In autumn 2025 the Dutch city of Eindhoven reviewed a 30-day sample and found files uploaded to public AI websites, ChatGPT among them: documents under the Dutch Youth Act (Jeugdwet), internal reports and CVs. The city reported a data breach to the Dutch data protection authority on 23 October, and it could not establish the full scope, because the uploads are kept for only 30 days.
That is shadow AI: staff using AI tools that nobody approved or registered. A ban does not remove it, and a policy nobody can follow does not either.
What works is a sequence. Find where AI is already used, in one week, from five sources. Sort what staff paste by data class and account type. Give people an approved tool and write it in a register. Then publish a policy short enough to read. This post walks through each step, shows what GDPR, the AI Act and DORA add for a regulated firm, and ends with a policy template you can copy.
Five steps, in order. Discovery comes first so the first version of the policy names the tools people really use.
We read the laws and guidance cited here on 15 November 2026. This is an engineer’s reading, not legal advice. Your DPO and counsel should confirm it, in particular your works council’s role and how your tools map to the roles below.
What is shadow AI, and why does a ban not stop it?
IBM describes shadow AI as workers downloading or using unapproved internet-based AI tools. It is common. Microsoft and LinkedIn’s 2024 Work Trend Index, a survey of 31,000 people in 31 countries, found that 78% of AI users bring their own tools to work. In KPMG’s summary of its 2025 study with the University of Melbourne, 57% of employees say they hide their use of AI, and only 40% say their workplace has a policy or guidance on generative AI.
The cost shows up in breach data. In IBM’s 2025 report, 63% of the 600 organizations studied had no AI governance policy. One in five reported a breach tied to shadow AI, and a high level of shadow AI added USD 670,000 to the average breach cost. These are survey and vendor figures, collected with different methods, so read them as direction, not as a forecast for your firm.
Why does a ban fail? Because the person pasting a contract into a chatbot is trying to finish work, not to cause a breach. The Hamburg data protection commissioner’s checklist says it plainly: without internal rules, you must assume employees will use the tools in an unauthorized and uncontrolled way, and the employer may be liable. Our view: a block with nothing to replace it sends the habit to phones and home laptops, where you can no longer see it.
Shadow AI also takes more than one shape, and each shape shows up in a different place.
| Shape | Example | Where you can see it |
|---|---|---|
| A public chatbot on a personal account | A free consumer login used in a browser tab | Web gateway or DNS logs, card and expense lines, a survey |
| A personal account where a company account exists | The same assistant, signed in with a private email | Identity provider logs, correlated with web traffic |
| AI inside something you already use | A browser extension, a meeting note-taker joined through calendar access | The list of apps people granted access to, a browser extension inventory |
| Code and keys | A developer’s own model API key or coding assistant plugin | IDE plugin inventories, API keys committed to repositories |
The shapes follow Ertas’s definition of shadow AI, which covers personal accounts instead of corporate licenses and AI features embedded in existing software. They also follow the surfaces Tines lists: unmanaged extensions, new access grants to AI vendors, IDE plugins and API keys.
How do you find shadow AI in a week?
Run discovery before you write anything, because a policy drafted from guesses names the wrong tools. Eindhoven’s 30-day sample is a fair model: a bounded period and one clear question. Our advice is to add a count by tool and team. Here is a week that needs no new software if you already run a web gateway and a cloud identity provider.
- Monday: web and DNS logs. Count visits to known AI domains by department, as DNS-based detection does. If you use Microsoft Defender for Cloud Apps, Microsoft’s own guide says to filter the cloud app catalog by the Generative AI category, review each app’s risk score and tag it Sanctioned or Unsanctioned. You can also upload firewall and proxy logs for an ad-hoc snapshot report. Note that, by default, it cannot discover apps missing from its catalog.
- Tuesday: apps people granted access to. List the third-party apps with access to mail, calendar and files. In Microsoft Entra, check which user consent option your tenant allows. In Google Workspace, the app access control page shows which apps are trusted, limited or blocked. AI note-takers, transcription tools and summarizer plugins are the usual finds here.
- Wednesday: card and expense lines. Adaptive Security notes that individual chatbot and image subscriptions appear as recurring charges on corporate cards or expense claims, often under vague labels. Search for the vendor names.
- Thursday: browsers and endpoints. Inventory the browser extensions on managed devices. If you license Microsoft Purview, endpoint data loss prevention can detect sensitive information pasted or uploaded to AI sites.
