Your staff are using AI tools in secret (‘shadow AI’): what should you do, without banning them?
Assume it is already happening, and manage it rather than ban it: a ban pushes the use onto personal phones, where you can no longer see anything. The real risk is not the tool, it is the data people paste into it: patient names, contracts, figures, passwords. In practice: ask, with no blame, who uses what; choose an official tool whose contract protects your data; write a one-page rule; and give the team an hour of training, which the EU AI Act has in fact required since February 2025.
The scenario in brief
Example, made up for illustration. In a fictional six-person medical practice, the secretary has to reply to an unhappy patient. To save time, she copies the patient's letter, with his name, date of birth and treatment details, into a consumer AI assistant open on her phone, and asks for a reply that is ‘polite but firm’. The reply is excellent. Nobody had told her not to do it. Nobody had told her she could, either, and nobody knows that on that day the practice handed health data to an online service whose terms it has never read.
This is what is known as ‘shadow AI’: artificial intelligence tools used at work without management knowing about it or having organised it. It is not ill will. It is almost always a conscientious person who wants to work faster.
What the figures say
In Belgium, use has jumped in a single year. According to Statbel, the Belgian statistics office, more than one business in three (34.5%) used at least one AI technology in 2025, up from 24.7% a year earlier. Among individuals, use is growing even faster:
| Finding | Figure | Source |
|---|---|---|
| Belgian businesses with 10 or more staff using at least one AI technology | 34.5% in 2025 (24.7% in 2024) | Statbel |
| People in the European Union aged 16 to 74 who used a generative AI tool in the last 3 months | 33% in 2025 | Eurostat |
| Same measure in Belgium | 42% in 2025 | Eurostat |
| Users aged 25 to 64 who use it for work | more than half | Eurostat |
| European businesses that considered AI but did not adopt it, for lack of skills | 70.9% | Eurostat |
Read the last row together with the one before: many businesses are hesitating for lack of know-how, while their staff have already started on their own. According to Eurostat, among people of working age who use these tools, more than half use them for work. If nobody organises it in your business, it happens anyway, on personal accounts.
Where is the real risk?
Generative AI (the kind that writes, summarises or translates from a simple request) is not dangerous in itself. The risk comes from two very concrete things.
1. The data people paste into it
Whatever an employee copies into an online tool goes to the provider of that tool. Depending on the settings, it may be kept in a history or used to improve the tool. The Belgian Data Protection Authority (DPA) makes the point in its April 2026 brochure on AI and privacy: be careful before entering sensitive information, such as medical details or financial data, into a chatbot; remove whatever identifies a person (name, address, age); and check the default settings, in particular conversation history and AI training, which are often switched on from the start.
With a free personal account, it is the employee who accepts those terms, not the business. You then have no contract, no control over the settings and no way of knowing what was sent.
2. The answers people take at face value
A conversational AI can be wrong with great confidence: it can invent a reference, a figure, a legal provision. The European Commission names this risk, known as ‘hallucination’, as the first thing to explain to staff who use these tools. A letter, a quote or a note written with AI must therefore always be checked by someone who knows the subject.
| Information | In an online AI tool? | Why |
|---|---|---|
| Public text, email template with no names, title ideas | Yes | Nothing confidential |
| Internal document with no names or sensitive figures | Yes, in the tool chosen by the business | The contract protects your data |
| Name of a client or patient, address, date of birth | No, unless replaced with ‘Mr X’ | Personal data |
| Medical record, test result, treatment | Never in a consumer tool | Health data, the most protected kind |
| Contracts, company figures, financial data | Only in the tool chosen by the business | Trade secrets |
| Password, access code | Never | A secret is never pasted anywhere |
Why a ban does not work
A ban looks like the safest option; it is often the least safe. The tool is free, fits in a phone and saves time: a ban does not remove the need, it moves the use out of your sight, onto personal accounts, with no rules at all. Along the way you lose the chance to choose a tool whose contract protects your data.
