Policy
Employees often use AI chatbots outside their organisation's visibility. What that means, what can go wrong and how to gain control step by step.
Shadow AI is the use of AI tools for work without the organisation knowing, approving it or having made agreements about it. For example, an employee using a personal account to have a client letter rewritten in ChatGPT, Claude or Mistral Vibe. It usually happens with good intentions, which is precisely why it remains unnoticed for so long.
The term derives from shadow IT: software and devices employees arrange themselves, outside the IT department. The difference lies in what goes into it. A personal to-do list contains little. In a chat window, you can paste an entire client file in seconds.
Not every form carries the same risk. Editing marketing text without personal data differs from uploading an employee file. For what data does and does not belong in a chatbot, see the rules by data type.
Rarely out of unwillingness to cooperate. Those who ask almost always hear the same reasons.
The Autoriteit Persoonsgegevens (AP) describes the same picture. In its warning about AI chatbots and data breaches from August 2024, the supervisory authority writes that many people at work use digital assistants, for example to answer client questions or summarise large client files, and often do so on their own initiative.
Big enough to assume it happens in your organisation too. There are few robust, representative figures for the Netherlands, so be cautious about percentages you encounter in presentations.
A frequently quoted figure comes from the Microsoft and LinkedIn Work Trend Index 2024: 78% of surveyed AI users brought their own AI tools to work. Pay attention to what that figure does and does not say. It concerns knowledge workers worldwide who already use AI, is a provider's survey and dates from 2024. It says nothing about how much personal data they enter.
More recent studies by security companies report similar or higher proportions. We do not reproduce those figures here, because the methodology and population studied are often impossible to verify. The direction is consistently the same, however: a substantial share of workplace AI use runs through accounts the organisation does not manage.
At the end of 2025, the municipality of Eindhoven announced that employees had sent files containing personal data to public AI websites. According to reporting by Omroep Brabant, these included youth care documents, internal reports and CVs; it came to light through a thirty-day sample, and the municipality could not establish the true scale. That last point is the lesson: without measurement you do not know, and measuring afterwards shows only part of the picture.
The AP points out that most companies behind chatbots store all data entered. That data then sits on the provider's servers, often without the employee realising it or the person concerned knowing. With a personal account, your organisation has no agreement with that provider. What happens to the input then depends on consumer terms.
When another party processes personal data on your behalf, Article 28 GDPR requires you to work only with processors offering sufficient safeguards. In practice, you record this in a data processing agreement. With a personal account, your organisation enters into nothing: the employee personally accepts consumer terms. What to check in such an agreement is explained in the article about a data processing agreement with an AI provider. The plans on which providers offer such an agreement vary and can change monthly. Check the provider's current terms.
The AP is clear on this. If an employee uses a chatbot on their own initiative against the employer's agreed rules and enters personal data, it is a data breach. The GDPR calls this a personal data breach. Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless a risk to data subjects is unlikely. The AP explains how to assess that risk on its page about whether to report a data breach. The chatbot-specific explanation is in A data breach through an AI chatbot.
The AP adds something often missed. If AI chatbot use is included in your policy, the supervisory authority says it is not a data breach, but is “often not legally permitted”. Allowing use without properly arranging the processing therefore does not solve the problem.
What you do not know about is absent from your record of processing activities, has not been assessed and falls outside your retention periods. You cannot answer an access or erasure request fully if you do not know where data ended up. And a client asking how you handle their file receives an inaccurate answer.
The table below is a reference for anyone wanting to start the conversation within an organisation. None of the signals proves anything alone. Together, they form a picture.
| Signal | What it might mean | Risk | Measure |
|---|---|---|---|
| Colleagues produce noticeably faster, more polished text | AI use through a personal account | Unknown what data has been entered | Ask without judgement and make an inventory of tools |
| Traffic to chatbots from the company network | Browser use, business or personal | Uploads of files containing personal data | Measure first, discuss the result, then offer an alternative |
| Expense claims or credit card charges for AI plans | Teams arrange a tool themselves | No data processing agreement in the organisation's name | Put purchasing under one owner and one contract |
| New browser extensions or AI features in meeting tools | Features reading along without being asked | Recordings and minutes held by a third party | Assess a feature before enabling it and turn it off by default |
| Nobody asks questions about AI | The topic feels unsafe | Use remains invisible | Establish a regular contact and reward reporting |
| Clients ask whether their data is used in AI | You have no conclusive answer | Reputational damage and breach of contract | Record which tools are allowed for which data |
A ban is quick to write and difficult to maintain. It does not remove the need.
