Get in touch with us
We at accompio will be happy to help you.
04.09.2026
Shadow AI occurs when employees use AI tools without official approval. Discover the risks involved and how companies can create secure AI governance, clear guidelines and suitable tools.
Shadow AI occurs when employees use AI tools in their daily work without these applications being officially authorised or known to the organisation. The quick productivity gain is tempting. At the same time, sensitive data can leak and regulations on data protection, security or compliance can be violated.
The usage also shows that employees want to work with AI and see concrete application possibilities. Companies should understand this need, provide secure tools and establish clear rules. In this way, unmanaged AI usage can be transformed step by step into viable AI governance.
Leonard Püttmann, Solution Architect at accompio AI, explains in an expert interview why shadow AI is so widespread, which risks companies should be aware of, and how personal initiative can be turned into a controlled use of artificial intelligence.
In the interview, Leonard Püttmann demonstrates why technical controls alone are not enough and how companies can combine their employees' needs with clear guardrails and secure AI solutions.
How can companies enable the use of AI whilst protecting sensitive data? In the video, Leonard Püttmann shows how control, clear rules and employee initiative can be combined.
00:06 | Claudia van Veen: Welcome to our expert interview. We are talking about shadow AI in the enterprise and the question of whether it is an engine of innovation or a compliance risk. For this, I welcome Leonard Püttmann.
00:21 | Claudia van Veen: Leonard, who are you and what do you do at accompio?
00:27 | Leonard Püttmann: I am a Solution Architect at accompio AI. I focus on how companies can use AI technologies securely and efficiently to generate tangible value.
00:49 | Claudia van Veen: What is meant by shadow AI?
00:52 | Leonard Püttmann: Shadow AI describes the unregulated use of AI applications that are unknown or unapproved within the company. The term is modelled on shadow IT. For example, employees use public AI tools without the IT department or company management knowing.
01:23 | Claudia van Veen: How widespread is Shadow AI?
01:29 | Leonard Püttmann: Use is widespread. Many AI applications are easily accessible and are already used privately. As a result, it seems obvious to use them for professional tasks as well.
01:42 | Claudia van Veen: Why do employees resort to such tools?
01:47 | Leonard Püttmann: Mostly it is about efficiency. If suitable internal solutions or clear guidelines are lacking, employees look for tools themselves. At the same time, this shows that a genuine need exists.
02:31 | Claudia van Veen: Is Shadow AI more of a technical or an organisational issue?
02:38 | Leonard Püttmann: It is primarily an organisational question. Businesses should understand what employees need and how they can enable them to work securely and efficiently.
03:07 | Claudia van Veen: Is Shadow AI a threat or can it also be an opportunity?
03:14 | Leonard Püttmann: Both. Uncontrolled usage brings risks. At the same time, employee initiative shows which use cases are helpful for staff. Companies can use these insights to provide suitable solutions.
04:22 | Claudia van Veen: How can companies identify Shadow AI and which data are particularly critical?
04:31 | Leonard Püttmann: Particularly critical are personal data, customer information, contracts, patents, internal documents and trade secrets. The usage often only becomes apparent during a conversation or through an incident.
05:02 | Claudia van Veen: Why are these risks often not adequately considered in everyday life?
05:09 | Leonard Püttmann: Immediate benefit is the priority for many people. At the same time, it is often unclear where inputs are processed or stored and what happens to the data.
06:17 | Claudia van Veen: Can Shadow AI be detected technically?
06:22 | Leonard Püttmann: Network traffic analysis can provide clues. However, complete technical detection is hardly realistic because new tools are constantly being added and private access points can also be used.
06:41 | Claudia van Veen: How should companies deal with the issue?
06:48 | Leonard Püttmann: A blanket ban is not enough. Companies should explain risks in an understandable way, talk to the teams and record which applications they need.
07:21 | Claudia van Veen: How can a wishlist for AI tools help?
07:27 | Leonard Püttmann: A simple reporting channel makes it clear which tools employees want to use and the requirements behind them. This allows recurring needs to be identified and prioritised.
07:46 | Claudia van Veen: What is part of clear guidelines?
07:52 | Leonard Püttmann: Guidelines should specify which tools are permitted, which data may be used and who reviews new applications. Training courses and workshops help to communicate the rules using concrete work situations.
08:33 | Claudia van Veen: What role does shadow AI play in the culture of innovation?
08:40 | Leonard Püttmann: Shadow AI shows curiosity and a practical need. Leaders should listen, examine the use cases and provide secure alternatives as quickly as possible.
09:22 | Claudia van Veen: What would be a negative example?
09:29 | Leonard Püttmann: It becomes problematic when sensitive information is entered into unapproved applications. This can give rise to data protection, compliance and reputational risks.
09:56 | Claudia van Veen: And what does a positive example look like?
10:02 | Leonard Püttmann: A helpful use case can arise from a team's day-to-day practice. If the company reviews it and turns it into an approved solution, other employees will then benefit from it too.
10:31 | Claudia van Veen: How will the issue develop?
10:38 | Leonard Püttmann: The number of AI applications will continue to grow, and AI will be integrated more heavily into existing tools. Therefore, companies must continuously develop their governance, their rules and the solutions they provide.
11:12 | Claudia van Veen: Is Shadow AI considered a general part of Shadow IT in the long term?
11:19 | Leonard Püttmann: The terms may grow together. What is crucial is less the designation than a controlled approach to unapproved applications and the data processed within them.
11:38 | Claudia van Veen: Is Shadow AI ultimately more of a risk or an opportunity?
11:44 | Leonard Püttmann: Left unregulated, it is a risk. If companies tackle the risks and translate employees' needs into secure solutions, it can turn into a real opportunity.
11:53 | Claudia van Veen: What is your specific tip for businesses?
12:00 | Leonard Püttmann: Talk to your employees, listen to them, and find out which tools are needed. If you need support, you are also welcome to speak with accompio IT.
12:14 | Claudia van Veen: Thank you for the conversation.
Shadow AI refers to a situation where employees use AI applications that are neither officially approved, known, nor controlled within the company. The term is based on shadow IT. It refers to a form of uncontrolled use rather than a specific product.
A typical example is a public AI chatbot into which employees enter texts, spreadsheets or documents to complete a task more quickly. From the organisation's perspective, this leaves important questions unanswered: What data is being processed? Where is the processing taking place? Is anything stored? Who can access the information?
Shadow AI can also lead to silos. Individual teams use different tools, knowledge is rarely shared and security requirements are implemented inconsistently. A joint AI strategy creates transparency here.
During the conversation, Leonard Püttmann mentions two main reasons. Firstly, employees want to work more efficiently and are looking for suitable tools themselves. AI now supports many tasks, such as structuring information, drafting texts or handling repetitive work steps.
Secondly, many employees are already familiar with AI applications from their personal lives. Positive experiences with ChatGPT, Google Gemini and other tools shape the expectation of being able to use comparable support in their professional lives too.
When suitable enterprise solutions or clear guidelines are lacking, teams find their own ways. Shadow AI is therefore frequently an organisational signal. It shows the areas where employees need support and where the internal provision of AI is not yet keeping pace with practical demand.
The greatest risk arises when sensitive information enters external AI applications. This includes personal data, customer information, contract documents, patents, internal records and trade secrets. A clear Data classification helps to identify information worthy of protection. For users, it is often barely recognisable how a service processes or stores input.
Unregulated AI usage makes it harder to comply with legal and internal requirements. With the EU AI Act furthermore, AI literacy is gaining importance within companies. Providers and operators of AI systems must take measures to promote the AI literacy of their employees. Training should therefore take into account the specific work context and the systems used.
If confidential information is disclosed, this results in reputational damage alongside potential legal consequences. Customers expect companies to protect their data reliably. Uncontrolled AI usage can undermine this trust.
Seamless technical detection is difficult. Companies can analyse network traffic, but the number of available AI tools is constantly growing. New services and private access points can only be tracked to a limited extent via this method.
Greater transparency is achieved through direct dialogue. Managers and IT managers should ask which tools teams are already using, which tasks they use them for, and which functions they feel are missing in the approved solutions. A low-threshold reporting channel for desired tools makes these needs visible.
„You just have to face the risks, and then the whole thing can work out well too.“
Leonard Püttmann, Solution Architect at accompio AI
A blanket ban usually does not eliminate the need for AI assistance. A more effective approach is one that reduces risks and transfers good use cases into a secure framework.
Organisations should clarify, together with the business departments, which AI tools are already in use and what purpose they serve. A list for tool requests helps to identify and prioritise recurring requirements.
Guidelines should explain clearly which applications are permitted, which data may be used and who reviews new tools. Short, concrete rules are more helpful in everyday life than general prohibitions.
Self-paced introductory courses on artificial intelligence teach the basics at one's own pace. Workshops are suitable for examining real use cases from individual teams. Employees learn where risks lie and how they can safely use AI in their work area.
Approved solutions must genuinely support employees in their tasks. For sensitive company data, an internal Confidential AI environment be a suitable basis. If the alternative is secure and usable in everyday life, the incentive to switch to unknown external services decreases.
The AI landscape is changing rapidly. Companies should regularly review the tools and rules they use. Shadow AI is therefore becoming an established part of the IT Governance and is losing its uncontrolled character step by step.
You want to record existing AI usage, evaluate suitable use cases and provide your teams with secure tools? accompio supports you in developing a practical AI strategy, with technical implementation and with the secure integration of AI into your existing infrastructure.
AI tools used on one's own initiative show where processes can be improved. Teams gain practical experience and often recognise early on which applications offer genuine added value. These impulses are valuable for companies if they are openly received and professionally evaluated.
Managers play an important role in this. They create opportunities for discussion, take needs seriously and quickly provide secure solutions. Such a culture of innovation combines curiosity with responsibility. Individual experiments can thus develop into approved use cases that benefit multiple teams.
Leonard Püttmann works as a Solution Architect at accompio AI. He deals daily with how companies can use AI technologies securely and efficiently and thus create tangible added value.
Shadow IT encompasses all unauthorised hardware and software solutions. Shadow AI specifically refers to the unregulated use of AI applications and the associated processing of data.
A complete technical control is hardly realistic given the many available tools. Companies can significantly reduce risk by making usage transparent, offering secure alternatives, defining clear rules and regularly training employees.
Personal data, customer information, contracts, patents, internal documents, and trade secrets require a particularly high level of protection. Before entering them, it must be clarified whether the tool being used is authorised for such data.
A practical AI guideline specifies permitted tools, allowed data, prohibited applications, responsibilities, and the process for reviewing new tools. It should be easily accessible and explained using real-world examples.
Unregulated use is a risk. At the same time, it makes a willingness to innovate and concrete requirements visible. If companies take up these impulses, assess risks and provide secure solutions, this can result in productive and controlled AI usage.
