Shadow IT and Shadow AI: Legal Threats and Employer Obligations

Employees are increasingly turning to unauthorized Artificial Intelligence and Information Technology tools, a phenomenon known as Shadow AI and Shadow IT, to enhance their daily work. This trend is driven by a growing technological awareness, generational shifts in the workforce, and constant pressure to maximize productivity and automate processes.

While many companies are adopting AI tools, their implementation is not always seamless. Employees often begin using their preferred tools long before official adoption, unaware of the associated risks. Shadow IT involves using unapproved software for basic needs like note-taking, email management, file sharing, or system cleaning. Shadow AI, a more advanced form, introduces new dimensions of risk.

The legal implications of Shadow IT are often underestimated. Employees typically choose software based on functionality and accessibility, neglecting crucial aspects like data encryption and storage. A seemingly harmless note-taking app, chosen for its user-friendly interface and multi-device synchronization, could become a major liability if its provider makes saved content publicly searchable. Similarly, file-sharing tools that require access to company documents, storing them in the creator's database, pose a significant threat, especially when users log in with established email accounts, granting broad access.