The short answer: Shadow AI means that people in a company are using AI tools the company does not know about—typically a personal ChatGPT account into which someone uploads a customer contract. You can identify it without monitoring employees, in four steps: ask them through a survey and interviews, review corporate card expenses, check the account type for every tool you find, and draw up a list of approved tools with a single designated approver. The difference between a personal and a business account is not cosmetic: with consumer ChatGPT plans, OpenAI may use content to train its models unless the user opts out, whereas OpenAI states that ChatGPT Business, Enterprise, and API data is not used for training by default. Data residency is a separate question—where the data is physically stored and where processing takes place.
Most companies that call me about „setting up AI„ have already done so. They just do not know it. Someone opened ChatGPT on their phone, showed it to colleagues, and since then it has been used to draft proposals and summarize meeting notes. Then a larger customer asks, „Which AI tools do you use, and where is our data processed?"—and the company has no answer. The following process is designed to produce an inventory, not to catch employees out.
What shadow AI is and why nobody talks about it at work
The term shadow AI is derived from the older concept of shadow IT—software that employees obtained themselves outside company processes. The AI version is worse in one respect: with an unauthorized application, it is usually only the fact that the application exists that escapes the company; with an AI chatbot, the content leaves as well. An entire document may be pasted into a prompt—including a customer’s email, signature, and order number.
Employees suspect that this is not acceptable and do not want to get themselves into trouble; management assumes that „we do not use AI here" because nobody purchased it. A separate article on company data in ChatGPT examines the risks of entering data into a public chatbot. Here, we go a step further: how to establish the real situation and turn the findings into a process.
How to inventory AI tools in your company
An inventory is a table. Not a twenty-page document or a project. Five columns, one row per tool—and once completed, a single answer to the question, „What are we using, and what data does it handle?"
| Tool | Who uses it | What data goes into it | Account type | Is the data used for training? |
|---|---|---|---|---|
| ChatGPT | sales, marketing | customer emails, proposal drafts | personal accounts paid with employees’ own cards | yes, unless the user opts out |
| Microsoft Copilot | management, assistant | Outlook, SharePoint, Teams | corporate Microsoft 365 tenant | no (see below) |
| Gemini | marketing | website copy, campaign ideas | personal Google account | yes, while activity saving is enabled |
| AI meeting transcription | project manager | recordings of customer meetings | unknown, free | not established—investigate |
| AI in the accounting system | accountant | invoices, suppliers | business license | according to the provider’s terms |
The rows above illustrate the structure; they are not your findings.
1. Start with a survey and interviews
Employees are the fastest source of information, and the surest way to lose their cooperation is to begin by monitoring network traffic. Send out a short survey—anonymity is not essential, but a promise that nobody will be reprimanded for their answers is:
- Do you use any AI tools at work? Which ones?
- Do you sign in with a work or personal account?
- Do you pay for the tool? Who pays?
- What types of documents or text do you enter into it?
- What would you miss if the company banned it tomorrow?
The fifth question is the most important, yet most companies omit it. It reveals what actual work the tool performs—and whether you should find a replacement or simply ban it. A ban without an alternative invalidates the inventory: the tool will not disappear; people will simply stop admitting that they use it. Follow up with interviews with team leaders: „Show me the last three things you used it for."
2. Review expenses—AI is paid for by card
AI tool subscriptions are paid by card and easily disappear among minor expenses. Review corporate card statements for the past twelve months, employee expense reimbursements, and invoices from agencies where an AI service may have been recharged as part of another item. Look for recurring monthly foreign-currency payments to overseas suppliers.
Be aware of items that will never appear in the accounts: free versions and tools paid for with employees’ personal cards. These tend to pose the greatest risk because the company has no administrative control over them.
3. Use the network view as a supplement, not the primary tool
A corporate DNS resolver or proxy can show which domains are accessed from the company network. This is a legitimate source for an inventory if you use an aggregated list of domains for the entire network—not user-level logs or communication content—and tell employees about it in advance. Monitoring individual employees is a separate legal matter and is not covered here. Much AI use also takes place on phones over mobile data, so this source will reveal only part of the picture.
4. Document what is allowed and appoint one approver
The outcome of an audit should not merely be a finding, but a list. Divide tools into three groups: approved (the company pays for them, they run under a business account, and everyone knows what data may be entered), approved with restrictions (only for a defined type of content—such as public copy, but not customer documents), and prohibited, with a reason and preferably an alternative. Then address the one factor that determines whether the list will still be valid a year from now: who approves new tools. Appoint one specific person, not a committee, and make sure approval takes days, not months.
Personal vs. business accounts: ChatGPT, Gemini, and Copilot
It is worth knowing what the terms actually say rather than relying on common assumptions.
OpenAI (ChatGPT). For services intended for individuals—standard ChatGPT, including paid plans—OpenAI states that it may use content to train its models. Users can opt out by turning off Improve the model for everyone under Data Controls in their account settings; conversations will remain in their history, but according to OpenAI, they will not be used for training. For business products—ChatGPT Business (formerly Team), ChatGPT Enterprise, and the API—OpenAI states that it does not train on business users’ inputs or outputs by default; for the API, this policy has applied since March 1, 2023. The Enterprise privacy page, updated on January 8, 2026, confirms the same.
Moving from personal accounts to a business workspace is therefore usually the most significant change resulting from an audit—and it has nothing to do with whether the personal account was paid.
