Shadow AI: The Hidden Risks Facing Employers

How Unauthorised AI Tools Can Create Data Protection, Employment Law and Privilege Risks

While much of the public discussion around AI has focused on the opportunities for productivity and innovation, businesses are increasingly confronting a less visible threat, that is, employees using unauthorised AI tools without the knowledge or approval of their employer, commonly referred to as “Shadow AI”.

Shadow AI often arises when employees seek to enhance productivity or streamline workflows but bypassing established security protocols. An example includes inputting company data or confidential information into publicly accessible AI tools to obtain summaries or recommendations. While these actions may appear benign, they can have serious legal consequences for businesses.

What are the risks?

Shadow AI is not merely an IT governance issue. It also raises significant employment law, data protection, cybersecurity and legal privilege concerns that may expose businesses to regulatory investigations, litigation risk and reputational damage.

• Data protection law

The most immediate concern is the processing of personal data through systems that have not undergone appropriate privacy, security or legal review by the employer.

Where employee, customer or third-party personal data is uploaded into an unauthorised AI tool, the employer may struggle to demonstrate compliance with core data protection principles, including lawfulness, fairness and transparency; purpose limitation; data minimisation; security and confidentiality; and accountability. The employer may also lose the ability to monitor where the personal data is sent or how it is subsequently used. In addition, unauthorised disclosure to third parties can undermine an employer’s ability to adequately respond to access, erasure and correction requests from data subjects.

• Employment law

Shadow AI raises important questions about employee conduct, confidentiality obligations and workplace policies.

Many businesses maintain policies governing confidential information, Acceptable IT usage, cybersecurity and data protection. Employees who upload confidential company information or confidential information into unauthorised AI tools may be acting in breach of these policies, even where there is no malicious intent. This could lead to disciplinary action being taken against the employee.

• Loss of Legal Professional Privilege

Perhaps the most significant yet underappreciated consequence of Shadow AI is the potential loss of legal professional privilege.

Businesses frequently involve external legal advisers in matters such as internal investigations, employment disputes, litigation, mergers and acquisitions and corporate governance matters.

Documents generated for the purpose of obtaining legal advice are often protected by privilege. However, privilege can be lost where confidential privileged communications are disclosed to third parties.

For example, this could arise where an employee uploads legal advice provided by external lawyers into an unauthorised AI platform. If that information is shared with, retained by, or accessible to the AI provider, a party in subsequent litigation could argue that privilege has been waived.

What businesses should do to protect themselves?

It is imperative that businesses are proactive and take the following steps:

1. Develop a dedicated AI use policy.
2. Define which AI tools are approved for use, providing AI solutions that satisfy business needs while maintaining compliance.
3. Prohibit the uploading of confidential, personal or legally privileged information into unapproved AI systems.
4. Update disciplinary, IT and data protection policies to address AI-specific risks.
5. Train employees on data protection and privilege considerations.
6. Implement monitoring and technical controls to limit unauthorised use.

Conclusion

In the age of AI, companies should no longer ask whether employees are using AI tools. The better question is whether they have established the governance, training and controls necessary to ensure that such use does not expose the business to avoidable data protection, employment or privilege risks.

For further information and support, please contact Maureen Daly at mdaly@reddycharlton.ie , Laura Graham at lgraham@reddycharlton.ie  or your usual contact in Reddy Charlton LLP