- Friday: an anonymous survey and three team conversations. Logs miss phones and home laptops. And since 57% of employees in KPMG’s study say they hide their use, the survey only works if you announce that nobody is punished for answering. Five questions are enough: which tools, for what tasks, with what kind of data, what would you rather use, and what stops you.
Write the result as one list: tool, team, task, data class, account type. That list is the first version of your register.
How far may you look?
Looking at staff traffic is itself processing of employees’ personal data. In Opinion 2/2017 on data processing at work, the Article 29 Working Party (the EU’s former data protection advisers) describes an appliance that decrypts traffic and can record an employee’s entire online activity. It calls monitoring every online activity a disproportionate response and says the employer should first try less invasive means.
The same opinion calls a data protection impact assessment before introducing monitoring good practice. It says employers must communicate acceptable use policies, and recommends involving a representative sample of employees. In some countries such a policy needs a workers’ council’s approval. The opinion also says prevention should be given much more weight than detection, and we read that as a case for an approved tool over a forensic hunt. It was adopted in June 2017 and its legal framework section covers the old Data Protection Directive, so ask counsel how your national authority reads it today.
Our rule of thumb for week one: count domains by team, not by name, do not inspect content, and do not follow up with individuals. The point is a map, not a list of culprits.
What can staff paste into an AI tool, and what can’t they?
Staff cannot judge “sensitive” on the fly, so give them classes with examples. Two variables decide the answer: the data class and the account type. The same tool can follow very different terms depending on the plan.
OpenAI’s help page says that for its individual services (Free, Plus, Pro) it may use your content to train its models unless you opt out. For its business products it states that by default it does not use business data for training. Anthropic draws the same line: its consumer terms update covers Free, Pro and Max accounts, and does not apply to services under its Commercial Terms. Terms change, so read the ones for the plan you actually buy, on the day you sign.
| Class | Examples | Free personal account | Company-approved business account |
|---|---|---|---|
| Keep out of general-purpose tools | Health data, files under professional secrecy, credentials and keys, unreleased financial results | No | No, unless the register lists a tool approved for exactly that use |
| Personal data | Customer, patient, applicant and employee records | No | Only for a use the register approves, after the DPA and DPIA check |
| Internal, no personal data | Meeting notes, drafts, internal procedures | No | Yes, in an approved tool |
| Source code and technical secrets | Proprietary code, architecture notes | No | Only in a tool the register approves for code |
| Public or your own words | Published pages, a generic email you wrote | No: use the company account | Yes |
Two details make the table work in practice. First, deleting names is not enough: the Hamburg checklist warns that it is not sufficient to remove names and addresses from the entry, because context can still point to the authors and the people concerned. Second, source code gets its own row. Netskope’s Cloud and Threat Report 2026 found that, over the past year, source code (42%), regulated data (32%) and intellectual property (16%) were the most common categories in generative AI data policy violations. That is one vendor’s report.
The same rules as the table, as the questions a person can ask in ten seconds. Print it next to the policy.
What goes in an approved-tools register?
A register is the list that makes “approved” mean something. Without it, a policy can only say no. With it, the policy can say yes to specific tools, for specific uses, with specific data. Each column below earns its place.
| Column | What it holds | Why it is there |
|---|---|---|
| Tool and plan | The product and the exact plan | The same tool follows different terms on different plans |
| Business owner | One named person | Someone answers when the use changes |
| Approved uses | Tasks, not departments | “Summarize internal minutes” is checkable; “marketing” is not |
| Data classes allowed | From your classes above | It is the rule staff actually apply |
| Account | Company-managed only, or not | Personal accounts cannot be reviewed or switched off |
| Contract | DPA signed, date | Article 28(3) asks for a binding contract when a provider processes on your behalf |
| Data path | Where it runs, sub-processors, transfers | GDPR’s transfer rules (Article 44) apply to transfers to a third country |
| Training and retention | Whether your data trains the model, how long it is kept | It decides which classes the tool can take |
| Review date | Next check | Terms and models change; stale rows are how shadow AI returns |
The register works as a rule too: no row, no use. A request for a new tool becomes a new row. Ertas, whose template targets regulated industries, has its governance committee update the approved list quarterly, which is a sensible rhythm.
Example only: the tools are placeholders and the dates are invented to show the columns.
What do GDPR, the AI Act and DORA say about staff using public AI?