Block a website on the office network and someone reaches for their phone or continues at home. You lose visibility while use continues. You then have the risk without the ability to intervene.
Under a strict ban, every question becomes a confession. Employees stop reporting mistakes, even though prompt reporting is necessary to meet the GDPR's 72-hour deadline. The AP asks organisations to make clear agreements with employees: may they use chatbots and, if so, what data may they enter? That differs from silence or simply saying no.
For certain data, no is the right answer. Medical data, criminal offence data, Dutch citizen service numbers and documents subject to confidentiality obligations do not belong in a chatbot for which nothing has been arranged. A ban works when it is narrow, explains why and sits alongside an authorised route. Blocking can form part of this. According to the reporting, Eindhoven employees were no longer allowed to use public AI websites after the notification. Such a measure only lasts if an authorised route is available alongside it.
The steps below assume an organisation with few arrangements in place. Think weeks, not days.
Management decides which tools are allowed and provides a budget. IT manages accounts and settings. The privacy lead or data protection officer assesses the processing. Team leaders have the conversation with their teams. Without that last group, a policy remains a document.
A fictional bookkeeping firm with fourteen employees discovers through a survey that nine use a chatbot, seven through personal accounts. The firm chooses one business plan, writes two pages explaining what may and may not be entered, and agrees that payslips and tax returns must never be included. Three months later, it repeats the survey. Two people turn out still to use personal accounts for minutes. That is not a failure, but exactly the information for which you repeat the check.
Shadow AI often starts in one place: someone wants to ask a question about a client file and has no safe way to do it. PrivaSearch was built for this case. It sits between your documents and the AI model. Personal data is detected inside PrivaSearch and replaced with consistent pseudonyms, and a colleague approves the result before a document becomes searchable. The steps are explained on the page about how it works.
Search then runs on released, pseudonymised passages, with a document and page reference. The AI assistant connection works through MCP, with Claude, ChatGPT Business and Mistral Vibe. The assistant searches the same released passages rather than the originals. Pseudonymisation is not anonymisation: for your organisation it remains personal data, and the GDPR continues to apply.
There is also a boundary we state openly. What someone types into a connected assistant goes directly to that assistant's provider, outside our pseudonymisation. Do not enter names there, and connect only business accounts with a data processing agreement. Read more on the page about AI chatbots and the GDPR.
PrivaSearch does not eliminate shadow AI for you. It offers a route for searching documents containing personal data. Rewriting emails, summarising meetings and all other use remain matters for your own policy and inventory. We have set out what goes wrong with uncontrolled AI use on the risks page. To see how it works with your own type of documents, book a demo.
Shadow IT is all software and equipment employees use without approval. Shadow AI is part of it: AI tools such as chatbots, writing assistants and summarisers. The difference mainly lies in the input. You paste entire texts and files into an AI tool, so a single action can send large amounts of personal data or confidential information to an external provider.
Using an AI tool is not prohibited in itself. It becomes a problem when personal or confidential data is entered without arranging the processing. According to the Autoriteit Persoonsgegevens, it is a data breach if an employee enters personal data into an AI chatbot against the agreed rules. The organisation is responsible, not just the employee. You need a lawyer to assess a specific case.
Start by asking, not monitoring. An open survey without consequences usually reveals more than a technical scan. In addition, you can review network traffic to known AI services, expense claims for plans and installed extensions. Remember that monitoring employees is itself processing of personal data. Coordinate this with your privacy lead and, where applicable, the works council.
That depends on the risk to data subjects. The GDPR requires notification to the supervisory authority, where feasible within 72 hours, unless a risk is unlikely. According to the Autoriteit Persoonsgegevens, sensitive data such as health data requires you to take high risk into account in any event. Also document why you do or do not notify. If in doubt, consult your data protection officer or a lawyer.
It helps a little, and only in combination with other measures. A block stops use on the work laptop, but not on a phone or at home. Without an authorised alternative, use shifts to places where you can no longer see it. Blocking can be appropriate as a temporary measure following an incident, or for services with which you deliberately do not want agreements.
No. A business plan arranges the agreement with the provider, but not what employees enter. Sensitive data, confidential client files and clients' documents require additional rules and sometimes a different route. Employees also continue using personal accounts if they do not know the rules or think the business alternative is worse. Policy, training and a repeated inventory remain necessary.
Who decides on AI tools, who assesses the risks and who oversees them? The roles explained, with a simple meeting structure and an AI register.
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →