What is shadow AI? Definition, risks and the way back

Shadow AI is the use of AI tools at work that the company has not chosen or approved. A personal ChatGPT account and a free online translator are two common forms. Whatever an employee pastes into them leaves the company's control, with no contract and no record. The usual cause is delay: the approved route is too slow for the task at hand.

Bringing teams back means offering a tool that is just as easy to use. It has to be connected to company documents and show where each answer comes from.

Shadow AI vs shadow IT: the definition

The term borrows from shadow IT and applies it to generative AI assistants used outside any policy.

Shadow IT has long described software adopted without IT's approval, such as a personal Dropbox. Shadow AI is the same habit applied to generative AI. A file in a personal Dropbox is still a file stored somewhere else. A prompt typed into a public chatbot goes to the model provider, which processes it and may keep it.

The UK's National Cyber Security Centre made the point early. Its blog post on large language models notes that the provider can see every query (NCSC, March 2023, accessed 1 November 2026). Its advice is to keep sensitive information out of queries to public models.

France's national cybersecurity agency, ANSSI, goes further in its security guide for generative AI (ANSSI, April 2024, accessed 1 November 2026). Recommendation R34 rules out consumer AI tools for any work that involves sensitive data. The guide lists contracts, personal data and API keys among the examples.

The scope is wide. Unauthorized AI use covers a personal account, a browser extension that summarizes pages, or a note taker plugged into meetings. These tools follow predictable paths, which makes them easier to spot.

How it starts: three ordinary scenarios

A contract to summarize, a bug to fix, a spreadsheet to chart: each time, a deadline is close.

Nobody wakes up planning to get around the IT team. Shadow AI starts with a deadline and a tool that answers right away. The three scenarios below are examples built for this blog, with no real customer behind them.

The first involves ACME, a fictional industrial customer used as an example across munimen.ai. On 12 June, Marc, the salesperson who handles the account, is preparing the renewal review. He needs to know within minutes which notice period applies. The contract in force is contract V3, which sets three months' notice.

Marc opens his personal ChatGPT account, pastes in the contract PDF and asks for a summary of the exit clauses. The answer comes back at once. The contract, with the signatories' names and ACME's pricing terms, now sits with the chatbot provider. Six months later Marc leaves the company, and his chat history leaves with his account.

The second scenario happens in an engineering team. A developer hits a production error and pastes the full stack trace into a free coding assistant. The trace holds customer email addresses and an API key. Both appear on ANSSI's list of data that should never reach a consumer tool.

The third takes place in finance. An analyst needs a chart of next year's price list for a board deck by the end of the day. The BI team has a two-week queue, so the spreadsheet goes to a free AI tool that builds charts from uploads.

In all three cases the public tool was faster than the internal route. That delay is the part the company can change.

Four concrete risks

Leaks, outdated versions, missing records and unvetted tools: each risk ties back to one of the scenarios.

Because these uses stay out of sight, their risks stay hidden until the first incident. Naming them one by one makes it easier to pick the right response.

Data leaks

ACME's contract V3 contains prices, names and exit terms. Once pasted into a consumer chatbot, it falls under that provider's terms of use. ANSSI notes that in most consumer offers, data sent to the service is collected and used to improve the provider's models (ANSSI, April 2024). The leak happens through an ordinary text box, with no alert.

Decisions made on an outdated version

Marc pasted the first PDF he found in his downloads folder. It was V2, which is obsolete and does not include the three months' notice. The chatbot summarized the wrong document faithfully, and Marc gave ACME a wrong exit date. This is different from an AI hallucination, because the model invented nothing: its source was out of date.

No record of what left

Nobody knows which document went out, or to which provider. If ACME asks what happened to its contract, the company cannot give a precise answer. Marc's departure makes it worse, since his history sits in an account the company does not control.

Reliance on an unvetted tool

The developer's coding assistant was never put under contract. Its terms can change at any time, and nobody signed a data processing agreement with its vendor. For companies handling the data of people in the EU, this matters under the GDPR, the EU's data protection law. Its Article 28 requires a written contract with any provider that processes personal data on your behalf, a point to confirm with your lawyer.

Each of these risks has a known response, and none of them relies on a ban alone.

Why a ban falls short

Blocking ChatGPT on the company network moves the habit to personal phones and leaves the need in place.

