Shadow AI in an SME is the use of ChatGPT, Copilot, Gemini or other AI tools that the company has not inventoried or governed. It is not a legal classification. It is a signal that visibility is missing. The first step at Legal Stones is five free questions. If needed, the AI Legal Assessment.
In many SMEs the team already uses AI: sometimes with a company account, sometimes with a personal one. Nobody has listed it. Nobody has written down which data may be entered. That is Shadow AI.
What Shadow AI is (operational definition)
It is AI use the organisation does not see, did not choose and has not documented. It includes personal ChatGPT, Copilot or Gemini accounts, browser extensions and “just trying it” in one department.
That is not the same as saying the use is unlawful. It is also not a finding that the AI Act applies or does not apply. It is a visibility snapshot: if the company does not know what is used, it cannot document measures or review the provider contract.
What an SME usually sees
- Someone pastes a client email or contract into ChatGPT. That can involve personal data processing.
- There is an “official” tool and, at the same time, personal accounts. A total ban sometimes pushes use off the inventory.
- Nobody has a list of tools, uses and data. Nor a short AI use policy (a recommended measure, not a duty with that name).
- ChatGPT Enterprise, Copilot or Gemini is about to be signed and the contract has not been reviewed. Checklist: AI clauses in SaaS contracts.
Copilot or Gemini “only”
Using only Copilot or Gemini does not classify the company by itself. It is not automatic. It depends on the use, the data and the potential role. The Assessment identifies that use; it is not a definitive legal classification. Hub: ChatGPT at work.
What to do (recommended measures)
- See real use. Start with the five questions: ChatGPT, client data, policy, inventory, personal tools.
- List tools, for what and with which data. Include use that is not on the official inventory.
- Write a short criterion: tools, uses, data, doubts.
- If a provider contract is on the table, human review under Spanish or EU law.
- Train the team on the real limits. Training oriented to Article 4: literacy measures, not an official EU certificate.
If the five-question signal is critical or moderate, the next step is the AI Legal Assessment: inventory (including Shadow AI), needs and a documented plan. Remote. Scope and fee are confirmed before we begin.
Frequently asked questions
What is Shadow AI?
It is the use of AI tools that the company has not inventoried or governed. It is not a legal classification. It is a signal of missing visibility. Legal Stones’ five questions are designed to surface it.
Does the AI Act apply if we only use Copilot or Gemini?
It is not automatic. Using only Copilot or Gemini does not classify the company by itself. It depends on the use, the data and the potential role. The first step at Legal Stones is five free questions. If needed, the Assessment identifies the use; it is not a definitive legal classification.
Should we ban ChatGPT?
Not necessarily. A total ban sometimes pushes use onto personal accounts. The usual path is to bound it: for what, with which information and with which tool.
Where do I start if I do not know what the team uses?
With Legal Stones’ five free questions. Then, if needed, the Assessment and, if there is a provider contract, a contract review.