Short answers, by article. Counsel confirms how they apply to your tools and your sector.
| Rule | What it says | What it means for shadow AI |
|---|---|---|
| GDPR Articles 4(7) and 5(2) | The controller determines the purposes and means of the processing and must be able to demonstrate compliance | Staff paste on your behalf, so your firm answers, and the Hamburg commissioner says the employer may be liable |
| GDPR Articles 6(1) and 28(3) | Processing needs a lawful basis, and a processor works under a binding contract with set content | A register row records the lawful basis and the signed DPA |
| GDPR Articles 32(4) and 33 | People acting under your authority process personal data only on your instructions; breaches go to the authority within 72 hours of becoming aware, unless unlikely to risk people’s rights | A written policy is the instruction. The Dutch authority says that if an employee enters personal data against the employer’s agreements, that is a data breach, so you need a same-day report path |
| GDPR Article 44 | Transfers to a third country need the conditions of GDPR’s transfer chapter | The register records where each tool sends data |
| AI Act Article 4, as amended by the Digital Omnibus on AI | Providers and deployers take measures to support AI literacy of staff | The Commission says employees using ChatGPT for ad copy or translation should be informed about specific risks, such as hallucination |
| AI Act Article 25(1)(c) and Annex III | A deployer that modifies the intended purpose of a general-purpose AI system so it becomes high-risk is considered a provider | See below |
| DORA Article 28(3) | Financial entities keep a register of information on all contractual arrangements for ICT services from third-party providers | An AI service used under a contract or terms is a candidate for the register; whether a free account counts is a question for counsel |
On the second row, the Dutch authority says that when an organization’s own policy has staff use chatbots with personal data, it is not a breach but often not permitted by law. A signed DPA does not supply a lawful basis by itself, so counsel confirms each approved use.
The row we think firms underrate is Article 25(1)(c). Annex III lists as high-risk AI systems intended for recruitment or selection, for evaluating creditworthiness, and for risk assessment and pricing in life and health insurance. A recruiter who asks a general chatbot to rank CVs, or a loan officer who asks one to assess an applicant, is pointing a general-purpose tool at one of those tasks. On the wording of Article 25(1)(c), the firm may then carry the provider’s duties for a high-risk system.
The Commission says the Annex III rules apply from 2 December 2027, so there is time, but the habit starts now. The policy’s answer is a short list of tasks that need review before any AI use: scoring, ranking or deciding about people.
Two more notes. Where a high-risk system is used at work, Article 26(7) requires employers to inform workers’ representatives and the affected workers first. And the Irish data protection authority adds a plain test for any AI product: what personal data it uses, where the data goes, whether the provider keeps or re-uses it, and how you can meet your obligations. That is the register’s checklist in one sentence. For the underlying questions, see our posts on GDPR and AI agents and the EU AI Act for companies deploying agents.
How do you roll it out so people follow it?
The order matters more than the wording. We would run it like this.
- Announce an amnesty first. For 30 days, anyone can register a tool they use and move from a personal to a company account without consequence. Adaptive Security recommends the same kind of 30-day window. Since more than half of employees say they hide their use, this is how you learn the truth.
- Offer an approved route before you block. Eindhoven’s response after the breach was to block public AI sites and let staff use only Copilot inside the municipal environment. The Hamburg commissioner recommends organization-owned accounts for any approved use. There are three rungs. A business plan of a mainstream assistant under a signed DPA suits general drafting. An assistant built into a suite you already license suits documents already in that suite. For a repeated process with real stakes, such as preparing a claim file or a KYC check, we think a purpose-built agent beats a chatbot, because its data path is written down.
- Add a fast request path. Deeploi’s advice is a fast-track request process: if someone can submit a tool and get a yes or no within a week, they are far less likely to sign up with a personal email.
- Train on the tool and the task. We would run an hour of scenarios rather than a slide deck: “A colleague asks you to summarize a contract in a free tool. What do you do?” It is also one way to act on Article 4. If people review AI output, our post on human oversight in practice shows what they should be trained to look for.
- Open a no-blame report line. Deeploi’s wording is a good model: a blame-free path for reporting an accidental paste. The 72-hour clock in Article 33 starts when you become aware, so you want to be told on the day.
- Block last. After the window, block the categories you tagged Unsanctioned, and keep discovery running. Adaptive Security notes that the AI tool landscape changes monthly, so yesterday’s baseline will not catch tomorrow’s tool.