A ban without an alternative does not remove Marc's deadline. He will open the chatbot on his phone, off the network, and the company loses what little visibility it had. A clear rule still helps, as long as an approved tool exists next to it.

In Europe, Article 4 of the AI Act has required employers using AI to build their staff's AI literacy since 2 February 2025. The European Commission's AI literacy FAQ covers the case of employees using ChatGPT at work: they should be informed of the risks, such as hallucination (European Commission, October 2026, accessed 1 November 2026). Whether it applies to your company is a question for your lawyer.

A five-step method that a small company can follow as easily as a large group:

1. Map actual use, team by team, through short interviews that do not look for someone to blame.
2. List the documents that never leave: contracts, personal data, access keys.
3. Write a short policy that says which uses are allowed and which are not.
4. Open an approved tool that is as easy as the public chatbot and connected to internal documents.
5. Train teams, then review the access rights granted to AI tools on a regular schedule, as ANSSI recommends.

Step 4 carries most of the effort, because it is the step that removes the delay.

What brings teams back: speed, accuracy, traceability

An approved tool wins when it answers fast, from the right version, with its source in plain sight.

Teams come back when the internal tool handles their task at least as well as the public one. Munimen, a company knowledge base hosted in the EU, is built around that observation.

Speed comes from connectors that keep existing tools in sync: Google Drive, Notion, Slack, Confluence, GitHub, Jira and Linear. Marc no longer hunts for the right PDF. He asks Companion, Munimen's assistant, which answers from the company's own documents.

Accuracy rests on citations. Every answer names the document it comes from. If V2 is still lying around in the Drive, Marc sees it in the citation and checks before he writes to ACME. Munimen's memory also keeps the facts teams learn in conversation, each with its date.

Traceability depends on where the data lives. Documents, their index and conversations are stored on AWS in the Paris region. By default only Mistral AI, a French company, generates the answers, and customer data never trains a model. Spaces reserve documents for one team: contract V3 stays in the sales space, along with what that team has learned.

Teams attached to ChatGPT or Claude can keep them. Through MCP, an open protocol that connects tools to assistants, those assistants query Munimen and cite the same sources. The Munimen vs ChatGPT Enterprise comparison sets out the differences, and the comparison with Microsoft Copilot covers companies that run on Microsoft 365.

Munimen has a clear limit. It does not detect shadow AI and cannot see what an employee pastes into a personal account, so the policy and the training still matter. Its job is to make the personal account unnecessary for questions about company documents.

Without Munimen / With Munimen

The same ACME file handled twice: first with a personal chatbot, then with an approved tool.

The table follows Marc's case, with the same question on both sides: which notice period applies to the ACME renewal. Both columns describe a mechanism. Any time saved is something to measure in a pilot, on your own documents and with your own teams. The right column assumes the sales Drive is connected and the sales space is reserved for that team.

Frequently asked questions

What is shadow AI?

Shadow AI is the use of AI tools at work that the company has not chosen or approved. Typical cases are a personal ChatGPT account, a browser extension or a free translator. Anything typed into them leaves the company's control with no contract. The Munimen page for IT teams shows how an IT department can offer an approved alternative.

What is the difference between shadow IT and shadow AI?

Shadow IT covers any software used without IT's approval. Unauthorized AI is a special case, because every prompt goes to the model provider, which processes it and may keep it. The risk therefore comes with each query. A well-run knowledge management system reduces the reasons people have to work around the rules.

Can employees use ChatGPT at work without leaking data?

Yes, as long as nobody pastes sensitive documents into a personal account. The NCSC advises keeping sensitive information out of queries to public models (NCSC, March 2023). Another route is to connect ChatGPT to an approved knowledge base through Munimen's MCP server, which returns answers with their sources.

How do you set up AI governance in a company?

Start by mapping how teams use AI today, then list the documents that must never leave. Write a short policy on allowed and banned uses, and open an approved tool. For developers, connect their coding assistants too: the Munimen page for engineering teams covers that case with Cursor.

Can Munimen detect shadow AI?

No. Munimen cannot see what an employee types into a personal account, and detection belongs to network security tools. What Munimen provides is the alternative: sourced answers drawn from company documents stored in Paris. The ChatGPT Enterprise comparison page helps decide between the two approaches.