TL;DR
Shadow AI — employees using AI tools the company hasn't approved — is quietly creating GDPR liability across Europe. Every prompt containing personal data triggers two regulatory frameworks simultaneously: GDPR and the EU AI Act. Most companies don't know this, and the gap between what the law requires and what employees actually do is growing every day. The August 2026 deadline for full EU AI Act compliance is five months away. Most companies haven't started.
Every time an employee pastes a customer name into ChatGPT, runs a vendor contract through DeepL, or asks Copilot to summarize their inbox using a free or unapproved account, they are operating in the dark — using tools the company hasn't sanctioned, with data the company hasn't authorized, under poorly understood legal frameworks. This is shadow AI: a quiet, daily habit that has become one of the most underestimated compliance risks in Europe.
I came to understand this not as a lawyer, but as an AI engineer. About two months into rolling out AI tools and creating guidelines and policies at work, I realized we had a problem: the guidance we'd worked hard to communicate to employees was missing something fundamental. Nobody had explained the difference between "confidential data" and "personal data" and the importance that this holds when using any of the easily accessible AI tools, and how this still applies even when working in a B2B market. Prior to the ChatGPT era, most of us found it sufficient to use standardized office applications to get our daily work done. Obviously, now our day-to-day work has changed significantly.
The policies had to be redrafted. Not updated — redrafted. We needed specific language covering GDPR requirements and how they overlapped with the EU AI Act, examples employees could actually apply, and clear distinctions between the tools they could use freely and the ones that required approved enterprise accounts. What made the gap visible wasn't an audit or an incident. It was the approval requests. As employees started coming to us to review, vet, and approve the AI tools they were already using — or wanted to use — a pattern emerged: most of them had no framework for thinking about what data they could share and with what. Shadow AI is a reality at most companies, and I can tell you that the liability it creates is not being addressed with nearly enough urgency — especially as free tools continue proliferating and competing for everyone's attention.
Read More