Home
/
Rethink Work blog
/
Security
/
Why Shadow AI is the Next Major Business Risk – and How You Can Address It

Across Europe, AI adoption has accelerated at a pace few organizations were prepared for. As ever more powerful tools become freely available online, employees may be increasingly tempted to use unapproved third-party systems to speed up tasks, generate content, or analyze data. This quiet, decentralized use of AI – widely known as Shadow AI – is now one of the fastest growing potential risks in the modern workplace.

The complexity of AI brings fresh challenges and potential dangers. For example, the BCS (British Computer Society) published a detailed analysis warning that Shadow AI is more dangerous than traditional Shadow IT because employees are feeding sensitive data into unregulated AI systems, often with little idea of where this data is being processed or stored. There is also a worrying prospect of the use of Shadow AI going undetected until issues arise – figures from Withum suggest 57% of employees hide their AI usage at work.

Despite the potential dangers, however, there is no reason to assume Shadow AI is driven by malicious intent. Rather, it commonly emerges because employees want to work faster, solve problems creatively, and bypass slow internal processes. But the consequences can be serious: exposure of sensitive business information, GDPR and EU AI Act breaches, intellectual property loss, and inconsistent or inaccurate outputs that undermine decision making.

In this blog article we explore the potential problems, the specific risks for European organizations, and the practical steps businesses can take to regain control – without stifling innovation.

The Scale of Shadow AI in Europe

Recent research shows that Shadow AI is not just fringe behavior – it is now mainstream. The Reco AI – 2025 State of Shadow AI Report suggests that 98% of companies have employees using unauthorized AI tools in some form. Meanwhile, Microsoft UK’s 2025 findings reveal the extent of the issue, with 71% of employees having used unapproved consumer AI tools at work, with 51% doing so every week. Only 32% are concerned about privacy risks, and only 29% worry about the security implications. The report warns that Shadow AI creates risks of data leaks, regulatory noncompliance, and cyberattack exposure.

Conversely, the official adoption of AI is also lagging for many businesses. According to research by Eurostat, in 2025 only 20% of official EU enterprises formally integrated and sanctioned AI technologies into their operations.  While this is up from 13.5% the year before, it leaves an enormous 80% of companies without official AI capabilities – creating a massive vacuum that employees fill using Shadow AI. A geographic divide exists too: Northern Europe leads in adoption of AI into businesses (Denmark at 42%, Finland at 38%), while Eastern and Southern Europe lag significantly (Romania at 5%, Poland at 8%), potentially forcing workers in lagging regions to rely heavily on personal AI accounts to keep up productivity.

Forrester predicts a surge in Shadow AI usage as employees independently adopt tools that help them work faster. Like Withum’s research, Gartner also reports a growing trend of employees using AI tools without informing employers, creating accountability and compliance risks. Major firms – including Apple, Amazon, and JPMorgan – have already restricted internal use of public AI tools due to data leakage concerns.

Why Shadow AI Is a Bigger Risk Than Shadow IT

Shadow IT – the use of unapproved apps or devices – has been a known issue for years, but Shadow AI introduces deeper, more systemic risks. Figures from the Komprise’s 2025 IT Survey of 200 U.S. enterprise executives reveals significant AI risks: 90% fear security and privacy threats from Shadow AI, 80% have experienced AI-related data incidents, and 13% have already suffered financial, client, or reputational damage.

Three key concerns for organizations include:

  1. Sensitive data is being fed into external systems: TechAhead’s analysis shows that corporate data fed into AI tools increased 485% in one year, while the sharing of sensitive data within those inputs nearly tripled – from 10.7% to 27.4%. The research also found that 75% of knowledge workers already use AI tools at work and, worryingly, that nearly half would continue even if banned. TechAhead’s analysis also emphasized that Shadow AI often involves unvetted tools processing sensitive information without encryption, governance, or accountability.
  2. GDPR and EU AI Act compliance risks: Under GDPR, organizations remain responsible for how personal data is processed – even if an employee uploads it to an external AI tool without permission. The EU AI Act, which officially came into force on 1st August 2024, adds further obligations, including transparency requirements, data governance and quality controls, risk management for high-risk systems, and documentation and auditability requirements. Shadow AI directly conflicts with these requirements, exposing organizations to regulatory penalties and reputational damage.
  3. Inconsistent or inaccurate outputs: Unregulated AI tools can generate fabricated facts, biased or incomplete analysis, and outputs that cannot be audited or explained. This undermines decision making and creates operational risk – especially in sensitive sectors such as finance, healthcare, legal services, and public administration.

Why do Employees Turn to Shadow AI?

The logical and simple answer is that AI helps them work faster. Microsoft’s research shows employees use Shadow AI because it boosts productivity, not because they want to break rules. Interestingly, research from BlackFog shows that nearly half (49%) of employees have used AI tools without their employers’ approval, but even more concerning is that a clear majority of leadership – 69% of the C-suite and 66% of senior management – are comfortable with this trade-off, choosing to prioritize speed over privacy in their rush to deploy AI.

Ideally employees will use fully vetted and sanctioned AI systems to achieve these productivity gains and advantages, while avoiding the potential risks from Shadow AI systems. Unfortunately, many organizations still lack clear AI usage policies, approved tools that meet real workflow needs, and training on safe and compliant AI use. It is essential to address this to ensure AI is used safely and responsibly.

