Shadow AI

Shadow AI is the AI-era counterpart of shadow IT. Employees paste customer data into ChatGPT to summarise it, feed source code to Copilot to debug, upload meeting transcripts to a free LLM tool for note-taking. Each use is simultaneously a privacy risk (personal data flowing to an untrusted processor without a DPA, cross-border transfer without safeguards, data potentially used for provider model training) and a security risk (prompt injection and exfiltration channels, confidential information in third-party logs).

Detection combines CASB-style traffic analysis for known AI services, DLP policies that flag sensitive content en route to LLM endpoints, and user training. Response pairs blocking (where risk is unacceptable) with sanctioned alternatives (enterprise AI tooling with contractual DPAs, zero-retention commitments, no-training opt-outs). Under GDPR, DPDP and PDPA, pastes of personal data to shadow AI are processor engagements without a contract — breaches of Article 28 / Section 8 / Transfer Limitation and typically also notifiable incidents in their own right if the data categories are sensitive enough.