Shadow AI: when AI works unnoticed in your business.

What is shadow AI?

Shadow AI is workplace AI use without approval: employees upload files to personal chats, install AI extensions or use new AI features without a company review.

Customer data and business secrets can reach external providers. Management may not know which data is involved or how it is used afterwards.

Three examples from daily work

• The contract: an employee uploads a client contract to a personal AI chat to understand a clause. It contains names, prices and a confidentiality agreement.
• The extension: a team installs an AI writing assistant in its browser. It can read page content and may also gain access to an internal CRM.
• The meeting: an employee sends a meeting recording to an online transcription service. The recording discusses personnel matters and unpublished business figures.

These are illustrative situations, not reports about MYNA clients. The Swiss NCSC describes similar risks from unintentional sharing of business and personal data. Swiss NCSC: AI at work (German)

The upload happens before the useful answer

One clear rule for your team

No confidential business data in unapproved AI services. This covers customer and personnel data, internal cost calculations, source code and credentials.

For example, if a customer contract forbids sharing code externally, that includes a personal paid chat account. Passwords and API keys do not belong in general AI chats.

For personal data, the company must assess processing by providers and any transfers abroad. A personal subscription does not replace this assessment. FADP: Articles 9 and 16 onwards

“Paid” does not mean “no training”

Not every cloud licence excludes model training on your inputs. Check the terms and settings of the account in use. If training is enabled, explicitly switch it off. Some business services already exclude it. NCSC: Business accounts and opt-out (DE)

Even without training, the provider processes your inputs and may store them. See specific provider examples in our cloud comparison.

Five steps to address shadow AI

• Find out what is used: Ask your team about chats, browser extensions and meeting bots.
• Record what is allowed: List approved tasks and data for each tool.
• Check accounts: Clarify training, storage, deletion and access.
• Provide a local alternative: With MYNA, your team can work with documents, ask questions and transcribe audio. The content stays in your company.
• Name a contact: Employees should be able to report uncertainty or accidental uploads quickly.

A usable, approved solution gives your team a way to complete these tasks without turning to personal AI accounts.

What to do after an accidental upload

Stop further inputs and report the incident internally. Record the service, account, time and affected data. If passwords or keys were exposed, have them revoked or replaced immediately.

The responsible person checks deletion options, protective measures and reporting duties. If a data security breach is likely to create a high risk for affected individuals, the company must notify the FDPIC as soon as possible. FADP: Article 24