How European Businesses Can Reduce Shadow AI risks – Without Slowing Innovation

Shadow AI risks cannot be solved by banning tools – determined employees will simply work around restrictions. Instead, organizations need a balanced approach that combines governance, technology, and culture.

However, policing Shadow AI can be complex, especially for organizations that don’t have internal expertise to analyze and assess the tools being used. It is more logical to remove the need for Shadow AI by replacing it with safe, approved, and effective AI systems which will help employees meet the needs without putting the organization at risk.

Below is a practical framework that helps an organization to align with European regulatory expectations and industry best practice:

  1. Be aware of what AI is being used already: As AI becomes essential to operations, internal audits are critical for ensuring the technology is used safely. While the focus has shifted from standard software to complex algorithms, the core goals – evidence, traceability, and accountability – remain the same. The process starts with creating a clear inventory of all AI models, integrations, and APIs, documenting their purpose, data sensitivity, and ownership. This baseline allows companies to manage risk effectively. By adopting industry standards like NIST or ISO/IEC 42001, organizations can turn technical oversight into clear, verifiable business accountability.
  2. Establish a clear, organization-wide AI usage policy: Employees may turn to unapproved tools in the absence of formal AI usage rules. A robust AI policy provides clear direction and sets binding standards across the organization. It should define approved AI tools, specify what data may or may not be shared, and establish mandatory requirements for handling personal and confidential information. It should also set clear expectations for transparency and traceability in AI use. This will provide a strong basis for ensuring all systems comply with GDPR and the EU AI Act.
  3. Provide secure, enterprise-grade AI tools: As we have discussed, the most effective way to reduce Shadow AI is to offer officially sanctioned tools that are secure, auditable, and integrated into existing workflows. For example, solutions such as Microsoft 365’s Copilot provide enterprise level governance, encryption, and data residency controls – giving employees the productivity benefits they want without risks.
  4. Build AI literacy and awareness: As we have seen, Microsoft’s research shows only 32% of employees are concerned about privacy risks when using consumer AI tools. This means effective training – often referred to as “AI literacy, or AI fluency” – will be needed to help employees understand how AI tools store and process data, what constitutes high risk behavior, the regulatory implications under GDPR and the EU AI Act, and underline when human oversight is required. It is also worth remembering that any governance framework is only as effective as the culture supporting it. While policies set boundaries, culture dictates behavior – transforming compliance from a mandatory requirement into an ingrained organizational habit.
  5. Implement strong data governance and access controls: As previously highlighted,TechAhead’s findingsshow that the volume of sensitive data entered into AI tools nearly tripled within a year, reinforcing the need for robust controls. Organizations should classify data, restrict external sharing, and deploy Data Loss Prevention (DLP) tools to prevent unauthorized uploads. They should also monitor AI-related activity for anomalies and ensure encryption and audit trails for all approved systems. This aligns directly with the EU AI Act’s requirements for transparency and risk management.
  6. Create a central AI governance team: Ideally, an organization should appoint a cross functional group – typically IT, security, legal, HR, and business leaders – that can oversee the use of AI systems. This can include tool evaluation and approval, risk assessments, vendor due diligence, and compliance monitoring. This AI management group ensures AI adoption is strategic, consistent, and aligned across the organization.
  7. Encourage responsible experimentation: While there are potential issues, Shadow AI often emerges from innovation. In some cases, instead of shutting these efforts down, organizations can turn AI curiosity into structured value creation by channeling this approach and providing sandboxes for testing new tools, clear processes for proposing new use cases, and supporting experimentation with proper oversight.
  8. Communicate the benefits of using approved tools: Employees that clearly understand why some AI tools are permitted whilst others need to be banned are more likely to follow the rules. Therefore, it is important to communicate how approved tools protect client and business data, how they reduce personal risk, and how they support long term AI strategy. This will help to build a culture of trust and shared responsibility.

  9. Monitor, measure, and continuously improve: The use of Shadow AI is not a one-time issue – it will evolve and change as new tools emerge in the future. With this in mind, organizations should track AI usage trends, review incidents or near misses, update policies as regulations change, and ensure training is refreshed regularly. This creates a living governance model that adapts to the pace of AI innovation.

Turning Shadow AI from a Risk into a Competitive Advantage

Shadow AI is a symptom of a deeper truth: employees want AI, and they will use it, but in some cases, this will be with or without approval. The organizations that thrive will be those that provide secure, accessible AI tools, that build strong governance frameworks, encourage responsible innovation, and ensure they fully align with GDPR and the EU AI Act.

By embracing AI safely and strategically, European businesses can unlock productivity, protect their data, and build a future ready workforce.

Konica Minolta’s Approach

Successfully addressing Shadow AI can be daunting for businesses that don’t have the expertise or knowledge base to do so effectively. This is where expert assistance makes a considerable difference.

At Konica Minolta, we help organizations get the most out of technology – whether it's the effective and planned deployment of AI in Microsoft 365 Copilot, intelligent document processing or business processes and business intelligence. We combine technology expertise with business understanding to help your company streamline processes, improve productivity and make better decisions by taking an information-led approach.

Share: