A sales colleague has her quotes polished by her private ChatGPT account; the controller uploads a customer list into a free analysis tool. Both save time — and nobody approved either. The phenomenon has a name: shadow AI.

More widespread than management thinks

In a Bitkom survey of well over 600 companies, around a quarter said that employees use private AI accounts for work — significantly more than the year before. A further quarter or so simply cannot say. At the same time, only about one in four companies provides AI access itself, and even fewer have formulated rules for its use. Employees fill the gap between need and supply themselves.

Why bans don't work

Shadow AI is not a discipline problem but a signal: the need is there, the offering is missing. Anyone who merely bans pushes usage into hiding — to where nobody can see any more which customer data, calculations or contract drafts end up in which service. The real risk is not the tool but the loss of control: no data processing agreement, no deletion periods, no overview.

Three steps out of the shadows

First: look instead of punish. An anonymous survey on which tools are used for what is the most honest needs analysis you can get. Second: offer an approved access that is better than the private alternative — with a company account, clear data rules and integration into your own systems. Third: an AI policy that fits on one page and says what is allowed instead of merely listing what is forbidden. The EU AI Act, with its AI literacy obligation, requires short training on this anyway. Shadow AI shows where your company already wants to be more productive than the official tools allow. Those who channel this energy into orderly paths win twice: less risk, more speed. We are happy to clarify what that can look like for you in a free initial consultation.