Artificial intelligence is already embedded in modern business operations. Employees use AI tools to draft emails, summarise meetings, analyse documents, generate code, prepare presentations and accelerate decision-making. In many organisations, however, this adoption is happening quietly and without oversight.
This phenomenon is increasingly referred to as “Shadow AI”, the use of AI systems by employees without formal approval, governance or visibility from the organisation. Regulators and legal commentators are now warning that uncontrolled AI use creates significant legal, operational and reputational risks for businesses.
For many companies, the question is no longer whether employees are using AI. The real question is whether the business has any meaningful control over how it is being used.
What is “Shadow AI”?
Shadow AI describes the use of generative AI tools outside corporate governance structures. Examples may include:
- employees uploading contracts into public AI tools for summarisation;
- developers using AI coding assistants without approval;
- HR teams using AI to review CVs or draft employment documentation;
- finance teams relying on AI-generated analysis;
- staff using personal AI accounts to process internal company information.
The issue is not necessarily that employees are using AI. In many cases, AI improves efficiency and productivity. The problem arises when organisations have no visibility over:
- which tools are being used;
- what data is being uploaded;
- where that data is stored;
- whether outputs are reliable;
- who is accountable for decisions influenced by AI.
In practice, many organisations already have employees using AI daily without any formal internal policy.
Why businesses cannot afford to ignore AI governance
1. Confidential information and trade secrets
Employees frequently use AI tools to process commercially sensitive information without fully understanding where the data goes.
This may include:
- contracts;
- customer information;
- pricing models;
- business strategies;
- source code;
- financial information;
- internal communications.
Many public AI systems process prompts through third-party infrastructure and may retain data for training or monitoring purposes, depending on configuration and provider terms.
Without a clear AI policy, businesses may unintentionally expose confidential information or weaken legal protections over trade secrets and intellectual property.
In regulated sectors, this may also result in contractual breaches, confidentiality violations, or professional conduct issues.
2. Data protection and GDPR risks
AI governance is now directly linked to data protection compliance.
If employees upload personal data into external AI tools without authorisation, the organisation may still remain legally responsible as the data controller. Regulators have repeatedly stressed that existing data protection laws apply regardless of whether AI systems are involved.
Potential risks include:
- unlawful processing of personal data;
- international data transfers;
- lack of transparency;
- inadequate security measures;
- inability to respond to subject access requests;
- data retention concerns;
- unauthorised sharing of special category data.
Many organisations underestimate how easily sensitive personal data can be entered into AI systems through seemingly harmless prompts.
3. Hallucinations and decision-making risks
AI outputs can appear highly convincing while still being inaccurate.
This creates a particular risk where employees rely on AI-generated:
- legal summaries;
- financial analysis;
- compliance recommendations;
- technical outputs;
- HR decisions;
- customer communications.
Regulators have specifically warned about “automation bias”, which is the tendency for users to over-trust AI-generated outputs without sufficient verification.
In practice, businesses may face:
- flawed decision-making;
- inaccurate advice;
- discriminatory outcomes;
- contractual errors;
- reputational damage;
- regulatory investigations.
AI can support human judgment, but it should never replace it.
4. Cybersecurity exposure
Uncontrolled AI adoption can significantly expand a company’s attack surface.
Employees may connect unauthorised AI tools to:
- email systems;
- CRMs;
- cloud storage;
- internal databases;
- code repositories.
This creates additional cybersecurity vulnerabilities, particularly where organisations have limited oversight over integrations, APIs or third-party vendors.
In many cases, the legal issue is not the AI tool itself, but the absence of governance around how it is deployed.
5. Reputational and regulatory risk
AI-related failures increasingly attract public and regulatory scrutiny.
A single inaccurate AI-generated communication, misuse of customer data or reliance on fabricated outputs may cause:
- client disputes;
- reputational harm;
- loss of trust;
- regulatory complaints;
- litigation exposure.
This is particularly important for professional services firms, financial institutions, healthcare providers and technology businesses where trust and accuracy are critical.
What should an AI use policy include?
An AI policy should not simply prohibit AI usage. Blanket bans are rarely effective and often encourage further “Shadow AI” adoption.
Instead, businesses should implement a practical framework that enables responsible and transparent AI use across the organisation.
In general, an AI use policy should address:
- which AI tools employees are permitted to use;
- what types of data can and cannot be uploaded into AI systems;
- confidentiality and data protection obligations;
- human oversight and verification of AI-generated outputs;
- cybersecurity and access control measures;
- intellectual property considerations;
- employee training and awareness;
- internal approval processes for AI adoption;
- accountability and reporting procedures where issues arise.
The framework should also be tailored to the organisation’s specific industry, regulatory obligations, internal systems and risk profile. A generic template policy is often insufficient where businesses process sensitive data, operate in regulated sectors or rely heavily on technology infrastructure.
How we can help
At IMD, we advise businesses on the legal and commercial risks associated with AI adoption, including:
- AI governance frameworks;
- AI use policies;
- data protection and GDPR compliance;
- SaaS and AI-related contracts;
- confidentiality and IP protection;
- technology disputes;
- risk management and internal governance.
As AI regulation and enforcement continue to evolve, businesses should ensure that innovation is supported by clear legal and operational safeguards rather than uncontrolled adoption.
This article is for general information only and does not constitute legal or professional advice. Please note that the law may have changed since this article was published.
