage policy.

  3. A named point of contact.

    One person, not a committee. They receive requests for new tools and can say no.

  4. A regular review.

    A register of uses, reviewed every quarter. Each use is approved, extended or stopped.

Support

What Optim-AI's audit does about shadow AI

At Optim-AI, shadow AI is part of the AI audit: from 9 days of work over three months at most. We identify the tools adopted without management approval, assess the data that passes through them and turn each risk into a countermeasure.

We work through questionnaires and interviews with your teams. The questionnaires are not anonymous. For the analysis, we classify uses by role and by team: who does what, with which tool, on which data. This is the basis of our audit approach.

The report to management is anonymous. Nobody is named or singled out in it. In the report, small teams are grouped together so that nobody can be identified. It is used to set rules and choose tools, not to sanction.

You receive, among other things:

  • a map of actual AI use, declared and undeclared;
  • an inventory of sensitive data and its exposure;
  • a list of risks ranked by severity and likelihood;
  • AI usage rules written to be read, and able to be attached to the company's internal regulations;
  • a countermeasures plan sequenced over 3, 6 and 12 months.

The plan belongs to you: you can carry it out with us, with another provider or on your own.

Frequently asked questions

Questions from business leaders

What is shadow AI?
It is employees' use of artificial intelligence tools that the company has neither chosen nor approved: consumer assistants, browser extensions, AI features switched on in existing software. In France, 49% of employees who use generative AI at work have not told their line manager (Ifop for Talan, March 2025).
Can a company ban employees from using generative AI?
An employer can regulate the use of work tools. But a ban on its own shifts use to personal devices, where it becomes invisible. Approved tools and a short rule protect data better.
Can a company monitor the AI tools its employees use?
Yes, within the limits of employment law and the GDPR. According to the CNIL (July 2026), a monitoring system must be proportionate. In companies with at least 50 employees, it requires prior information and consultation of the works council (CSE). In all cases, employees must be told about it before it is put in place. Permanent monitoring of workstations is generally considered excessive.
Where should you start when you discover undeclared use?
With an inventory without sanctions, to get the truth. Then offer an approved tool that is at least as convenient, write a one-page rule and name a point of contact.

Sources

The sources consulted

Page up to date as of 10 October 2026. All sources were consulted on 9 or 10 October 2026.

AI audit for SMEs and mid-sized companiesIdentify actual use, including use that has not been declared.AI usage policyWhat may be entered, what must never be, and what requires review.EU AI Act for SMEsWhat the EU AI Act requires of an SME, date by date.Risks and controlThe five real risks of AI in business and their countermeasures.Questions and answersShort answers on regulation, costs and organisation.ContactWrite to us to discuss your situation.

Next step

Know how AI is actually used in your company

The first conversation lasts thirty minutes, with no commitment. It is used to decide what to look at first.

Book 30 minutesTake the AI maturity test