Shadow AI: your employees already use AI. How to govern it instead of banning it

What shadow AI is and why a ban won’t stop it

Shadow AI is the use of artificial intelligence tools that IT and security either don’t know about or haven’t approved. Most often it’s a personal account with a public chatbot, a browser extension, an AI feature switched on in an otherwise approved SaaS application, or a coding assistant signed in with a personal email address.

It differs from classic shadow IT in that nothing needs to be installed or bought. A browser tab and the clipboard are enough. The motivation is different too: people don’t do it out of defiance, but because the tool saves them work.

A global study by Melbourne Business School and KPMG of more than 48,000 people in 47 countries (fieldwork November 2024 to January 2025) found that 57% of employees hide their use of AI and present its output as their own work. Almost half admit to using it in ways that contravene company policy, including uploading sensitive company information to free public tools. Meanwhile, only 40% of respondents said their workplace has any policy or guidance on generative AI, and only 47% had received training.

That leads to an uncomfortable conclusion for anyone betting on a ban: where rules are missing or impossible to follow, people won’t stop using AI. They’ll stop talking about it.

The Czech context: adoption is outpacing the rules

According to an SAP survey of 200 executives published in September 2026, 83% of companies in the Czech Republic use AI, up from 41% a year earlier. In the same survey, half of the managers are worried about data misuse or leakage, and 30% of companies cite missing rules and legislation as an obstacle.

The AIMomentum 2026 survey offers a different angle: half of Czech companies actively use or are testing AI, compared with 18% in 2025. The two figures aren’t directly comparable – the sample and the question differ – but the direction is the same.

In fairness, we should say what’s missing: while preparing this article we could not find a representative Czech survey focused specifically on unapproved AI use by employees. Czech media rely on foreign figures here. Whether shadow AI exists in your company, and to what extent, is therefore something you’ll learn not from surveys but from your own logs.

There is one Czech precedent. On 10 July 2025, NÚKIB (the Czech National Cyber and Information Security Agency) issued a warning regarding certain products of the company DeepSeek, which applies to entities regulated under the Cybersecurity Act (zákon o kybernetické bezpečnosti). It explicitly does not cover open-source models run locally without communicating with the vendor’s servers. It’s a good illustration that the deciding question isn’t “AI or no AI”, but where the data goes and under which jurisdiction.

What the data says about breaches

The IBM and Ponemon Institute report, based on 600 organizations that suffered a data breach between March 2024 and February 2025, tracked shadow AI separately for the first time. One in five organizations reported a breach caused by shadow AI. Organizations with high levels of shadow AI had breach costs that were on average USD 670,000 higher than those with low levels or none. In these incidents, personal data (65% versus an average of 53%) and intellectual property (40% versus 33%) were compromised more often.

The governance figures matter even more. According to the same report, 63% of breached organizations have no AI governance policy or are still developing one. Of those that have one, only 34% regularly audit for unsanctioned AI. And of the organizations that reported a security incident involving an AI model or application, 97% lacked proper AI access controls.

The second useful source is operational telemetry. In its January 2026 report, Netskope states that the share of AI users using personal AI apps fell from 78% to 47% within a year. Over the same period, the number of data policy violations related to generative AI in the average organization doubled to 223 incidents per month. Most involved source code (42%), regulated data (32%) and intellectual property (16%).

How to read these numbers soberly:

• The decline in personal accounts shows that offering a corporate alternative works. People switch when they have somewhere to go.
• But almost half of users stay on personal accounts. An approved tool on its own isn’t enough.
• Netskope measures its own customers – companies that have already deployed some controls. In an organization with no visibility, the numbers are likely to be worse, not better.
• IBM reports a correlation, not causation. Companies with high levels of shadow AI may simply have weaker security in general.

Source code in first place is an important signal for development teams: code often contains credentials, internal addresses and business logic. Secret scanning in the repository, described in the article on CI/CD security, therefore also protects against what a developer pastes into a chat.

What the AI Act requires of companies: Article 4 after the Digital Omnibus

According to the European Commission, the AI literacy obligation under Article 4 of Regulation (EU) 2024/1689 has applied since 2 February 2025. It covers both providers and those who merely deploy AI (deployers) – so it also applies to a company whose employees write texts in a chatbot. The Commission adds that such employees should be informed about specific risks, such as hallucinations.

