Summarizing an email, polishing minutes, explaining a table: Public AI tools often produce a usable draft in seconds. That is precisely the temptation to use them without corporate approval. Experts then often speak of "Shadow AI at work: Employees use AI applications outside the officially designated systems, processes, or controls.
That is not automatically prohibited for every input. A prompt containing publicly available information must be assessed differently than an uploaded customer document. The shortcut becomes risky when data, rights, or operational obligations are overlooked. This guide shows employees in Austria which information does not belong in an unvetted tool, how to request a secure alternative, and what to do immediately after an accidental submission.
What Shadow AI means in everyday work
Shadow AI is a practical term, not a legal category in its own right. It refers to the professional use of an AI application that has not been reviewed, approved, or integrated into the company's intended workflow. This can be a publicly accessible chatbot, a browser extension, an automatic meeting transcriber, a translation site, or an image AI.
Typical situations include:
- A customer email is copied in full into a private AI account.
- An extension reads web pages or the contents of the open inbox.
- A meeting service records participants without an agreed-upon process.
- Internal figures are uploaded to draft a presentation.
- Employees bypass a blocked tool using their private smartphone.
Therefore, the decisive factor is not just whether a tool works technically. It must be checked which information is processed, where it is transmitted, which settings apply, and whether its use is permitted for the specific task. Even a free account with model training disabled does not automatically become an approved corporate system.
Why the quick shortcut can become risky
The Austrian Data Protection Authority on AI and data protection reminds us that the principles of the GDPR continue to apply when using AI. These include lawfulness, purpose limitation, data minimization, accuracy, as well as integrity and confidentiality. The authority also points out that with third-party AI systems, personal data can reach the manufacturer or other third parties.
In addition to personal data, this concerns trade and business secrets. The WKO guideline on corporate data and confidentiality advises against using confidential information about the company or third parties in AI applications. API keys should be treated like passwords. Unpublished orders, price calculations, financial information, or product ideas can also be in need of protection.
Three risks are particularly easily underestimated in everyday life:
- The input leaves the controlled area. Data may be transferred to an external provider, stored, or processed for technical checks.
- The output appears more secure than it is. A linguistically convincing answer can be factually incorrect, incomplete, or legally inappropriate.
- The process is hard to explain later. Without approval, a documented purpose, and defined controls, a transparent workflow is missing.
The goal is therefore not to prevent every use of AI. A clear framework should enable useful applications without handing over sensitive information or professional responsibility.
The data traffic light before each prompt
Before you paste text or upload a file, assign the information to one of three levels. The traffic light does not replace internal policy, but it provides a quick initial boundary.
| Level | Examples | Practical decision |
|---|---|---|
| Green | Publicly available information, fictitious example data, general phrasing tasks | Use only in an approved tool and have the result reviewed by a subject matter expert. |
| Yellow | Internal procedures without names, non-public drafts, aggregated metrics, internal work knowledge | Check approvals and tool terms; when in doubt, anonymize or ask internally. |
| Red | Customer and employee data, health data, contracts, access credentials, source code, price lists, trade secrets | Do not enter or upload into an unvetted public tool. |
Important: Removing names is not always enough. A combination of role, location, project, date, and circumstances can still make a person or company identifiable. True anonymization is more than replacing a name with 'Person A'. If the content cannot be reliably de-identified, it should remain out of the tool.
The five-second check before sending
Ask yourself five brief questions before each work-related AI input:
- Am I even allowed to share this information?
- Is this exact tool approved for the task?
- Does the AI need the full content, or is a neutral template sufficient?
- Can I review the result professionally and assume responsibility for it?
- Would I also show the input to my manager, IT, or the data protection office?
A single 'no' or 'I don't know' is a stop signal. First, formulate an abstract example or ask about the intended system. That takes a few minutes and is usually faster than dealing with unclear data disclosure.
Be especially cautious with automatic functions. A meeting bot can capture more than the spoken instruction. A browser extension can have permissions across multiple sites. An AI feature in a well-known software may be subject to different contractual or storage conditions than the rest of the service. Therefore check not only the product name but the specific function and the account used.
What employees should assess legally and organizationally
The Chamber of Labour Styria on AI in the workplace hält fest, dass KI als Hilfsmittel die persönliche Arbeitsleistung nicht grundsätzlich ausschließt. Beschäftigte bleiben aber für ihre Arbeit verantwortlich und müssen Datenschutz, Persönlichkeitsrechte, Urheberrecht, Geschäftsgeheimnisse und betriebliche Vorgaben beachten.
Since February 2, 2025, Article 4 of the EU AI Act on AI literacy has also been in effect. The current Q&A page of the European Commission explains that providers and deployers of AI systems must take measures to develop the AI literacy of their staff. Since the beginning of August 2026, the rules on supervision and enforcement have also been in effect. According to the Commission, the obligation does not mean that every single person must pass a test. Rather, measures should take into account knowledge, experience, and the context of use.
For employees, this does not mean they have permission to use any tools they like. Rather, it shows why companies need understandable rules, suitable systems, and task-related training. The jobspot guide Building AI literacy at work offers a personal learning plan for this.
