Shadow AI: the tool arrives before the policy does

An employee finds a tool that works. They create an account with a work email or a personal one. They paste in a document. The task that took an hour takes ten minutes. Nobody tells IT, because nothing in the process asked them to.

That is shadow AI. It is the AI version of shadow IT, and the same rule applies: it appears wherever the official path is slower than the unofficial one.

The measured scale

The 2024 Work Trend Index from Microsoft and LinkedIn, published on 8 May 2024, surveyed 31,000 full-time employed or self-employed knowledge workers across 31 markets between 15 February and 28 March 2024. It reported that “75% of knowledge workers use AI at work today” and that “78% of AI users are bringing their own AI tools to work (BYOAI)”.

Read the second number carefully. It is not 78 % of employees. It is 78 % of the employees who are already using AI at work. Among the people who have adopted the tool, roughly four in five brought it themselves.

Microsoft's 2026 edition, published on 5 May 2026, surveyed 20,000 knowledge workers across ten markets between 18 February and 20 April 2026, and found that “66% of AI users say AI has allowed them to spend more time on high-value work” and “58% say they're producing work they couldn't have a year ago”. Romania is not one of those ten markets, so neither survey measures Romanian workplaces directly.

The gap that matters in Romania

Eurostat measured, in its release of 11 December 2025, that “In 2025, 20.0% of EU enterprises with 10 or more employees used artificial intelligence (AI) technologies”, and placed Romania last at 5.2 %.

The two figures measure different things. Eurostat counts the enterprise as an adopter. The Work Trend Index counts the individual. An organisation that has not adopted AI as an institution can still contain employees who use it every day, and the Eurostat figure would not move.

That is the question a Romanian management team should ask rather than assume: not whether the company uses AI, but whether its people do.

Why it is a security problem and not a discipline problem

A prompt is data. The contract summarised is data that was submitted. When the tool is unknown to IT, so is everything attached to it: which service holds the text, how long it keeps it, whether the account is personal or corporate, whether the terms permit the content to improve a model, and which other companies process it.

OWASP's 2025 Top 10 for LLM applications lists sensitive information disclosure as LLM02, immediately after prompt injection. The risk does not require an attacker. It requires only an application, a user permission and a document that should not have been in reach.

A ban does not remove the demand. It removes the visibility, and leaves the demand exactly where it was.

What an approved path has to contain

A policy that says "do not use AI" competes with a tool that saves an hour a day, and it loses. The workable version replaces a prohibition with a route:

• A named, approved system, so there is something to point at.
• Data classes: what may be entered, what may not, in plain language.
• Named users and real permissions, enforced by the system and not by the policy.
• A rule for which outputs need a human check before they leave the organisation.
• A reporting route for when the model is wrong, with no blame attached to using it.

The measure of the policy is not its length. It is whether the approved path is faster than the unapproved one. If it is not, the policy describes a workplace that does not exist.