Shadow AI in the workplace: what reduces it

What is shadow AI?

Company data ends up in personal AI accounts outside the company’s contracts and control. Shadow AI is the use of AI tools without the employer’s knowledge or approval, for example a free chatbot or a meeting note-taker. What reduces it is an approved tool that, in daily use, is at least as good as the personal one.

In brief

• Expect shadow AI?Shadow AIEmployees using AI tools without the knowledge or approval of the company, usually through personal accounts. Bans encourage it, because the need remains and the usage merely becomes invisible. in your company too. According to KPMG and the University of Melbourne, 77 percent of employed people in Switzerland use AI at work, and more than half of those users admit to breaching company policy in the process (survey November 2024 to January 2025).
• A permitted personal account does not solve the data problem either. In the EY survey of May 2026 (604 respondents from Swiss companies), 29 percent may use personal accounts, and for 8 percent these are their only access to AI. In none of these cases does the company have a contract covering the data entered.
• Have the approved tool cover translation and correspondence first. These are the two most common AI uses in Swiss SMEs, at 52 and 47 percent (AXA/Sotomo, 300 SMEs, March 2025).
• The question belongs with executive management. Fines under the Data Protection Act, up to CHF 250,000 for intentional breaches, fall primarily on the responsible individual in the company and only subsidiarily on the company itself (Art. 64 revFADP?revFADP (revDSG)Switzerland's revised Federal Act on Data Protection, in force since 1 September 2023. It governs how companies may process personal data, and applies to AI use exactly as it does to any other processing., up to CHF 50,000).

The most common form is unremarkable. A customer letter is pasted into a browser window for translation, a chatbot shortens a quote, a note-taking bot that one participant invited transcribes a video call. Nothing gets installed, and hardly any traces remain on the company network. If it runs on a personal phone, IT sees nothing at all.

Together with the FDPIC?FDPIC (EDÖB)The Federal Data Protection and Information Commissioner, Switzerland's federal supervisory authority. It can conduct investigations and issue rulings; fines are imposed by the cantonal criminal authorities., the Federal Office for Cybersecurity is devoting October 2026’s Cyber Security Month to “oversharing”, with a focus on AI tools at work.

This article is the sixth part of our series on law and regulation. It builds on the one-page policy and deals with the question that comes before it: what is already running in the company, and how to get it under control.

Why a ban changes little

Samsung is the textbook case from 2023. Shortly after the group had allowed its engineers to use ChatGPT, internal source code and meeting notes ended up with the provider. Samsung then banned generative AI on company devices. A ban of this kind does not remove the need, and a personal phone sits on every desk.

Microsoft put a number on this behaviour in its Work Trend Index 2024, a worldwide survey of 31,000 people: 78 percent of AI users brought their own tools to work. In small and medium-sized companies the figure was 80 percent.

We therefore consider a ban defensible only with an expiry date and an announced replacement.

What is at stake

When a company passes personal data?Personal dataAny information relating to an identified or identifiable person, so customer records, HR files or even an email address. As soon as such data is involved, the revFADP applies. to an AI provider, the revFADP requires a contract that binds the provider as a processor?ProcessorA service provider that processes personal data on behalf of, and under the instructions of, the controller, such as a cloud or AI provider. Art. 9 of the revFADP ties the handover to conditions. (Art. 9). For a transfer abroad it requires a permissible basis (Art. 16). When someone types customer data into a personal account, both are missing, and the provider is usually based in the US. On a free plan↗Provider Data-Protection Check · Part 1Is ChatGPT GDPR-compliant? What OpenAI's contracts coverA Zurich law firm reviewed the contracts of OpenAI, the provider of ChatGPT: none of them holds up for lawyers, doctors and other holders of professional secrecy. What that means for companies, and the routes around it that the review does not name.Read article, inputs may also be used for training, depending on the provider. At ChatGPT this setting is on by default.

Personal data is only part of it. Source code, quotes, prices and strategy papers leave the building the same way, and an invention that sits with a third party before the patent application is filed can jeopardise its patent protection.

The second risk lies in the output. In the KPMG survey, almost three quarters of Swiss respondents say they do not check AI results, and 63 percent have already found errors in their work that trace back to AI. Approving a tool therefore includes a rule that employees check the results.

Key figure

23 %

Source: AXA/Sotomo, SME Labour Market Study 2025, 300 SMEs, surveyed in March 2025

This assessment does not replace legal advice. There are as yet no Swiss court decisions specifically on AI tools.

What shadow AI reveals about your needs

Shadow AI shows which use cases employees rely on enough to break a rule for them. When deciding what an approved tool should cover first, that is the best basis available.

An anonymous survey surfaces these use cases within two weeks: which tools, for which tasks, with which data and with what time saved. It has to be anonymous, otherwise nobody names what breaks a rule. If the cover note says the survey is preparing a better tool, the answers are more honest.

