# Shadow AI: take back control without banning AI

> Shadow AI: your teams use AI tools the company did not choose. Risks, warning signs, and the method to turn it into governed team AI.

URL: https://aiorigin.io/en/guides/shadow-ai

- Method
- Shadow AI

GUIDE · AI GOVERNANCE

# Shadow AI: when everyone uses AI on their own, take back control without banning it.

Shadow AI is the use of AI tools the company has neither chosen nor governed. Banning them does not work: teams save time with them. Offer them something better, with clear rules.

Talk about your project
Read the essentials

A 30-minute conversation with the team that will run your project, with no commitment.

- 48% of employees who use AI have already entered company information into it
- 49% of users in France have not told their manager

FROM EVERYONE’S AI TO TEAM AI

For

Leadership, IT, business teams

Reading time

6 minutes

Updated

October 15, 2026

THEY TRUST US

- Celio
- Plein Sens
- Shiseido
- Green-Got
- Promologis
- Bridgestone

IN BRIEF

## What is shadow AI?

Shadow AI is employees’ use of generative AI tools (chat assistants, browser extensions, transcription tools) that the company has not approved. It extends “shadow IT”: the tool is useful, but it escapes the IT department.

The main risk is not the tool itself: it is the data. Contracts, customer data or internal figures pasted into a public service leave your perimeter, with no trace or control. According to KPMG, 48% of employees who use AI at work have already done so.

The effective answer is not a ban, but organization: choose shared tools with the IT department, write an AI acceptable use policy, train each team on its real problems, then connect AI to your business tools so it helps without data leaving.

THE FOUR ANSWERS

Shared tools, an AI policy, hands-on sessions, AI connected to your tools.

- Executive management
- IT department
- CISO
- DPO
- Business teams

Updated October 15, 2026.

SIGNS TO WATCH FOR

## Your teams already use AI. The question is how.

The signs we keep seeing in the companies we work with.

TOOLS

Personal subscriptions to AI assistants, put on expense reports or not reimbursed at all.

DATA

Internal documents pasted into public services to be summarized or translated.

SILENCE

The time savings are real, but no one mentions them to their manager.

GAPS

A few very advanced people, and the rest of the team afraid to start.

WHO IS AFFECTED

Any company whose employees have internet access. The question is not whether shadow AI exists in your company, but at what scale.

- Executive management
- IT department
- CISO
- DPO
- Team leaders

WHAT WE DO

## Turning shadow AI into team AI.

Four workstreams, run with your IT department and business teams. We keep the uses that work; we give them a framework.

### An assessment without blame

Which tools, for which tasks, with which data: an anonymous survey and interviews with each business team.

### Shared AI tools

With your IT department, we select the tools to allow, their configuration and where your data is hosted.

### A short AI acceptable use policy

What is allowed, what is not, and who approves. One page, not a rulebook.

### Hands-on sessions for each team

Everyone brings a real problem and leaves with the AI agent that solves it, within the chosen framework.

BEFORE / AFTER

## From makeshift use to team AI.

Before and after: Shadow AI

SHADOW AITEAM AI

ToolsChosen by each person, by trial and error.Selected with the IT department, configured, known to all.

DataPasted into public services.Processed within a controlled perimeter, hosted in France if needed.

Know-howIn the heads of a few pioneers.Shared: good practices become shared agents.

GainsInvisible, never measured.Tracked on a metric you already follow.

Every gain is measured in your company, from your starting point.

OUR METHOD

## Four steps, in a loop.

The four steps of our method, in a loop. Each can be done on its own; together, they organize AI across the whole company.

### Inspire your leadership team

A keynote built on cases from your business. Your leadership decides where AI will be useful, and where it will not.

### Map your operations

We spot the bottlenecks, rank use cases by gain and difficulty, and name the tools to adopt.

### Bring your teams on board

In a hands-on session, everyone arrives with a real problem and leaves with the AI agent that solves it. An AI policy sets the shared rules.

### Build with the AI Factory

Our engineers build AI-ready business tools with you. You keep the keys.

YOUR QUESTIONS

## Questions about shadow AI.

What is shadow AI?

The use of generative AI tools that the company has neither chosen nor governed: chat assistants, extensions, transcription or translation tools used personally for work.

What are the risks of shadow AI?

Mainly data leaks: internal documents or customer data sent to services outside your control. Then come unreviewed errors, uncertain copyright, and know-how that stays with individuals.

Should you ban ChatGPT and other assistants?

Banning without offering an alternative pushes usage into the shadows. It is better to allow chosen tools, configured with your IT department, and explain why some uses remain off-limits.

How do you measure shadow AI in a company?

With an anonymous survey and interviews with each business team, supplemented if needed by IT department logs. The goal is to understand needs, not to punish.

Is an AI policy enough?

No. The policy sets the rules, but without shared tools and hands-on training, personal use continues. It is the combination that works.

What does the AI Act say about this?

Since February 2, 2025, Article 4 of the regulation requires companies that use AI systems to ensure a sufficient level of AI literacy among their staff. Governing usage is part of that.

Where should you start?

With a hands-on session with a volunteer team: you see real usage and draw the first rules from it. This is step 3 of our method, Bring your teams on board.

SOURCES

## The texts and studies cited on this page.

Every figure on the site is sourced. See all our sources.

KPMG and the University of Melbourne, Trust, attitudes and use of artificial intelligence: A global study 2025, April 2025, 48,340 people in 47 countries. kpmg.com

Ifop for Talan, Les Français et les IA génératives, March 2025, 1,100 people. ifop.com

European Union, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act), June 13, 2024. eur-lex.europa.eu

CNIL, Comment déployer une IA générative ? La CNIL apporte de premières précisions, 2024. cnil.fr

ANSSI, Recommandations de sécurité pour un système d’IA générative, April 2024. cyber.gouv.fr

LET’S TALK ABOUT YOUR PROJECT

## Let’s talk about AI in your teams.

Thirty minutes to review current usage, and tell you where we would start.

Your contact

The AI Origin team that runs the projects

You talk directly with the people who will run your project, from scoping to go-live.

No specific project yet? Start with a hands-on session: everyone brings a real problem and leaves with the AI agent that solves it. See step 3, Bring your teams on board

Thank you, we have received your request.

We will get back to you to schedule a time.

### Write to us in two lines.

Your company, the teams involved, what you are seeing. We will get back to you to schedule a time.

Write to contact@aiorigin.io
Or book a time slot

Or write to us: contact@aiorigin.io