> Bron: https://neuralex.nl/en/blog/shadow-ai-ontdekken > Find out where employees use AI through open conversations, logs and a no-blame survey. Then make safe use practical with clear rules and alternatives. [Back to insights](/en/blog) AI Act ·October 7, 2026 ·5 min read # How do you find shadow AI inside your organization? Find out where employees use AI through open conversations, logs and a no-blame survey. Then make safe use practical with clear rules and alternatives. Find shadow AI by openly asking employees which AI tools they use and why, then comparing their answers with network and SaaS logs, paid subscriptions and browser extensions. Look for personal accounts and AI features built into software your organization already uses. This gives you a more realistic picture than relying on a list of officially approved applications alone. Use the review to understand risks and needs, not to catch employees out. Someone may have chosen a tool because it solves a real problem or because no approved option is available. Ask what people do with it, what information they enter and what safe alternatives they need. Then set clear, workable rules and provide suitable tools. ## What shadow AI means Shadow AI refers to AI systems employees use for work without the organization having formally selected, reviewed or covered them in its internal rules. It might be a chatbot, but it could also be a feature in writing software, a meeting app, design software or a customer service platform. Sometimes use starts with a free account or trial. As a result, it can remain outside the view of IT, management and the people responsible for privacy or security. Not every use is immediately dangerous. An employee might ask a public tool to rewrite public information or draft an internal text. The risk changes when someone enters personal data, confidential customer information, business plans, source code or employee information. Output may also be wrong and copied without review. You need to understand which tools are being used and for what purpose before deciding what needs attention. ## Start with no-blame conversations Explain why you are carrying out the review: to make AI use safer and more useful and to reduce blind spots. Make clear that the conversation is not intended to punish individual use. Ask employees which tools they use, for which tasks, how often and what information they enter. Ask what task they are trying to solve and what prevents them from using an approved alternative. A short survey can reveal patterns. Ask about areas such as writing, translation, summarizing, programming, image creation or meeting notes. Find out whether people use work or personal accounts, whether they recognize AI features in existing software and whether they know what happens to the information they enter. Leave room for comments. An anonymous option may encourage more candid answers, though it makes it harder to discuss an unsafe use directly with the person involved. ## Compare answers with technical signals Review network and SaaS logs for use of known AI services and for accounts or applications that are missing from your internal inventory. Check business payment methods and expense claims for recurring subscriptions or trials that became paid accounts. Employees may also pay for AI services with a personal card, so financial records will not show everything. Inventory browser extensions and plug-ins that can read, summarize or send content to an external service. Also review the settings of software already approved by the organization: vendors regularly add AI features to existing products. These may transcribe meetings, summarize documents or generate text. Find out whether the features are enabled, what information they process and whether employees can use them without installing anything separately. Use technical signals carefully. A visit to a service’s domain does not prove that someone entered company information. Logs may be incomplete, and personal use on a work device can look like business use. Limit access to what is needed for the review, record who can view the information and follow your internal monitoring practices. ## Map the use and the risks Create a simple record for each application: who uses it, or which team does, for what task, with what type of information and for what purpose? Also note whether an employee checks the output before sharing or acting on it. Flag uses that involve confidential information or personal data, support decisions about people, or allow AI to send or change something on its own. Context matters. A public chatbot and a protected business environment may have different terms. Review the vendor’s relevant contract and privacy information: are inputs retained, used for further processing or shared with other parties? You do not have to carry out a full technical assessment of every tool at the start. Prioritize tools and practices that handle sensitive information or could affect customers, employees or business processes. Want to record the outcome? Read [how to keep an AI register](/en/blog/ai-register-bijhouden). ## Make rules and safe alternatives practical A policy only works when employees know what they can use and how. Name approved tools, explain which tasks they suit and identify information that should never be entered into an unreviewed service. Explain when human review is needed, how to report errors or incidents, and whom to contact with questions. Keep the rules short enough to use during everyday work. Provide alternatives that actually help people do their jobs. If employees use AI to summarize text, give them access to an approved tool reviewed for that purpose. If a team needs a feature that is not available yet, give them a route to request a review. Without a useful alternative, a ban may simply make use less visible. Repeat the review when processes, software or needs change. New features can appear in existing subscriptions, and employees will discover new tools. Give teams a way to report a proposed tool and keep the inventory current. Discovery then becomes an ongoing part of good governance rather than a one-off search. ## Consider privacy and AI rules Shadow AI can have practical consequences for privacy, information security, contracts and the reliability of work. If personal data is entered, the organization needs to consider, among other things, why it is being processed, who can access it and how it is protected. The GDPR remains relevant even when an employee pastes information into an external AI service for convenience. The AI Act uses rules that depend on the type of AI system and how it is used. The organization’s role and the purpose of the application may therefore matter. The Act also addresses AI literacy and sets specific obligations for certain uses. An inventory can help identify where further review is needed; creating one does not by itself make a use compliant. Neuralex does not provide legal advice. Before introducing a policy or a new application, have the relevant process and data handling reviewed by a legal professional. ## Frequently asked questions **What is a good first step if you suspect shadow AI is being used?** Explain that your goal is to support safe use, then openly ask employees which AI tools they use for work and why. **Are network logs enough to find shadow AI?** No. Logs may show traces of use, but not always who used a tool or what information was entered. Combine them with conversations, surveys and subscription records. **Should you ban every AI tool that has not been approved?** Not automatically. First assess the purpose, the information involved and the risks. Then make the permitted option clear and provide a useful alternative. AI Act & compliance ## Do you know which AI your organization uses? We help you map AI use in a practical way and set up a register that is compact enough to maintain. Legal review is done together with a lawyer. Curious what this means for your situation? [Ask your question](/en/contact) [Read the AI Act for SMEs](/en/blog/ai-act-voor-het-mkb) --- Volledige (opgemaakte) versie: https://neuralex.nl/en/blog/shadow-ai-ontdekken