The Digital Omnibus – Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 – softened the wording of Article 4. Providers and deployers are now to “take measures to support the development” of AI literacy among their staff and other persons operating and using AI on their behalf. The text explicitly adds that the obligation does not require guaranteeing any particular level of literacy for any individual.

In practice, this means:

• The obligation hasn’t gone away. It has changed from an obligation of result to an obligation of effort.
• No certificate is needed. The Commission recommends keeping an internal record of training and other measures.
• The scope should be driven by context: people’s technical knowledge, the purpose of the system and who it affects.

Enforcement remains uncertain. According to the Commission, the supervision and enforcement rules apply from the beginning of August 2026 (the document gives both 2 and 3 August in different places), and penalties are imposed by national market surveillance authorities in proportion to the nature and severity of the infringement; they are more likely where an incident occurred because people were insufficiently trained. How the Czech supervisory authority will approach this obligation remains to be seen; check the current status with a lawyer. And regardless of the AI Act, GDPR, contractual confidentiality towards customers and trade-secret protection still apply – and an unapproved tool breaches those far more easily.

Governance that works: four layers

1. An approved alternative

Without one, everything else is just repression. A corporate license with sign-in through the corporate identity (SSO), contractually covered data processing and training on inputs switched off. Verify exactly what the provider does with the data, where it stores it and for how long in the contract and the tenant settings, not in the marketing materials.

2. One-page rules

Nobody reads a twenty-page policy. A table is enough: data class, where it may go, where it may not. If the company has no data classification, that’s the first task – without it you can’t configure DLP either.

The table is an example, not a standard. Each company sets its own boundaries according to its contracts and regulation.

3. Technical controls

• Visibility: proxy, DNS or SSE/CASB logs show which AI services are being called from the corporate network and in what volume. The same goes for OAuth consents in the identity provider and for browser extensions.
• Identity: approved tools only via SSO; on managed devices, restrict sign-in with personal accounts where the service allows it (tenant restrictions).
• DLP: inspection of pasted content on the endpoint or in the browser. Start in alert mode, and block only once false positives have been tuned out.
• AI gateway for API access: applications and agents should not call models directly with a key in their configuration. A single entry point gives you central keys, limits, logging and the ability to mask sensitive data.
• Block only selectively: according to Netskope, 90% of organizations block some AI apps – ten on average. It makes sense to block services with unacceptable terms, not the whole category.

Logs from these layers belong in the same place as other security events – see the article on security monitoring and logging.

4. People

Role-based training: a developer needs to know different things than a salesperson. And above all, a channel for requesting a new tool, with an answer within days. If approval takes three months, shadow AI will come back.

What to do in 30 days

The plan assumes the company has an identity provider and at least basic network logs. If not, start there; the article on infrastructure chaos before adopting AI explains why.

When this approach isn’t enough or doesn’t apply

Controlled enablement isn’t a universal answer. There are situations where a stricter regime is appropriate, and arguments that are fair to mention.

• Highly regulated or classified data. Where a contract or the law rules out processing by a third party, banning public tools is the right call. Even there, though, it helps to offer an alternative – a model running in your own cloud environment.
• Personal devices. Neither network controls nor DLP can see a phone on mobile data. This gap can only be closed by a combination of rules, training and making the corporate tool more convenient than working around it.
• A small company without a security team. A CASB and an AI gateway may be overkill. An approved tool via SSO, one-page rules and training cover most of the risk for a fraction of the effort.
• Employee monitoring. Content inspection and DLP intrude on privacy. The scope of monitoring needs to be assessed in advance from an employment-law and GDPR perspective, and employees must be informed about it.
• A false sense of security. An approved tool doesn’t fix wrong outputs. According to the KPMG study, 66% of employees rely on AI output without checking its accuracy – and that applies to a licensed tool too.

Key takeaways

• Shadow AI is a measurable risk. According to IBM, one in five organizations studied named it as the cause of a breach, and it raises breach costs by USD 670,000 on average.
• A ban hides the problem; it doesn’t solve it. According to the KPMG study, 57% of employees conceal their use of AI.
• An alternative works, but not on its own. According to Netskope, the share of users on personal AI apps fell from 78% to 47%, yet data policy violations still doubled.
• Article 4 of the AI Act still applies. After the Digital Omnibus it requires measures to support AI literacy, not a guarantee of a specific level. Keep a record of what you’ve done.
• Start with data, not tools. Without data classification you can neither write rules nor configure DLP.
• The first step is visibility. The real extent of shadow AI in your company will be shown by your own logs, not by surveys.