In many organizations, artificial intelligence is already an everyday work tool—even if the company has never formally decided to implement it.

Employees use AI to summarize documents, translate correspondence, prepare proposals, analyze materials, and create content. This often takes place using personal accounts, without their supervisors’ knowledge and outside the company’s official IT environment.

In practice, this means that AI can be introduced into an organization from the bottom up before management establishes guidelines for its use.

This is precisely why companies today should focus not only on the question of whether to implement AI, but above all on how to regain control over the way artificial intelligence is already being used within the organization.

Shadow AI – when an organization doesn’t know which tools its employees are using

In the traditional model, the implementation of new technology is usually preceded by a decision-making process: selecting a vendor, conducting a legal analysis, performing a security assessment, purchasing licenses, and obtaining formal approval to use a specific solution.

Generative AI has changed this model.

An employee can start using a new tool within minutes, without the involvement of IT, compliance, or the legal department. As a result, a company may not know:

• which AI tools are actually being used,
• for what purposes employees are using them,
• what data and documents are being provided to them,
• whether they are being used on company or personal accounts,
• and what terms and conditions the provider of a given tool applies.

This lack of knowledge hinders not only risk management but also the fulfillment of legal obligations related to the use of AI.

The AI Act also applies to entities that use AI

The AI Act does not apply exclusively to entities that develop or provide artificial intelligence systems. The way a company uses AI in its operations is also significant.

One area requiring attention is the competence of individuals using AI systems on behalf of the organization.

In practice, however, it is difficult to plan training, establish rules for using AI, or implement appropriate organizational measures if the company does not know where and how AI is being used by employees.

Therefore, the first step should not be to automatically draft yet another procedure, but rather to map the actual uses of AI within the organization.

AI and Personal Data

One of the most common risks is feeding data on customers, employees, job applicants, or business partners into AI tools.

If an AI tool processes personal data, the company should analyze, among other things:

• the purpose and legal basis for processing,
• the scope of data provided to the tool,
• the role of the solution provider,
• data retention policies,
• the possibility of using the data to further develop the model,
• any potential data transfers outside the European Economic Area,
• and information obligations toward data subjects.

Applications involving special categories of data or information of heightened business sensitivity require particular caution.

Confidentiality and Trade Secrets

The risks do not end with the GDPR.

AI tools may also process information that is not personal data but is of significant business importance, such as:

• contract content,
• pricing strategies,
• information about negotiations,
• technical documentation,
• source code,
• non-public financial data,
• and information about planned transactions.

In such cases, trade secret protection rules, obligations under NDAs, and other confidentiality obligations are relevant.

Feeding information into an external AI tool should therefore also be analyzed from the perspective of whether the company retains control over the information and whether it violates its obligations to customers or business partners.

Banning the use of AI does not always solve the problem

A natural reaction for some organizations is to completely ban the use of specific AI tools.

However, such an approach may lead to the use of AI being shifted outside the company’s official processes.

Therefore, a more effective solution may be to establish clear guidelines that reflect how employees actually work.

The organization should first and foremost determine:

• which tools may be used,
• whether use should be limited exclusively to company accounts,
• what data and information must not be provided to AI,
• in which processes the use of AI is permitted,
• when an AI-generated result requires human verification,
• who approves new tools,
• and who is responsible for training employees and updating the guidelines.

The AI policy should reflect the actual way work is done

An internal policy on the use of AI can be an important element of risk management, but the mere existence of the document is not enough.

If the policy does not address employees’ actual needs and does not account for how the organization uses the technology, it may remain merely a formality.

Therefore, the process of developing it should begin with:

1. identifying the tools in use,
2. mapping the processes in which AI is used,
3. defining the types of data and information processed by these tools,
4. assessing legal and organizational risks,
5. defining permissible and impermissible uses,
6. establishing rules for monitoring the results of AI operations,
7. developing a training program and a mechanism for updating the policies.

AI governance is a management decision

The use of AI is not solely a technological issue.

The IT department may be responsible for configuring and securing the tools. The legal department may analyze regulatory obligations. The compliance team may prepare procedures, and HR may organize training.

Ultimately, however, it is the organization that must decide:

which AI applications it accepts, what level of risk it is willing to accept, and where human oversight is necessary.

That is why one of the first questions management should ask today is not:

“Do we have an AI policy?”

but rather:

“Do we know how our employees actually use AI?”

Only by answering this question can we create solutions that are legally compliant, practical, and applicable in day-to-day operations.

How can JLSW support businesses?

JLSW supports businesses in establishing guidelines for the use of artificial intelligence within their organizations, particularly in the following areas:

• auditing and mapping AI applications,
• developing AI policies and procedures,
• assessing compliance with the AI Act and the GDPR,
• analyzing rules for the use of third-party tools,
• protecting confidential information and trade secrets,
• developing training programs and AI governance guidelines,
• and evaluating contracts with AI solution providers