Shadow AI: what do we do when employees use AI without asking?
Short answer
Shadow AI is the use of AI tools that management doesn't know about or hasn't approved – typically free ChatGPT or other apps on an employee's own account. The risk is that personal data and confidential information end up with a service that has no data processing agreement (DPA), and may be used for training. Bans rarely work. What works is a good alternative: approved tools, a short policy, a course and an easy way to register new uses.
Why does it happen?
Because AI helps. Employees who have seen how much time AI can save will use it – even when the business hasn't decided anything. The problem isn't the use; it's that data ends up where it shouldn't.
What you can do tomorrow
Choose one approved tool on a business plan, write a short AI acceptable use policy, and give everyone a short course. With GoalCube, staff can use AI on real data without the names leaving the EU – so there's no longer any reason to work around it.
What to do
- Ask without punishing.An anonymous survey gives you an honest picture.
- Offer a good alternative.A business plan with a data processing agreement that is easier to use than the free app.
- Protect data automatically.With GoalCube, the AI only sees codes, so using AI on real data becomes far safer.
- Make registering easy.It should take a minute to register a new use.
- Follow up.GoalCube logs when a dataset is used without being registered and shows it at the top of the status page.
What the law says
- Articles 28 and 32 GDPR
- Personal data may only be given to providers with a data processing agreement and appropriate security.
- Article 4 AI Act
- AI literacy covers all use of AI at work – including use that management doesn't know about.
Questions and answers
Should we ban ChatGPT?
A ban usually just moves the use to personal phones. An approved alternative with data protection works better.
Is it a data breach if an employee has pasted personal data into free ChatGPT?
It can be. Assess it as a possible personal data breach, and report it to your supervisory authority within 72 hours if it is likely to result in a risk to the people concerned.
How does GoalCube detect shadow AI?
If the AI uses a dataset without a confirmed registration, it is logged, and the status page shows a warning at the top.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.