On top of that, proxy and DNS logs show which AI services are accessed from the company network. They do not capture use on personal devices. A third part of the inventory is missing from both sources: AI features built into software you have used for years, for instance in the CRM, the office suite or the HR tool. Employees often do not perceive these as AI at all. Ask the people who administer that software.

An approved tool that matches the personal account

Whether an approved tool gets used depends on three things: sign-in with the company account, browser access without individual access requests, and a current model. If the approved model is weaker than the free personal version, the personal account stays open in the second browser tab.

For most companies, a business plan from a major provider is enough to start, with a data processing agreement?Data Processing Agreement (DPA)The contract that governs how a provider may process personal data on a customer's behalf. Without a signed DPA, a cloud provider is not considered bound under data protection law. and training excluded by contract. In the EY survey, 70 percent of respondents use integrated tools such as Microsoft Copilot or Gemini in Google Workspace. For HR data, client information or health data, that is often not enough. That data needs a platform of your own↗Sovereign AI · Part 4Sovereign AI platform: why it binds more than the modelThe model is easy to swap. The platform, the software your team uses for AI every day, holds your chats, files and knowledge, and that is what binds you longest. How to choose it sovereignly.Read article in a Swiss data centre. Open models run on it, and the data stays in Switzerland.

For employees to know which data may go into which tool, you need data classes and a short policy. The fourth part of this series shows what the one-page policy↗Law & Regulation · Part 4AI governance: one page is enough to startAn AI policy, the internal rule for how to use AI tools, that takes three months to finish protects no one today. Shadow AI, the use of unapproved tools, grows for exactly as long as the document sits in draft.Read article looks like. For shadow AI, the part that matters most is the response time for new tools. Employees who have to wait for approval use the personal account in the meantime. A response time of a few working days prevents that.

In larger companies, technical controls pay off as a second stage: data loss prevention (DLP?DLPData loss prevention: software that detects and prevents confidential files or data from leaving the company, for instance by upload to web services.) software that detects uploads of sensitive files, and a web gateway that makes unknown AI services visible. Employment law sets the limit. Art. 26 of Ordinance 3 to the Swiss Employment Act (ArGV 3) prohibits systems intended to monitor employee behaviour. Controls must therefore target the data and be announced transparently.

What additionally applies to banks, law firms and medical practices

In its Guidance 08/2024, FINMA expects banks and insurers to keep a central inventory of their AI applications with a risk classification. That inventory also has to cover employees’ use of personal accounts. If a bank employee enters identifying customer data into a personal account, this also engages banking secrecy under Art. 47 of the Banking Act, which can be breached through negligence as well.

For lawyers, doctors, fiduciaries with audit mandates and other professional secrecy holders, Art. 321 of the Swiss Criminal Code applies. According to the prevailing legal opinion, an AI provider can be engaged as an auxiliary person?Auxiliary personSomeone who supports a secrecy holder in their professional work, such as practice staff or an IT provider with access to case data. Art. 321 of the Swiss Criminal Code expressly covers auxiliary persons too. if it is contractually bound by instructions and does not use the data for training. A free personal account does not meet that test. For these businesses, client, patient and customer data therefore does not go into any account without a contract. With Swiss hosting or a locally run model, they can still use AI on this data.

How to start

1. 01

   Ask anonymously

   A two-week survey: which tools, which tasks, which data, how much time saved. Also record the AI features built into existing software.

2. 02

   Approve the most common tasks

   One tool under a company contract for the two or three most frequently named uses, with a current model and sign-in through the company account.

3. 03

   Introduce the policy

   Data classes, approved tools, a point of contact with a response time. Any existing ban gets an expiry date.

4. 04

   Ask again after three months

   The same survey. If use of personal accounts does not fall, the approved tool is missing something, and the answers say what.

Do you know which AI accounts your team worked with this week?

Together with the FDPIC, the Swiss Federal Office for Cybersecurity is devoting October 2026's Cyber Security Month to "oversharing", with a focus on AI tools at work. Often the personal account is even permitted. In the EY survey of May 2026 (604 respondents), 29 percent are allowed to use personal AI accounts, and for 8 percent these are their only access to AI.

The company has no contract with the provider of these accounts. For customer data, however, the revFADP requires a data processing agreement, and for client or patient data professional secrecy also applies.

In our assessment, shadow AI declines when a tool under a company contract is at least as good in daily use as the personal one. The place to start is translation and correspondence, the two most common AI uses in Swiss SMEs (52 and 47 percent, AXA/Sotomo, March 2025). For confidential data, that means Swiss hosting or a locally run model.

The article covers the limits for banks, law firms and medical practices and the route from an anonymous inventory to approval. The PDF adds a ready-to-copy survey for your employees. Link in the comments.

#ShadowAI #AIGovernance #DataProtection #Switzerland