The right reflex is the opposite: accept that AI is useful, and offer an official route that is easier than the hidden one. Nobody has a reason to hide when using the tool the business provides.
What the law already asks of you
The EU regulation on artificial intelligence, the AI Act, also applies to SMEs that simply use AI tools. Its Article 4 requires businesses that use AI to take measures to develop the AI literacy of their staff, meaning the knowledge needed to use it while understanding its limits and risks. This obligation has applied since 2 February 2025; its wording was rewritten in July 2026, but it remains an obligation.
In its questions and answers on AI literacy, the European Commission uses an example very close to yours: staff who use a conversational AI to write advertising copy or to translate. Its answer: yes, they should be informed about the specific risks of these tools, for example hallucinations. The key points:
- No certificate required and no set format: training suited to how you use the tools is enough.
- Keep a record: a simple internal note of the training given and the instructions issued.
- The tool's instructions are not enough: for the Commission, simply asking staff to read them is likely to be ineffective.
- Supervision has started: the enforcement rules have applied since 2 August 2026, under the responsibility of national authorities.
On top of this comes the GDPR, which you already know: pasting patient or client data into an online tool means handing it to a third party. You must be able to say which one, for what purpose and with what safeguards. If in doubt, the Data Protection Authority publishes its recommendations on AI.
The five-step plan, from Monday morning
- Ask, with no blame. A short anonymous survey or a round-table: which AI tools do you use, for what, with what kind of information? Make it clear from the start that nobody will be punished. You will discover useful practices you will want to keep.
- Choose an official tool. A business version, in the company's name, whose contract states that your data is not used to train the tool, and which lets you manage accounts and cut off access when someone leaves. A business subscription always costs less than a data leak.
- Write the rule on one page. What uses are allowed, what is never pasted (the table above), the duty to check before sending, and who to ask when in doubt. One page that gets read is worth more than twenty that get ignored.
- Give an hour of training. How to word a request well, how to hide a name (‘Mr X’, ‘the patient’), why everything must be checked. Note the date and who attended: that is your record for the AI Act.
- Review every six months. The tools change fast. Hold the round-table again, update the page, close the accounts nobody uses any more.
None of these steps needs technical skills. Above all, they need management to lead by example, by using the official tool itself.
In a healthcare practice: one more rule
Health data is among the most protected data under the GDPR. The rule to put on the wall is simple: no data that could identify a patient goes into a consumer AI tool, even ‘just to rephrase’. For a letter, AI can help find the tone or the structure; the name, diagnosis and treatment are added afterwards, by hand, in your usual software.
What DeepIT can do with you
DeepIT manages the IT of SMEs and healthcare practices in Brussels. We can help you take stock of the tools in use, choose and set up a business tool suited to your size, and write your one-page usage rule with you. The aim is not to hold your teams back, but to let them use AI without leaving a door open.
See also our managed IT services.
Get your AI use under control→
Frequently asked questions
What is shadow AI?
It is the use at work of artificial intelligence tools that the business has neither chosen nor approved, often on free personal accounts. The main risk is that confidential data (clients, patients, figures) ends up with a provider the business has no contract with.
Should AI tools be banned at work?
Generally, no. A ban does not make the need go away: use moves onto personal phones and accounts, out of your sight. It is better to provide an official tool whose contract protects your data, with a clear rule on what may be pasted into it.
Does the AI Act apply to a small business that simply uses an AI assistant?
Yes. Since 2 February 2025, its Article 4 has required businesses that use AI to take measures to develop the AI literacy of their staff. The European Commission makes clear that no certificate is required: suitable training and a written record of the instructions given are enough.
What information should never go into an online AI tool?
Passwords and access codes, health data, and anything that could identify a client or patient (name, address, date of birth). Contracts and company figures go only into the tool chosen by the business. If in doubt, replace names with ‘Mr X’.
How can I tell whether my staff are using AI without saying so?
The simplest way is to ask them, with an anonymous survey and a promise that there will be no sanctions. The answers show the real needs and the tools already in use, which helps you choose an official tool that meets them.