Marcus Belke
CEO of 2B Advice GmbH, driving innovation in privacy compliance and risk management and leading the development of Ailance, the next-generation compliance platform.
Whether for texts, code or translations: AI tools have long since arrived in everyday working life. However, many AI tools are used without the departments responsible for IT, Data protection or Compliance become aware of it. The phenomenon has a name: Shadow AI. What begins as a small help can quickly lead to data protection incidents, security gaps and liability issues. If you don't act now, you risk losing control and trust.
What is considered shadow AI?
In one company, a text generator was used to summarize meeting minutes. Weeks later, sensitive passages appeared on external platforms. No malicious intent, but an incident with legal consequences.
As described in the case study above, shadow AI means that employees use AI systems without the knowledge or approval of the IT or compliance department.
Further examples from practice:
- An employee uploads customer data to ChatGPT to speed up responses. He doesn't realize that the data is being processed on external servers.
- A developer tries out AI coding tools that he knows privately and integrates their suggestions into the company code. There is no license check or security assessment.
- In the Marketing confidential presentations are copied into an online translation tool so that the international version is ready more quickly. This unintentionally reveals internal strategies.
These and similar situations are all examples of unauthorized AI use.
The risks of shadow AI for companies
The practical examples show: The downside of uncontrolled AI use is broad and ranges from data protection to strategic mistakes. Companies that tolerate or do not actively control shadow AI expose themselves to a variety of specific risks:
- Data protection violations
According to a study by the National Security Alliance (NCA) 38 percent of employees admit to having entered sensitive work data into AI tools without permission. Even a short text upload can personal datacustomer details or confidential business information into external systems. This quickly leads to regulatory violations, resulting in severe fines and loss of reputation. - Security gaps
Many AI tools store or process data outside the EU. This results in a loss of control over storage location and access. Business secrets or intellectual property can inadvertently fall into the wrong hands. And this often goes unnoticed until damage is done. - Wrong decisions and bias
Shadow AI works without validation. Unsupervised models deliver discriminatory, incorrect or distorted results. Even small errors in the automated evaluation can have serious consequences for Affected parties and trust in the company, for example when applying for jobs or in customer service. - Liability issues
AI outputs can infringe copyrighted content or trademarks. As it is often unclear which data was used to train models, the company ultimately bears the Liability. Even if employees are "just trying things out". This can lead to legal disputes and damage to the company's image. - Project terminations and cost explosions
Almost half of all companies have already had to stop or restart AI projects, often due to a lack of governance structures. This not only means delays, but also high follow-up costs due to rework and additional checks. - Loss of trust and competitiveness
Customers, partners and investors are paying increasing attention to the responsible use of AI. An incident involving shadow AI can permanently damage trust and weaken a company's competitive position.
Tip: Automate IT asset management with Ailance® ITAsMa - simple, secure, efficient
Regulatory requirements at a glance
The regulatory framework for AI is currently being massively tightened. In addition to the GDPRwhich already stipulates clear obligations when handling personal data, the EU AI Act in particular introduces far-reaching innovations. It classifies AI systems according to risk levels, making even seemingly harmless tools subject to review and documentation. For companies, this means that every use of AI must be properly anchored not only technically, but also legally.
In future Responsible persons be able to fully demonstrate the purpose for which AI is used, what data is processed, what risks exist and what control mechanisms have been implemented. In addition, supervisory authorities require regular re-audits and the clear assignment of responsibilities.
Those who ignore these obligations risk severe penalties of up to 35 million euros or 7 percent of global turnover. Shadow AI is therefore not only an internal risk, but also poses a direct threat to regulatory compliance. Compliance and the liability of the company's management.
Reading tip: AI regulation - this has applied to companies since February 2025
Measures: How to get shadow AI under control
Shadow AI cannot be contained with guidelines or bans alone. The decisive factor is a structured, technically supported governance approach that Transparency and operationalizes processes. In practice, this means that companies need a central AI inventory, automated review and approval processes and evidence of regulatory requirements such as GDPR and EU AI Act.
One example: With platforms such as Ailance such workflows can be mapped. The solution supports companies in automatically recording AI use cases, assessing risks and tracking compliance requirements in an audit-proof manner. Management dashboards or export functions can help with this at any time. Transparency towards IT, Compliance and supervisory authorities. The focus remains on the procedure, not on the functions.
Tip: Manage all AI projects centrally, audit-proof and legally compliant with Ailance® AI Governance
This shows that Governance tools are an important enabler for making shadow AI visible and keeping risks manageable. Which platform or process is suitable depends on the size of the company, IT landscape and regulatory requirements.
Act now: Request a demo and experience how Ailance makes shadow AI visible and automates governance.
Marcus Belke is CEO of 2B Advice as well as a lawyer and IT expert for data protection and digital Compliance. He writes regularly about AI governance, GDPR compliance and risk management. You can find out more about him on his Author profile page.
German 
English 
Italian 
French