Shadow AI: ban it, or give people a better option

How widespread is shadow AI?

Widespread, and it grows where companies encourage AI without providing it. Shadow AI means AI tools staff use for work without the company providing or approving them, usually private accounts of public chat services. In the IW Köln short report of 19 September 2026 (about 5000 employees surveyed, 2793 of them AI users), 29.1% of employees who use AI at work used tools their employer did not provide: 33.5% in firms with fewer than 50 staff and 25.5% in firms with 250 or more. Among staff whose employer strongly promotes AI skills, the share was 44.5%. The authors sum it up: "Wer fördert, ohne bereitzustellen, macht die Nutzung unkontrollierbar" (whoever encourages without providing makes use uncontrollable).

IT leaders see it too. In Flexera's report on IT priorities for 2026, published in November 2025, 58% of IT leaders said shadow AI remains a problem, and 85% saw missing transparency over IT assets as a serious risk. Part of the cause is supply: Bitkom (21 October 2025) found that only 26% of firms give their staff access to generative AI, and 43% of firms with 500 or more staff.

What is the risk for the company and its managing directors?

The company stays responsible for data it never sees leaving. A labour lawyer at Pöppel Rechtsanwälte (5 May 2026) sets out three points:

• Data protection: employees who enter personal data into an AI tool on the employer's behalf trigger processing for which the employer remains responsible, with GDPR fines of up to 20 million EUR or 4% of worldwide turnover
• Trade secrets: entering sensitive information into a generative AI tool counts as disclosure and can end trade secret protection under the German Trade Secrets Act (GeschGehG)
• Management liability: managing directors' duty of care under section 43 of the GmbH Act (GmbHG) and section 93 of the Stock Corporation Act (AktG) comes into play when shadow AI leads to data or secret leaks

There is also a quieter cost: work done in private tools leaves nothing behind in the company. Prompts that worked, documents that were summarised and answers that were wrong all stay in someone's private account. That is the background. How it applies to your company is for your lawyers and data protection officer to assess, and nothing here is legal advice.

Why does a ban not work?

Because the need does not go away, only the visibility. Blocking public AI sites on the company network catches company devices. Staff then use their phones, where the company sees nothing at all. Bitkom's president described the pull in November 2024: "Wer mit KI im Privaten positive Erfahrungen macht, will die Technologie auch im Beruf einsetzen" (whoever has good experiences with AI privately wants to use it at work too). In forums, IT leaders ask the next question: did people stick to a controlled allow policy at all?

• A ban leaves the work undone: people used AI because it saved them time on real tasks, and a ban gives them nothing in return
• A ban cannot be checked: use on private devices and private accounts is invisible to IT
• A ban conflicts with management's own goals: most companies want staff to use AI, and the IW figures show that encouraging it without providing a tool drives shadow use up the most

A ban is still right for some things: certain data classes should never go into any external tool. That rule works best when there is an approved tool for everything else.

What does a better alternative look like?

A better alternative is an approved AI platform that is at least as convenient as the public tools and safe for the company. It has four parts:

1. 1

   A chat interface people want to use

   Sign-in with the company account, chat, file upload, conversation history and a choice of good models. If it feels worse than the private tool, people go back to the private tool.

2. 2

   One LLM gateway in front of all models

   An LLM gateway is one controlled access point to all models, with keys, budgets and logs. Every request passes through it, so the rules apply to every team and every application in the same way.

3. 3

   Models in your own cloud account or on your own servers

   Models from Azure OpenAI or Amazon Bedrock in an EU region of your own cloud account, open-weight models on your own servers for data that may not leave the house, or both behind the same gateway. An open-weight model is a model whose weights you can run on your own servers.

4. 4

   Company knowledge with permissions

   Assistants that answer from SharePoint, file shares, the DMS or the ERP, with the permissions of each source respected and the source shown. Public tools cannot offer this, and it is often the reason people switch for good.

Our guide to ChatGPT at work and data protection compares this setup with business tiers of SaaS products and shows what leaves the company at each step. Our LLM gateway guide explains the gateway in more detail.

What goes in an AI usage policy?