For a repeated process, the Wise Agents platform has every agent built, tested, approved and watched. Each version is scored against the pass bar you set, a named person approves each release, and every run is recorded step by step (how the platform works). The model provider and route are named per deployment in the DPA. It is a sanctioned alternative for work that people paste into public tools today. We hold ourselves to the rule in this post: our scoping page asks you not to send personal data or confidential documents before the DPA is in place.
A policy template you can copy
Keep it short. Deeploi puts the sweet spot for small teams at two to three pages, a regulated firm may need an annex for the register, and Ertas warns that a policy nobody understands is a policy nobody follows. The template below is ours, written to match the steps above. Adapt it with your DPO.
AI USE POLICY (example, adapt with your DPO and counsel)
1. Why this exists
One paragraph: we want people to use AI well, and we protect clients,
colleagues and the firm while they do.
2. The one-line rule
Use only tools on the register, only with a company account, and
only with the data classes the register allows for that tool.
3. Data classes (with five examples each)
Keep out of general-purpose tools / personal data / internal /
source code and technical secrets / public. Names removed is
not the same as anonymous.
4. The register
Where it lives, who owns it, how to request a new tool, and the
promise to answer the request within an agreed number of days.
5. Accounts
Company-managed accounts only. No personal accounts for work.
Training on our data is switched off wherever the plan allows it.
6. Tasks that need review before AI is used
Scoring, ranking or deciding about people (hiring, credit,
insurance pricing, performance). Ask the DPO first.
7. Checking the output
A named person is responsible for anything sent outside the firm.
AI output is a draft. Facts and figures are checked against a source.
8. What we look at, and what we do not
Say plainly what is logged (tool names and counts by team), what is
not (message content), and who may see it.
9. If something goes wrong
Report the same working day to the DPO. Honest reports are not
punished. The DPO decides whether it is a breach to notify.
10. Training
Short scenario training at onboarding, then once a year and when
the register changes.
11. Owner and review
Policy owner by name. Register reviewed quarterly, policy twice
a year, and after any incident.
12. Consequences
Repeated, deliberate breaches of the rule follow the normal
disciplinary process. Honest mistakes reported promptly do not.Section 8 matters more than it looks. The Article 29 Working Party’s opinion asks employers to tell staff what is monitored and to keep the policy on who may see log data easily and permanently accessible, so it also guides them on acceptable and unacceptable use of the network.
Where to start tomorrow
Pull the Monday logs and send the Friday survey. You will have a list of tools by the end of the week, and a first register by the end of the next. If one of the tools on that list is doing a job that deserves a proper, tested agent, that is the conversation we like to have. Bring one process. In 45 minutes you get a first view of its risk class, the controls it needs and whether an agent is the right tool at all. Book a scoping call.
Questions
Is shadow AI illegal?
Using an AI tool is not illegal by itself. The law comes in through what goes into it. Personal data pasted into a tool with no contract, no lawful basis or no security can breach GDPR, and the controller answers for it (Articles 5(2), 6(1), 28 and 32). The Dutch authority says that an employee who enters personal data into a chatbot against the employer's agreements causes a data breach.
Can we simply block ChatGPT and be done?
You can, and some organizations do after an incident. Eindhoven blocked public AI sites and moved staff to Copilot in its secure environment. We would offer the approved tool first, because a block with no alternative pushes the habit to phones and home laptops, where you cannot see it.
What do we do if someone already pasted client data?
Treat it as a possible personal data breach the same day. Article 33 gives the controller 72 hours after becoming aware to notify the supervisory authority, unless the breach is unlikely to risk people's rights. Record it, ask the provider to delete the upload, and tell the DPO.
Do we need the works council before we look at AI use?
It depends on the country. The EU data protection advisers wrote in 2017 that in some countries an acceptable use policy legally requires approval of a workers' council. For high-risk AI at work, AI Act Article 26(7) separately requires informing workers' representatives. Ask counsel before you start.
Does the AI Act require an AI usage policy?
Not by name. Article 4 asks providers and deployers to take measures to support the AI literacy of their staff, and the Commission says employees using ChatGPT should be told about specific risks such as hallucination. A short policy plus training is a sensible way to meet that.