Accidentally entered data: These six steps count
A mistake should not be covered up. The sooner the responsible department knows the facts, the sooner it can limit access, contact providers, and assess reporting obligations. Proceed objectively:
- Stop use. Do not send any further prompts or upload any additional files.
- Do not promise to perform your own cleanup. Only delete the chat if internal policy requires it. Clicking "Delete" does not automatically prove that all copies have been removed by the provider.
- Secure the facts. Note the tool, account type, time, data type, affected persons or projects, and the action taken. Do not copy sensitive content unnecessarily into new channels.
- Report internally. Inform the designated point of contact immediately, such as a supervisor, IT security, the data protection officer, or the incident team.
- Follow instructions. The company assesses contracts, logs, possible deletion requests, risks, and next steps.
- Secure access credentials immediately. If a password, token, or API key has been exposed, the responsible access must be promptly disabled or renewed.
The WKO guideline on the legal framework recommends reporting serious AI errors or data protection breaches immediately to the competent authority. Whether a reportable data protection breach actually exists is not for the affected employee to decide alone. Under Article 33 of the GDPR, the responsible organization must generally notify the data protection authority of a breach without undue delay and, where feasible, within 72 hours, if it is likely to pose a risk to the rights and freedoms of natural persons. The DSB explains the reporting procedure for data breaches.
The 72 hours are therefore not a buffer for internal waiting. Employees must report immediately; data protection and security officers will then determine whether and how the authority or affected individuals should be informed.
How to request an approved AI tool
A mere ban rarely addresses the actual work needs. Those who regularly need to structure texts, summarize information or create variants should state the concrete benefit and the required safeguards. A factual request might look like this:
"For the recurring task of converting longer public technical texts into an internal outline, an AI tool could save time. Which system and which account are approved for this? I would not use any personal or confidential content and would review the result for technical accuracy. If no tool is currently designated, to whom can I submit the use case for review?"
A good request specifies the task, type of data, expected benefit and human oversight. It does not immediately demand a specific brand. This allows IT, data protection and the relevant department to assess whether an existing system is sufficient or another solution is needed.
Companies in turn should not simply publish a long list of bans. Employees need an easily findable list of permitted tools, allowable data classes, contact persons, review obligations and reporting channels. The WKO-Vorlage für betriebliche KI-Guidelinesshows which points an internal agreement can cover.
Three case studies from Austrian businesses
The HR officer and the application documents
A HR officer wants to have ten resumes summarized by a public chatbot. Even if she removes the names, employers, education histories and dates can still make people identifiable. In addition, the analysis concerns a decision that is important for applicants. Therefore the documents do not belong in an unvetted tool. More appropriate are an approved system, a documented purpose, defined access controls and a genuine human review.
The technician and the error message
A technician copies a log excerpt into an AI because he wants to clarify a rare error message. However, the text contains internal server names and an access token. He stops the process, immediately notifies IT security and has the key renewed. Afterwards the team creates a sanitized example schema for future requests. The professionally correct response here is to quickly contain the issue and improve the process.
The project manager and the meeting minutes
A project manager wants to shorten the wording of an internal record. Instead of uploading the document, she first creates a neutral outline without names, numbers or project details and has only that structure edited. For the actual content she uses the approved office software. This reduces the amount of data while still allowing some AI assistance.
Checklist for everyday work
- I know the company's AI policy or know where to find it.
- I only use approved tools and the designated company account.
- I check data classification and confidentiality before each prompt.
- I replace real cases with neutral templates or fictitious data whenever possible.
- I do not upload contracts, personnel files, customer data, or access credentials without review.
- I verify facts, figures, sources, and the Austrian legal relevance of the output.
- I flag uncertainties and have important decisions made by humans.
- I report any erroneous transmission immediately via the designated channel.
Additionally, it's worth taking a look at common attack patterns. The jobspot-article "Detect phishing and protect data erklärt grundlegende Warnsignale für Links, Logins und digitale Identitäten.
FAQ on Shadow AI at Work
Is using a public AI tool at work always prohibited?
No. Relevant factors are company policies, the task, the data, the tool's terms and conditions, and applicable law. Even for public information, the tool should be authorized and the result reviewed.
Is it sufficient to remove names from a document?
Not necessarily. Other characteristics can make individuals or companies identifiable. Also, trade secrets can exist even without personal data.
May I use AI on my personal smartphone?
A private device does not change the work-related nature of the content. Processing internal data via a private account or device can additionally circumvent company security measures.
Can I simply delete an accidental upload?
You should not rely solely on the visible delete function. Stop using it, document the necessary facts briefly, and report the incident internally. The responsible department will determine further measures.
What should a good company AI policy contain?
At minimum: allowed tools and accounts, permissible data types, prohibited inputs, review obligations, documentation, contacts, training, and the error reporting procedure.
Conclusion: Safe working starts before the prompt
Shadow AI usually does not arise from malicious intent, but from time pressure and a lack of alternatives. Still, an unvetted input remains a real risk. Employees act professionally when they classify data beforehand, use only approved systems, review outputs for accuracy, and report errors immediately.
For the next workday one concrete step is enough: find out which AI tools are allowed in your company and who you can report a new use case to. If both are missing, contact your manager, IT, the data protection office, or the works council. A clear process turns secret improvisation into a responsible work aid.