Google (Gemini). The consumer Gemini app and Gemini in Google Workspace operate differently. For the consumer version, Google states that some conversations are reviewed by human reviewers, including trained service providers, and explicitly recommends that users not enter confidential information they would not want a reviewer to see or Google to use to improve its services; the Gemini Apps activity setting affects this. For Google Workspace, by contrast, Workspace does not use customer data to train models without the customer’s permission or instruction, and interactions remain within the organization.
Microsoft (Copilot). For Microsoft Copilot in a Microsoft 365 work environment, the documentation states that prompts, responses, and data accessed through Microsoft Graph are not used to train foundation language models. Microsoft makes these commitments to Microsoft 365 commercial customers—in other words, users signed in with a work account in a corporate tenant. Anyone who opens Copilot while signed in with a personal account falls outside this framework.
A Copilot audit will also reveal another issue unrelated to model training: Copilot only shows users data for which they have at least read permission. That sounds reassuring until you discover how sharing is configured in your SharePoint environment. Copilot does not bypass access controls—it simply finds information that has been incorrectly shared for years much more efficiently.
What data residency means and why it matters
Data residency refers to the geographic region in which data is physically stored and, in some cases, processed. It is a different question from training: „our data is not used for training" says nothing about where that data resides. You should therefore distinguish between data at rest, meaning where the data is stored on disks, and processing, meaning where model computation takes place. Providers offer these options separately, and they are not always available in the same regions.
OpenAI offers content storage in several regions, including Europe (the EEA and Switzerland), the United Kingdom, and the United States. According to its documentation, inference residency—the region in which the model runs—is available for Europe, the United States, and the United Arab Emirates. Availability is limited to eligible API customers and new ChatGPT Enterprise and Edu customers; ChatGPT Business does not offer this option. Google Workspace’s Data Regions feature allows covered data to be stored in either the United States or Europe, and covered data includes Gemini prompts and responses; the feature is limited to specific editions. Microsoft lists Copilot as a service covered by the EU Data Boundary for EU customers and by its data residency commitments since March 1, 2024. The documentation also includes an important warning: third-party models used as subcontractors may not be covered by the EU Data Boundary, so even the choice of model within Copilot can affect where processing takes place.
No general article can give you a definitive answer on how this relates to GDPR—it depends on what data you process, in what role, and on what legal basis, while assessments of transfers to third countries belong in the hands of a lawyer. Selecting a region does not solve everything by itself, but there are situations in which processing within the EU simplifies both documentation and customer discussions. For each tool in your inventory, note whether it offers a regional option at all, whether that option is available under your plan, and whether it is actually enabled. The last point often comes as a surprise: the feature exists, but nobody has enabled it for that particular workspace. Alongside this sits the regulatory dimension of the AI Act, which is covered in separate articles on this website.
AI policy: what may be entered and who decides
A list only becomes a rule once it is written down somewhere. It does not need to be a policy drafted in legal language; two pages are enough. It should cover:
- What must never be entered. Personal data of customers and employees, contract content, passwords and login credentials, source code containing keys, materials protected by confidentiality obligations, and third-party materials that you have no right to disclose.
- What may be entered and into which specifically named tools.
- Who approves a new tool and how long approval takes.
- What to do if something has already been entered—who should be notified and confirmation that reporting it will not result in punishment. Without this point, you will never learn about an incident.
- Who reviews the policy once a year, because providers’ terms and plan names change, as illustrated by the renaming of ChatGPT Team to Business.
Rules that nobody remembers do not work, so combine the policy with the training covered in the article on AI training for companies.
When the cloud is not enough: workloads that must not leave the network
For some workloads, neither a business account nor a European region is sufficient. Payroll, medical records, materials covered by confidentiality obligations, and know-how that constitutes the company’s value are all cases where the question „Who has this on their disks?" matters more than a commitment not to use the data for training. The solution is a model running on your own hardware. The article on AI without the cloud examines which workloads fall into this category, while a comparison of local models on Czech-language tasks shows whether such a model can handle Czech well enough.
Frequently asked questions
Can we not simply ban AI? A blanket ban without an alternative moves usage to personal devices and accounts, where the company has no control over it. Banning one tool while providing an approved alternative can work.
What if we discover that someone has already uploaded a customer contract? Determine which tool and account were used, check the training settings for that account, and assess whether the nature of the data makes this an incident that must be reported. A lawyer should determine whether a notification obligation applies.
ITHOPE provides AI audits for small and medium-sized companies in Brno: tool inventories, checks of account types and settings, policy preparation, and—for workloads that must not leave the company—the deployment of a local model on the company’s own hardware. An audit will usually also reveal who has access to what and whether data can be restored from backups; related services include IT management and backups and the overview of IT services for companies.
Sources
- OpenAI: How your data is used to improve model performance — https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance
- OpenAI: Data Controls FAQ — https://help.openai.com/en/articles/7730893-data-controls-faq
- OpenAI: Enterprise privacy — https://openai.com/enterprise-privacy/
- OpenAI: Data residency and inference residency for ChatGPT — https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt
- Google: Gemini Apps and your data — https://support.google.com/gemini/answer/13594961
- Google Workspace: Generative AI privacy hub — https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub
- Microsoft: Data, Privacy, and Security for Microsoft Copilot — https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).