Shadow AI in companies: why bans do not protect you
Shadow AI describes AI tools that employees use without approval, usually public services accessed through private accounts. It grows wherever AI is banned or merely tolerated. What works against it is an approved tool, a short AI usage policy and a data classification that sets out which data may leave the company.
For decision makers in brief
Situation: In manufacturing, 8 % of companies explicitly ban AI, only 30 % actively provide it and 39 % merely tolerate its use (ZEW 2026).
Risk: Where AI is only tolerated, nobody knows which data goes where. Design data, cost calculations and customer information end up in public services.
Effort: Four steps are enough to start: an inventory of the tools in use, a classification of your data, a short policy with an approved tool and early involvement of the works council. They fit into the first 90 days.
Cost: An approved tool costs money. Shadow AI costs money too, it is just invisible: data leakage, missing logs and renegotiations with the works council.
What defines shadow AI
The term borrows from shadow IT, meaning software that business units deploy without the IT department. With AI the threshold is especially low. A browser is all it takes to summarise a draft contract, check a cost calculation or translate a customer enquiry. The motives of employees are almost always legitimate: they want to work faster. The problem lies in the path the data takes along the way.
How widespread freely available tools are is shown by the business survey of the ifo Institute, the Munich economic research institute, for 2026: 22.5 % of companies using AI rely exclusively on free systems, while only 18.7 % run their own AI systems. Free services are not automatically shadow AI. They become shadow AI as soon as nobody has defined which data belongs in them.
Feature | Approved AI tool | Shadow AI |
|---|---|---|
Who decides on use | The company, with a policy | Individual employees |
Where data is processed | Contractually defined, on request on your own premises | At the service provider, often outside the EU |
Contractual basis | Data processing agreement in place | Private terms of use |
Logging | Traceable, auditable | None within the company |
Knowledge of use | Inventory, named contact | Nobody has an overview |
Ban, tolerate or provide: how industry responds
A survey by ZEW, the Leibniz Centre for European Economic Research in Mannheim, conducted in spring 2026 among around 1,500 companies delivers perhaps the most uncomfortable figure in the industry report. In manufacturing, AI use is explicitly banned in 8 % of companies, in the information economy in only 4 %.
Stance on AI use | Manufacturing | Source |
|---|---|---|
AI applications are actively provided | 30 % | ZEW 2026 |
Use is merely tolerated | 39 % | ZEW 2026 |
Use is explicitly banned | 8 % | ZEW 2026 |
For comparison: ban in the information economy | 4 % | ZEW 2026 |
The largest group is therefore not the one that bans, it is the one that looks away. Tolerance is not governance. Where employees use AI without defined rules and tools, exactly the risk arises that most companies fear: 77 % name data protection requirements as the biggest barrier to AI and digitalisation, ahead of the skills shortage at 70 % (Bitkom 2026, the German digital industry association).
Why bans create shadow AI in companies
A ban is the understandable reaction to this risk. It does not solve the problem, though, it shifts it into shadow IT. There are three reasons for this.
First, the benefit for employees remains. Anyone who has seen a summary take only a fraction of the time will, if in doubt, reach for their private smartphone. A ban cannot be enforced there.
Second, the company loses its overview. An inventory of what is used officially and unofficially is the precondition for any prioritisation. After a ban, nobody reports honestly which tools are in use.
Third, it loses the learning curve. What employees try out in secret would often be a good candidate for the first official pilot. Under a ban it never surfaces.
The conclusion of the industry report is therefore clear: bans create shadow IT, providing tools creates control.
Provide instead of ban: the approved tool
An approved AI tool has to do two things at once. It must be as easy to use as a public service, otherwise employees keep working around it. At the same time it must meet the requirements that public services fail to meet for much of your data. The industry report names four operational criteria:
Models run on your own hardware or with processing exclusively in the EU.
Design data, cost calculations and customer prices are not transferred to third parties.
Every use is logged so that audits remain possible.
The model is interchangeable, so the dependency does not simply move elsewhere.
The obvious implementation is a language model on your own infrastructure that is available internally like a familiar assistant. We describe what this looks like technically under AI in your own data centre. Which contractual and technical evidence you should demand from a provider is set out on our page on GDPR compliant AI with data processing agreements and logging.
A documented case shows that this approach works in industry: Covestro runs COVA, a company wide assistant on its own infrastructure, which according to the company is used by 4,500 employees every week. This is not one of our projects, yet it shows that providing a tool concentrates usage. How you can check whether an offer really keeps data within your own sphere of control is described in our article on verifiable digital sovereignty in AI.
Template outline for a short AI usage policy
A policy only works if people read it. It should therefore be short and concrete. The following outline serves as a starting point.
Section | What it covers |
|---|---|
1. Purpose and scope | Who the policy applies to and which types of AI applications it covers |
2. Approved tools | Which tools may be used and how to get access |
3. Data classes | Which data may go into which tool, for example public, internal, confidential, strictly confidential |
4. Prohibited use | For example confidential data in non approved services or decisions about people without human review |
5. Review obligation | Results are checked by a person before they are passed on |
6. Labelling | When AI generated content is disclosed to customers or the public |
7. Competence | Which training employees receive before they use a tool |
8. Contact and reporting channel | Who is responsible for AI and where new use cases are reported |
9. Review | When the policy is updated, for example for new tools or deadlines |
Two sections have a regulatory background. In our reading, Article 4 of the AI Act has required AI literacy measures since 2 February 2025. The Digital Omnibus softened this in July 2026: instead of ensuring literacy, companies now have to take measures to promote it. Since 2 August 2026 the transparency obligations of Article 50 have also applied. How we build these obligations into projects is described on our page on AI compliance and the EU AI Act. The specific assessment for your company belongs in a legal review.
Co-determination and AI: the works council comes before the pilot
Using AI systems that can record the performance or behaviour of employees touches on the co-determination rights of the works council. In February 2026, Bitkom published a guide on artificial intelligence and co-determination. According to the research for our industry report, there is no robust survey data that quantifies co-determination as a barrier.
In practice it has proven effective to involve the works council before the pilot, not just before the rollout. A works agreement negotiated after the fact is regularly more expensive than one agreed in advance. A tool agreed with the works council builds trust in both directions: employees know what is allowed, management knows what is being used.
Four steps from tolerance to control
Inventory: Record which AI tools are used officially and unofficially. Ask without threatening sanctions, otherwise the list stays incomplete.
Data classification: Define in writing which data may leave the company and which may not. This determines architecture and cost more than any choice of model.
Policy and tool: Publish the short policy together with an approved tool. A policy without a tool is a ban by another name.
Responsibility and co-determination: Appoint a person with dedicated working time for AI topics and involve the works council before the first pilot starts.
