When Artificial Intelligence enters the enterprise…without knocking
There is a new “gray area” in enterprise digital transformation. It is not software. It is not a hacker. It is an increasingly common and often unconscious practice: shadow AI.
This term refers to the use of generative AI tools by employees without authorization, outside of any company policy and outside of cybersecurity systems. Shadow AI is a silent but widespread, and rapidly growing, phenomenon.
Let’s look at some examples:
- A salesperson copies a confidential offer into a chatbot to improve its style.
- A technician asks an AI for support by pasting code and access keys.
- An HR generates a job description from confidential internal resumes.
In all these cases, sensitive data leaves the company, without encryption, without logging, and without any guarantee of protection. A time bomb in data governance.
Why does this happen?
Because it is convenient. Because it is fast. And because often the company has not yet established clear rules.
There are four main reasons for this:
- Absence of a clear policy on the use of artificial intelligence.
- Lack of approved, accessible and easy-to-use business tools.
- Perception of AI as a “personal” and harmless tool.
- Time pressure: better to do now than wait for a permit.
According to the Shadow AI Report 2025, about 90 percent of AI use in the enterprise is from personal accounts.
And only 19 percent of enterprises have implemented an active policy on the use of generative AI (source: Gartner, 2023).
The result? A mass of strategic data that spirals out of control, often irreversibly.
Managed AI vs. uncontrolled AI
The difference between a company that governs transformation and one that risks accidents is all here: the management of artificial intelligence.
| Appearance | Uncontrolled AI | Managed AI (e.g., Microsoft Copilot) |
|---|---|---|
| Tools | Unauthorized public chatbots | Integrated into enterprise software |
| Account | Personal, unsecured | Corporate, tracked and secured |
| Security | No encryption or auditing | Logging, encryption, auditing |
| Output | External, not verifiable | Internal, integrated into workflows |
| Compliance | Non-compliant (GDPR, NIS2) | Compliant with ISO, AI Act, EU standards |
What a company really risks
The problem is not just technical. It is strategic, economic, and legal.
A real-world scenario for an Italian SMB hit by an attack or data leak related to AI misuse can result in huge costs, even with a single incident.
| Cost item | Estimated 2025 (€) | Notes |
|---|---|---|
| Redemption required | 600,000 – over 2,000,000 | Italian averages speak of 1.9 million per case |
| Operational block (2-5 days) | 300.000 – 1.000.000 | Each hour of downtime can cost up to €30,000 in manufacturing |
| Technical recovery and support | 100.000 – 250.000 | Includes forensics, help desk, recovery |
| GDPR / NIS2 Penalties | 50.000 – 800.000 | Up to 4% of turnover or €20 million |
| Legal and litigation costs | 50.000 – 150.000 | Lawyers, reimbursements, accident-related litigation |
| Reputational damage | Not quantifiable | Direct impact on customers, partners, investors |
Total potential: more than 1 million to 3 million, without considering long-term effects on market confidence.
What data are displayed?
We’re not just talking about generic text. Shadow AI puts the enterprise’s most sensitive and strategic data at risk:
- Customer data: names, contact details, commercial offers.
- Code and API: scripts, access keys, links to repositories.
- HR data: resumes, evaluations, employee and candidate information.
- Internal documents: budget forecasts, budgets, management dashboards.
- Intellectual property: algorithms, development plans, design.
- Regulated information: health, insurance, sensitive data.
All of this data can be absorbed by public AI models, stored and used to train systems not under the control of the company.
The solution exists: AI yes, but aware
The alternative to Shadow AI is not to ban the use of artificial intelligence, but to govern it safely and effectively.
With Microsoft Copilot, integrated into the Microsoft 365 suite, companies can:
- Use AI directly from Word, Excel, Outlook and Teams.
- Avoid manual copying of sensitive data to external chatbots.
- Protect all interactions with encryption, logging, and auditing.
- Comply with major international standards: GDPR, NIS2, ISO, AI Act.
- To train employees in a concrete and continuous way, with paths designed for real processes.
According to McKinsey (2023) and BCG (2024), proper use of AI can lead to productivity gains of up to 40 percent when integrated into business processes with certified tools.
Conclusion
Generative AI is already present in companies, albeit in an unseen form.
Pretending it does not exist means leaving room for risky behavior.
Prohibiting it without alternatives means missing opportunities for efficiency and competitiveness.
The real strategic choice is to activate managed, safe, educational and integrated tools.
With Eurosystem Smart Factory and Microsoft Copilot, you can govern AI with intelligence.
More productivity, less risk. AI really works — only when used consciously. Contact us for more information.