What is shadow AI and why is it a compliance risk?
Shadow AI is staff using AI tools the organisation has not approved or does not know about, such as pasting customer data into a public chatbot. It is a risk because personal or confidential data can leave the organisation, decisions get made with no record, and the business cannot show regulators how AI is being used, which also makes the EU AI Act's AI literacy and oversight duties hard to meet.
How it works
- Find out which AI tools people actually use.
- Approve safe ones and route their use through a governed gateway.
- Train staff on what they may and may not share (AI literacy).
- Record AI use so it stops being invisible.