Sources
- www.ibm.comwww.ibm.com/think/x-force/2025-cost-of-a-data-breach-navigating-ai
- newsroom.ibm.comnewsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- news.microsoft.comnews.microsoft.com/source/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/
- kpmg.comkpmg.com/mt/en/home/media/press-releases/2025/05/global-study-reveals-tension-between-ai-benefits-and-risks-and-highlights-a-governance-gap.html
- datenschutz-hamburg.dedatenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Informationen/20231113_Checklist_LLM_Chatbots_EN.pdf
- www.autoriteitpersoonsgegevens.nlwww.autoriteitpersoonsgegevens.nl/en/current/caution-use-of-ai-chatbot-may-lead-to-data-breaches
- www.accountant.nlwww.accountant.nl/nieuws/2025/12/ap-slaat-alarm-over-datalekken-door-ai/
- nltimes.nlnltimes.nl/node/85334
- www.omroepbrabant.nlwww.omroepbrabant.nl/nieuws/6001041/Datalek:-gemeente-Eindhoven-deelt-persoonsgegevens-met-openbare-AI-websites
- www.binnenlandsbestuur.nlwww.binnenlandsbestuur.nl/digitaal/gemeente-eindhoven-blokkeert-chatgpt-na-datalek
- learn.microsoft.comlearn.microsoft.com/en-us/purview/deploymentmodels/depmod-data-leak-shadow-ai-step1
- learn.microsoft.comlearn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery
- learn.microsoft.comlearn.microsoft.com/en-us/entra/identity/enterprise-apps/user-admin-consent-overview
- knowledge.workspace.google.comknowledge.workspace.google.com/admin/apps/control-which-third-party-and-internal-apps-access-google-workspace-data
- www.tines.comwww.tines.com/blog/how-to-detect-shadow-ai-usage-across-your-organization-without-blocking-adoption/
- www.adaptivesecurity.comwww.adaptivesecurity.com/blog/shadow-ai-policy-template
- www.ertas.aiwww.ertas.ai/blog/shadow-ai-policy-template-regulated-industries
- www.deeploi.iowww.deeploi.io/magazine/ai-policy-template
- ec.europa.euec.europa.eu/newsroom/article29/redirection/document/45631
- help.openai.comhelp.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance
- openai.comopenai.com/enterprise-privacy/
- www.anthropic.comwww.anthropic.com/news/updates-to-our-consumer-terms
- www.netskope.comwww.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- gdpr-info.eugdpr-info.eu/art-4-gdpr/
- gdpr-info.eugdpr-info.eu/art-5-gdpr/
- gdpr-info.eugdpr-info.eu/art-6-gdpr/
- gdpr-info.eugdpr-info.eu/art-28-gdpr/
- gdpr-info.eugdpr-info.eu/art-32-gdpr/
- gdpr-info.eugdpr-info.eu/art-33-gdpr/
- gdpr-info.eugdpr-info.eu/art-44-gdpr/
- ai-act-service-desk.ec.europa.euai-act-service-desk.ec.europa.eu/en/ai-act/article-4
- ai-act-service-desk.ec.europa.euai-act-service-desk.ec.europa.eu/en/ai-act/article-25
- ai-act-service-desk.ec.europa.euai-act-service-desk.ec.europa.eu/en/ai-act/article-26
- artificialintelligenceact.euartificialintelligenceact.eu/annex/3/
- digital-strategy.ec.europa.eudigital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers
- digital-strategy.ec.europa.eudigital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
- eur-lex.europa.eueur-lex.europa.eu/eli/reg/2022/2554/oj
- www.dataprotection.iewww.dataprotection.ie/en/dpc-guidance/blogs/AI-LLMs-and-Data-Protection
- wiseagents.aiwiseagents.ai/platform.html
- wiseagents.aiwiseagents.ai/contact.html
Read on or before 15 November 2026. Not legal advice: your counsel and data protection officer decide.
Related posts
AI Agent Audit Logs: What to Record and How Long to Keep It
AI agent audit logs: the fields to record for every run, what AI Act Articles 12, 19 and 26(6) and GDPR say about keeping them, and a review routine.
Read
GDPR AI Agent Data Processing Agreement: A Checklist
GDPR AI agent data processing agreement checklist: the Article 28(3) items, the sub-processor chain down to the model provider, transfers and ten questions.
ReadGDPR and AI agents: the seven questions your DPO will ask
Controller or processor, the DPA, minimisation, retention, erasure, sub-processors and transfers: what GDPR asks of an AI agent, article by article.
Read