An AI usage policy sets out which AI tools staff may use, with which data and for which tasks, and who checks the results. Each rule works best when the platform enforces it and the text only explains it. Many firms have no such rules yet: in Bitkom's survey of October 2025, 24% of firms had not considered them. A policy for a mid-sized company covers eight points:

• Scope: who the policy covers, including trainees and contractors, and which work AI should help with. This stays in the text.
• Approved tools: the tools and models staff may use for work, and a quick route to request a new one. The platform enforces it, because the gateway accepts only approved models.
• Data classes: which data may go into which tool, and which data must never leave the company, such as personnel files or customer contracts. The platform checks requests before they leave and sends sensitive work to models on your own servers.
• Private accounts: whether private AI accounts may be used for work at all, and if so for which data. The text sets the rule. An approved tool that is as good as the private one makes it easy to keep.
• Checking results: a person checks AI output before it reaches customers, systems or decisions. Uses the AI Act treats as high-risk, such as screening applicants or scoring credit, do not start without a separate approval. Where agents act in your systems, approval steps enforce this.
• Labelling: people are told when they deal with an AI system, and certain AI-generated content is marked, as Article 50 of the AI Act requires from 2 August 2026. Fixed notices in the chat window and message templates enforce it.
• Logs: what is recorded, who may read it, how long it is kept, and that reports are by team, not by person. The logging configuration enforces it, agreed with the works council.
• Training and contacts: what people learn before they get access, who owns the list of approved tools, and whom to tell when something goes wrong, for example personal data entered into the wrong tool. The text names the people, and the training record shows who learned what.

Approved tools, data classes, labelling and logs are platform settings, so write them down as settings. The next section goes through them rule by rule: how the platform enforces each one and how to check it. Our AI platform for all teams provides those settings in your own cloud account or on your own servers. What the policy says is for your company to decide, advised by its data protection officer, its lawyers and, where there is one, the works council. Nothing here is legal advice.

How do we enforce an AI policy technically?

Write each rule of the AI policy, called KI-Richtlinie in German companies, as a setting the platform enforces, and keep the text for what no system can check. Policies are spreading: in Bitkom's survey of October 2025, 23% of firms had AI usage rules, up from 15%, and 31% planned them. In the BSI and TÜV-Verband security study reported by ZfK on 15 October 2026, 59% of AI-using firms had binding internal policies. A policy on paper stops no one, so map it to the platform:

Keep in the written policy what no system can enforce: which tasks AI may support, that results are checked before they are used, and whom to ask. Our guide on LLM cost allocation shows how team keys and tags turn the gateway's logs into spend per team.

Which AI tools are already in use here?

Start with an inventory, because you cannot replace what you do not know. Find out what is used, for which tasks and at what cost before you decide what the platform must offer:

1. 1

   Collect what already exists

   Licence lists, invoices and expense claims for AI subscriptions, and usage exports from the tools the company already pays for.

2. 2

   Ask the teams

   A short survey on which tools people use and for which tasks, answered without names so that people tell you the truth.

3. 3

   Use network data only with agreement

   Proxy or firewall logs can show which AI services are reached, but they show it per person. Use them only in aggregate, and agree this with the works council and the data protection officer first.

4. 4

   Sort by task and data

   List the tasks, the data they involve and the tool used today. These tasks become the requirements for the approved platform.

5. 5

   Move the most used tasks first

   Offer the approved platform for the tasks people use most, then retire the private tools for those tasks.

The free AI usage review covers the first step: one page on AI spend and quality, built from exports you choose to send. It doubles as the start of an AI inventory.

What do the works council and the data protection officer need to see?

Involve both before the platform goes live, because an approved platform changes the picture. According to Pöppel Rechtsanwälte, the Hamburg Labour Court (16 January 2024, 24 BVGa 1/24) found no co-determination right for private ChatGPT use on private devices. Once the employer introduces its own tools, co-determination generally becomes relevant. A platform the company runs, with gateway logs, is such a tool.

Show the works council what the platform records and who can read it, and show the data protection officer where data flows and is stored. Our guide on works council and AI system logging lists the fields and the settings. Your company decides, advised by its data protection officer and lawyers. If you want help with the technical side, talk to an engineer: a free 30-minute call that needs no access to your systems or data.

AI platform for all teamsFree AI usage reviewFor IT leaders and CIOs