Banning rarely works. Give the team a business-grade tool whose data is not used for training by default, a clear policy (forbidden data, mandatory review), then train people on their real files. The main risk is not AI itself, but internal data leaking through personal accounts.
What is shadow AI?
Shadow AI means employees using AI tools without the company's approval, often with personal accounts, which exposes internal data. It is rarely bad intent: your colleagues found a tool that saves them time, and nobody offered them another one.
The figures make it unsurprising. In France, the France Num 2026 barometer found that 40% of small and medium businesses use AI, but only 19% use a paid solution. Much of the usage therefore goes through free or individual versions that the company does not administer.
The real risks, without drama.
| Risk | What happens | Severity |
|---|---|---|
| Data | Customer emails, contracts or internal figures are entered into a consumer service, under the user's terms rather than the company's. The French data protection authority (CNIL) advises against entering personal data into such services. | The most serious |
| Quality | Inaccurate answers go out to customers without review. | Real, easy to reduce |
| Compliance | Undocumented data processing and no training framework, while the EU AI Act asks companies to support their staff's AI literacy. | Medium |
| Know-how | The best prompts and practices stay in personal accounts and leave with the employee. | Underestimated |
Why banning rarely works.
A ban without an alternative removes the usage from your field of view, not from the team's daily routine: it moves to personal phones and laptops. You then lose the one thing you could control, which data leaves, and through which tool. The CNIL does not recommend banning either, but framing usage: a list of what is allowed and forbidden, a tool chosen for its security, trained users and clear governance.
The plan in four steps.
- Take stock, no blame 1 week
A short, anonymous survey: which tools, for which tasks, with which data. You will discover the team's most useful use cases along the way.
- Provide a business tool 1 week
Claude Team or ChatGPT Business: Anthropic and OpenAI state that data from their business plans is not used to train models by default, and the company administers the accounts. Claude Team Standard costs $25 per seat per month billed monthly (see pricing details).
- Write a one-page policy a few days
Approved tools, data never to enter, mandatory review before anything is sent, who to ask when in doubt.
- Train and appoint a champion ongoing
Half a day on the team's real files, then a champion who collects questions and shares good practice.
What to tell the team.
Tone matters as much as the rule. A message that works well, in essence:
You were right to use AI. From Monday, we do it with a company tool, simple rules, and training for everyone.
The message to get across
Acknowledging employees' initiative turns a control issue into a team project. The first "hidden" users often become your best champions.
What I recommend.
Handle it within a month, not a quarter: week one for the survey, week two to open business accounts and share the policy, week three for training. The first benefit of an official tool is simple: usage becomes visible again, therefore measurable, and you can finally choose which tasks deserve to go further.
And don't forget existing personal accounts: simply ask everyone to stop putting company data in them once the business tool is in place, and to move their useful prompts into the team workspace.
Related work
- ACEM SchoolAI agent · Claude SkillsTutoring association near Lyon: an AI agent that helps managers build student / teacher schedules, and the team's first steps with AI.Private project
- XEFIAI architect · backendLyon IT services company (2025-2026): business apps for car dealerships and internal AI agents built into the teams' workflows.
Related questions.
Can I discipline an employee who used ChatGPT?
That is an employment-law question that depends on your internal rules and on what was communicated. Without a written rule known to everyone, a sanction is hard to justify. Set the framework first (approved tool, policy), and for a specific case, ask an employment lawyer in your country.
Should I block ChatGPT on the company network?
Blocking can make sense for very sensitive roles, but it often pushes usage to personal phones, where you have no visibility at all. It is more effective to offer an equivalent business tool first, then block only unapproved services if needed.
Sources
- CNIL (French data protection authority) : How to deploy generative AI: first guidance (July 18, 2024, in French)consulted October 13, 2026
- European Commission : AI literacy: questions & answers (AI Act, Article 4)consulted October 13, 2026
- Anthropic : Is my data used for model training? (page showing August 18, 2026)consulted October 13, 2026
- OpenAI : Enterprise privacy (updated January 8, 2026)consulted October 13, 2026
- French Ministry of the Economy : France Num 2026 barometer (September 28, 2026, in French)consulted October 13, 2026
Information last checked on October 13, 2026.