Shadow AI: two-thirds of AI users work around the policy. The numbers, the legal position, and the way out for leadership

When you next run a round on AI this quarter, nobody in the room will tell you what the numbers already say: your workforce is using AI. Not as an exception, as the norm. 78 percent of AI users bring their own tools rather than the sanctioned ones. 71 percent of connections to generative AI run through personal accounts. And two-thirds of office professionals who have used AI did so while believing company policy forbade it. The question for 2026 is not whether your people use AI. It is whether you can see it, and what leaves the building while you cannot.

This piece collects what the 2025 and 2026 telemetry and survey data actually show, what that means legally for a German managing director since the AI Act, and the order of measures that work — which is not the order most companies instinctively reach for.

Is my workforce really using AI without approval?

Yes, with a probability that no longer needs a survey of your own. The measurements converge across five independent sources. Microsoft and LinkedIn's Work Trend Index 2024 puts 75 percent of knowledge workers on AI, with 78 percent of those bringing their own tools. LayerX's enterprise telemetry records 71 percent of all connections to generative AI tools via personal, non-corporate accounts, 58 percent of corporate-account connections bypassing single sign-on, and 89 percent of AI usage invisible to identity and access management. The PagerDuty survey of 2026, run by Wakefield Research among 1,250 office professionals at companies with at least 500 million US dollars in annual revenue in Australia, Japan, the UK and the US, found 66 percent admitting AI use they believe violates policy, rising to 72 percent in organisations of 1,500 or more employees.

One figure matters for the management floor in particular: in a Cybernews survey of 1,003 employees in the United States (August 2025), 93 percent of executives and senior managers said they use AI tools at work that their employer has not approved. According to Netskope, 60 percent of users of generative AI SaaS apps were still using personal, unmanaged accounts for them in May 2025.

What actually leaves the building?

The short answer is: more than any file-based control sees. LayerX's Browser Security Report finds 77 percent of employees paste data into generative AI prompts, 82 percent of those paste events run through unmanaged personal accounts, and 40 percent of files uploaded to AI tools contain personal or payment data. In the same 2025 report, generative AI had overtaken every other channel for corporate-to-personal data movement and accounted for 32 percent of it, more than any other exfiltration channel in the enterprise browser.

Harmonic Security's analysis of one million prompts and 20,000 uploaded files across more than 300 applications puts numbers on the sensitivity: nearly 22 percent of uploaded files and 4.37 percent of prompts contained sensitive content, and files — though only 13.9 percent of exposure events — carried 79.7 percent of stored credit card exposures, 75.3 percent of customer profile leaks and 68.8 percent of employee PII incidents. The same analysis found the average enterprise gaining 23 previously unknown generative AI tools in a single quarter. Netskope's Cloud and Threat Report 2026 counts an average of 223 incidents per organisation per month of users sending sensitive data to AI applications, double the prior year. In total, organisations uploaded an average of 8.2 gigabytes per month to generative AI SaaS apps in spring 2025 (Netskope).

PagerDuty adds the human layer: 43 percent have entered work-related correspondence into public AI tools, rising to 51 percent in the UK and 50 percent in Japan. That is contracts, personnel matters and customer complaints, pasted into systems your company has no agreement with.

Which duties land on me as managing director?

Three legal regimes attach, and none of them requires you to have approved anything. That is the point that surprises: the liability does not sit on approved usage, it sits on usage.

First, data protection. An employee pasting customer names, personnel data or correspondence into a public AI tool hands personal data to a provider with whom you have concluded no processing agreement. That is a processing under your responsibility without its contractual basis — a failure of the Article 32 security duty, with a possible notification duty under Article 33 if the exposure qualifies as a breach. For infringements of Articles 28, 32 and 33, the fine framework under Article 83(4) GDPR reaches 10 million euros or two percent of global annual turnover; if the legal basis is also missing or the data goes to a third country without appropriate safeguards, Article 83(5) raises it to 20 million euros or four percent.

Second, the AI Act. Article 4 has applied since 2 February 2025, and since 27 July 2026 in the version of Regulation (EU) 2026/1744: providers and deployers take measures to support the development of AI literacy among their staff and other persons dealing with AI systems on their behalf; they do not have to guarantee any specific level for any individual. Deploying within the meaning of the regulation is use under your own authority; on our reading this includes unsanctioned use by employees, although the regulation does not say so expressly. A company whose staff uses public tools untrained cannot satisfy it. Since 2 August 2026 the Article 50 transparency duties apply on top: deployers must disclose deepfakes, and AI-generated text on matters of public interest that is published without editorial control, as artificially generated, and must inform the persons exposed to emotion recognition or biometric categorisation. Infringements of Article 50 can be fined up to 15 million euros or three percent of global turnover; for SMEs and small mid-caps the lower of the two amounts applies (Article 99(4), (6) and (6a)). For Article 4 the regulation sets no fine bracket of its own; penalties are left to the Member States.

Third, trade-secret law. The German Trade Secrets Act protects information only while the holder took reasonable secrecy measures. Pasting confidential material into a public tool can forfeit the protection entirely — the information stops being a secret the moment your secrecy conduct no longer deserves the name. And the consequence is no longer theoretical: on 11 May 2026 CB Financial Services filed a Form 8-K with the SEC that, according to the CSA, appears to be the first triggered by unauthorised employee AI use rather than a cyberattack. According to IBM's 2025 report, breach costs at organisations with high levels of shadow AI were 670,000 US dollars higher on average; in the 2026 report, the share of organisations studied that had security incidents involving shadow AI more than doubled to 43 percent (from 20 percent, according to IBM), and such incidents cost 5.39 million US dollars on average.

Why prohibition does not work

The instinctive answer — forbid it — is the one the data refutes most clearly. Of the people already using AI, 66 percent do so believing it is not permitted. Asked whether they would disclose their use, 39 percent say they would rather use AI without telling anyone — rising to 47 percent at billion-dollar organisations and 46 percent at firms of 1,500 or more employees. A third would hide it to avoid scrutiny, and 29 percent are not even sure whether use is permitted. A ban does not reduce usage. It removes visibility and adds concealment, which is strictly worse.

What a managing director can act on shows in Netskope's traffic data: the share of generative AI SaaS users on personal accounts fell twelve points between February and May 2025, the first measured sign that sanctioned alternatives displace personal accounts rather than sit alongside them. Supply-side governance beats detection.

The way out: make it visible, sanction it, enable it

Six measures in the order that works. The sequence matters more than the individual items, because each step depends on the previous one being real.

The cost arithmetic is the closing argument. At organisations with high levels of shadow AI, a breach cost 670,000 US dollars more on average, according to IBM's 2025 report. The setup described above is a project of weeks at five figures, not quarters at six. Governance is cheaper than invisibility; the numbers say it plainly enough that the remaining question is only who in your house owns the file.

Frequently asked questions about shadow AI