Shadow AI: data risks and the actual legal scope
Unapproved AI use can put data at risk. It does not by itself prove an AI Act or GDPR breach; the processing and applicable duties matter.
Contents
Shadow AI means staff using AI tools outside an organisation’s approved arrangements. An employee may place personal data, trade secrets or internal documents in a service whose terms, retention and access controls have not been assessed. That can expose data, but it does not automatically establish breaches of both the AI Act and GDPR.
Correcting the original timeline
The original report described 2 August 2024 as the start of the AI Act’s new obligations. The regulation entered into force on 1 August 2024, while particular duties apply progressively under Article 113. Article 50 transparency duties apply from 2 August 2026; the current text gives high-risk rules different dates. The legal position cannot be determined from a tool’s name or the regulation’s adoption year alone.
Assess personal data separately
In Opinion 28/2024, the European Data Protection Board explains that model anonymity and legitimate interest as a legal basis require a specific assessment. The legitimate-interest test considers the interest pursued, whether processing is necessary and the balance with affected people’s rights. Public availability of data and the label AI do not replace that assessment.
Whether an employee’s use breached GDPR or the AI Act depends on the data, purpose, organisation’s role, service configuration and applicable duties. This article does not establish a breach by any particular company.
Initial operational steps
Our recommended working method is to maintain a short list of approved tools, permitted data types and accountable owners. If unapproved use is discovered, first record the service, account, data entered, time and available information about further processing. Use those facts to decide about access, retention or deletion and escalation to the responsible person.
This is a proposed triage method. It does not claim that every event requires identical reporting or automatically results in a fine. Its purpose is to establish what happened and support a decision based on evidence.
Correction and update, 12 October 2026: The original report confused some dates and overstated legal obligations. This version follows the current consolidated regulation and the primary materials linked below. The original publication date is retained.
Sources: