What is shadow AI, and how do you stop staff pasting client data into ChatGPT?
The short answer
Shadow AI is staff using AI tools the company never approved. Two steps get it under control. Write down which tools are allowed and which data may never go in. Then move the team to accounts where training is off, such as ChatGPT Business.
In detail
Shadow AI is the AI use your company does not know about. The term follows shadow IT. NordLayer names it on its AI security page and sells controls against it. That page opens with the words "Discover shadow AI" (read on 22 September 2026).
The risk is not theory. The Dutch privacy regulator AP received several breach reports about it. Staff had entered patient records and customer addresses into an AI chatbot. The AP published that warning on 6 August 2024.
Use against your own rules counts as a data breach, says the AP. A report to the regulator and to the people involved is then often compulsory. So the first step costs nothing. Agree which tools are allowed and which data stays out.
The second step is a business account. OpenAI states "No training on your business data by default" on its pricing page. Paying is not the same as safe. Mistral trains on what you type until an admin turns that off.
Do you want the paste itself blocked? Then you need a managed browser. NordLayer Browser Premium costs $4 per user per month, with a minimum of five users. Those rules work only inside the NordLayer Browser, not in Chrome or in the ChatGPT app.
Start with a list of every AI tool your team uses this week. Approve one assistant that does not train on your chats. Block the rest. The comparison below shows how Lumo and Mistral Vibe differ on exactly that point.
Three steps against shadow AI, and where each one stops
| Step | What it does | Where it stops | Source |
|---|---|---|---|
| House rules on paper | Staff know which tools are allowed and which data stays out. | Nothing is blocked. A rule works only as well as people follow it. | https://www.autoriteitpersoonsgegevens.nl/actueel/let-op-gebruik-ai-chatbot-kan-leiden-tot-datalekken |
| ChatGPT Business account | OpenAI says it does not train on your business data by default. | The promise belongs to the company account. A personal account falls under the personal rules. | https://openai.com/business/chatgpt-pricing/ |
| NordLayer Browser Premium | An admin blocks pasting and file uploads into AI tools and sees which tools staff open. | Only inside the NordLayer Browser. Chrome and the ChatGPT app are not covered. | https://nordlayer.com/ai-security-solutions/ |