Be honest: if you asked your leadership team today which AI tools are actually in use across the company, would you get a complete answer?
In many companies, the first answer only covers the officially rolled-out tools — a shared ChatGPT team account, maybe Microsoft Copilot, an AI feature in the CRM. Look closer, though, and a much broader picture usually emerges: suddenly it's twenty or thirty systems — most without any formal approval, without documentation, without IT or compliance ever knowing about them. That's Shadow AI. And in 2026, it's no longer a side issue — for many companies, it's becoming one of the biggest challenges in building effective AI governance.
What is Shadow AI, exactly?
Shadow AI describes employees using AI tools without IT, privacy, or compliance knowing about it or approving it — echoing the older term "Shadow IT." The difference: AI tools can be opened in a browser in seconds. No installation, no approval process, no invoice running through procurement. The barrier to entry is essentially zero — which is exactly why Shadow AI spreads faster than IT departments can react.
The result: companies believe they have three or four AI systems in use. In reality, it's often ten times that.
Five departments, five tools — a typical Monday morning
Here's what Shadow AI looks like in practice, department by department:
Five departments, five different tools, five different vendors with five different data-handling and terms-of-use policies. And that's just a slice — in practice, more tools usually show up in design, finance, or project management. Nobody in the organization has a central list. Nobody can say, if asked, which company data is going into which tool.
Our tip: Ask openly in your next team meeting: "What AI tools are you actually using for your work right now?" The answers are almost always surprising — in both good and concerning ways.
Why Shadow AI becomes a compliance risk
At first glance, Shadow AI looks like a productivity story — employees use whatever helps them get work done. From a compliance perspective, though, it creates several concrete risks at once:
No transparency. If nobody knows which AI systems are in use, nobody can assess their use — let alone document it.
No governance. Without central tracking, there are no consistent rules for what data may go into which tool.
Unclear accountability. When a tool is used without approval, it's often unclear who's responsible if something goes wrong — IT, the business unit, or leadership.
Hard to document. The EU AI Act requires documentation of AI systems in use for many use cases. What isn't known can't be documented.
Data protection risk. If employees feed customer data, contract drafts, or applicant information into an unapproved AI tool, that's potentially a GDPR issue — independent of the EU AI Act.
Inconsistent internal policy. Without a central overview, every department ends up with its own informal rules – or none at all.
On top of that: the AI literacy obligation under Article 4 of the EU AI Act has been in force since February 2025 – regardless of whether a tool was officially rolled out or not. If a company uses AI systems (including as a deployer), it must ensure employees are adequately trained. A lack of transparency makes it significantly harder for companies to ensure employees are properly trained and that internal policies are followed.
How companies regain visibility: building an AI inventory
The good news: the first step isn't a months-long project. This isn't about banning Shadow AI – that rarely works in practice and mostly just pushes the problem further underground. It's about establishing transparency, then building rules on top of it. The term for this is an AI inventory (also called an AI asset inventory) – a central, continuously maintained overview of all AI systems in use across the company.
A simple three-step approach tends to work well:
1. Take stock. Systematically ask every department which AI tools they actually use – not just the officially introduced ones. A short, anonymous survey often paints a more realistic picture than any IT inventory list. The result becomes the foundation of a complete AI inventory.
2. Assess. Categorize what you find: what is each tool used for? What data goes into it? Are there any use cases among them that are critical from a privacy or regulatory standpoint?
3. Build governance. Define clear rules – which tools are approved, what data may go in, who's accountable – and make sure new tools get captured going forward instead of growing in the dark again.
Our tip: Don't start with a ban list – start with an inventory. Bans without an alternative almost always mean employees keep using the tools anyway, just more quietly than before.
Frequently asked questions about Shadow AI
What is Shadow AI?
Shadow AI refers to employees using AI tools without IT, privacy, or compliance knowing about it or approving it — think ChatGPT, Copilot, or Claude used in daily work, outside any official approval process.
Is Shadow AI illegal?
Shadow AI isn't illegal by itself, but depending on the use case it can lead to GDPR or EU AI Act violations — for example when personal or confidential data is entered into unapproved tools. What matters isn't the tool itself, but the missing visibility and governance around it.
How do you detect Shadow AI in a company?
The most reliable way is a systematic survey across every department — traditional IT inventory lists usually miss browser-based AI tools. A short, anonymous survey tends to paint a much more realistic picture.
How do you build an AI inventory?
Start with a full inventory of the AI tools actually in use, follow up with an assessment (purpose, data processed, regulatory relevance), and build ongoing governance processes so new tools get captured going forward instead of being missed.
What now? Transparency is the first step, not the whole project
Shadow AI isn't going away on its own – if anything, the list gets longer with every new AI tool that hits the market. But that's exactly what makes this topic so tractable: it doesn't start with a complex legal question, but a simple one: which AI systems are we actually using?
An AI discovery process helps companies systematically capture the AI systems they actually use, and build governance and compliance processes on top of that – instead of working off a list everyone already knows is incomplete.
AI governance doesn't start with a form. It starts with transparency. Only once a company knows which AI systems are actually in use can risks be assessed, accountability assigned, and compliance processes built on solid ground.
That's exactly where SimpleAct comes in: capture, classify, and document AI systems – in one place, traceably, without Excel chaos.
This article is for general information purposes only and does not constitute legal advice. Whether and to what extent individual AI tools are subject to documentation requirements depends on the specific use case. If in doubt, we recommend a legal review.
About SimpleAct: SimpleAct is a European compliance platform that helps companies structure their AI system documentation under the EU AI Act. From capturing systems, through risk assessment, to an export-ready audit trail – all in one place.
```Tags
Kamill | SimpleAct
Author · SimpleAct Team