Shadow AI in the Workplace: Detect, Govern, Replace

Your employees have been using AI for a while now. The only question is whether you know which ones.

An employee has a chatbot “quickly polish” a contract draft. A colleague installs a browser extension that summarizes emails. In sales, someone connects an AI meeting assistant to the calendar – and the administrator consent request lands as a ticket at the MSP, reason given: “Yes”. That is how it went at one of our customers, described in Admin consent request in Microsoft 365.

That is shadow AI: AI tools used in the company without IT knowing about them or having approved them. Almost every company has it. The question is not whether – but how to deal with it.

What counts as shadow AI?

• Personal accounts with chatbots – Employees use the free access with a personal email for company texts
• Browser extensions – Summarizing, translating, writing – with access to every open page
• AI meeting assistants – Record meetings, transcribe, summarize
• Apps with Microsoft 365 access – Connected by clicking “Accept”, read emails, files, calendar
• AI features in existing software – New features a vendor quietly switches on – see Azure Copilot Agents
• Own scripts with AI interfaces – Developers or power users connect models directly

Why is this a problem?

• Confidential data leaves the company – to providers without a contract, often outside the EU.
• Training and storage: Depending on the service and account type, inputs may be stored or used for training.
• Data protection: Personal data without a legal basis and without a data processing agreement (DPA) – see GDPR for AI support.
• Access rights: Apps and extensions with full access to mailboxes are an entry point.
• Wrong results: AI texts, formulas or code that nobody checks.
• Proof obligations: Customers and auditors increasingly ask which AI is in use – for example in the context of NIS2.

Step 1: Make it visible

Without an overview there are no rules. Possible sources:

• Firewall, proxy and DNS logs: Which AI services are being accessed, by whom, how often?
• Cloud app discovery: Microsoft Defender for Cloud Apps and similar tools list the cloud services in use along with a risk rating.
• Microsoft 365 / Entra ID: Check enterprise applications and granted permissions – which apps have access to email and files?
• Browser extensions: Read out and control them via Group Policy or Intune.
• RMM and security tools: Some now offer their own reports on AI usage.
• Asking: A short, anonymous survey “Which AI tools do you use for what?” often brings more than any technology.

Step 2: Set rules

An AI policy does not have to be long. One page is enough to start:

1. Approved tools – with a business account, a contract and no training on company data.
2. Data classes: What may go in (public texts, general questions), what may not (customer data, HR data, passwords, contracts, source code – depending on the tool)?
3. Review obligation: AI results are checked before they are passed on.
4. New tools: How do you request them, who decides?
5. Labeling: Where does it have to be visible that AI was involved?

Step 3: Offer good alternatives

Shadow AI arises because employees want to solve a real problem. A ban without an alternative just shifts usage to personal devices. Better:

• Provide approved AI tools with a business account – with a contract, EU processing and no training.
• Offer AI where it is needed: in the Office suite, in support, in documentation.
• Block risky services selectively instead of blocking everything.

Step 4: Secure it technically

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

• Restrict user consent for apps and route requests through the admin workflow.
• Browser extensions: limit them to an allowlist via policy.
• Use data loss prevention (DLP) for especially sensitive data, where available.
• Log the use of approved tools.

Step 5: Train

Since February 2025, the EU AI Act requires companies to ensure sufficient AI literacy. A short training on opportunities, limits, data rules and the review obligation covers that and at the same time lowers the risk of shadow AI. Details: EU AI Act for MSPs and IT teams.

What MSPs can offer their customers

• AI inventory at the customer: Which services, which apps, which extensions?
• Policy and training as a package.
• Technical safeguards in Microsoft 365 and in the browser.
• Introduce and support approved alternatives.

How does SuperSupport fit in?

IT support is also an entry point for shadow AI: people who have to wait a long time for IT ask a chatbot and copy error messages, including paths and user names, into it. SuperSupport is an approved AI support: every step logged, sensitive things after IT's approval. What this looks like for internal IT teams and MSPs is explained on the respective pages.

Frequently asked questions

What is shadow AI?

Shadow AI refers to AI tools that employees use without IT's knowledge or approval – for example personal accounts with chatbots, browser extensions, AI meeting assistants or AI features in apps that someone connected themselves.

Why is shadow AI a risk?

Because confidential data – customer data, contracts, source code, HR data – ends up with providers you have no contract with. Depending on the service, inputs may be stored or used for training. On top of that come data protection violations, wrong results nobody checks, and apps with far-reaching access to mailboxes.

How do I detect shadow AI?

Through firewall and proxy logs, cloud app discovery (such as Microsoft Defender for Cloud Apps), the list of apps with access to Microsoft 365, inventories of browser extensions – and by asking your employees. Some RMM and security tools now offer their own reports on AI usage.

Should I just ban AI tools?

A blanket ban usually just shifts usage to personal devices and accounts. Better: offer approved tools with a business account, set clear rules for data, block risky services selectively and train people.

What does shadow AI have to do with the EU AI Act?

Since February 2025, companies that use AI have to ensure their employees have sufficient AI literacy. That requires knowing which AI is being used at all – another reason to make shadow AI visible.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial