Shadow AI in SMEs: Mapping Undeclared AI Usage in Two Weeks
40 to 60% of AI usage in French SMEs escapes IT oversight. The concrete two-week method to map it before a GDPR or AI Act audit catches you off guard.
40 to 60% of real AI usage in French SMEs and mid-caps completely escapes IT oversight, a shadow AI that is neither declared nor controlled (field observation from nachnouchi.com). This figure is not a one-off anomaly, it is the norm in nearly every organization I work with.
During a recent engagement, a CFO assured me her company only used AI through a single tool validated by leadership. Two weeks of mapping later, we had identified seven different tools used by the sales, HR, and marketing teams, three of them through personal accounts handling customer data. None of the usage was malicious, each employee was simply trying to save time, and none of it had ever reached a steering committee or an IT review.
This invisibility carries a direct cost. First, budget waste, with AI licenses paid twice over by different departments unaware of each other's existence, sometimes for the exact same use case. Second, legal exposure, since 80% of SMEs have no documented AI governance, while GDPR applies as soon as personal data passes through an unvalidated tool, with or without the AI Act. Third, reputational risk, a customer data leak through a personal ChatGPT account exposing the company without it ever being aware, and without any contract or data processing agreement to fall back on.
Mapping this shadow AI does not require a six-month audit. In two weeks, a structured diagnostic combines three levers: an anonymous self-report survey sent to every team, anonymity removing the fear of sanction and surfacing real usage, a review of expense reports and SSO access to spot unvalidated subscriptions, and short interviews with each department's managers to understand the concrete use cases. This is exactly the second governance principle I defend on nachnouchi.com, mapping shadow AI before governing it, and the first building block of the usage inventory.
Governing a single tool while three others circulate unchecked protects nothing. Mapping shadow AI is not a punitive step, it is the mandatory starting point of any credible AI governance, and it takes weeks, not months. If you'd like to discuss it, get in touch.
Frequently asked questions
What is shadow AI and why does it affect SMEs so much?
Shadow AI refers to AI usage not disclosed to leadership or IT. 40 to 60% of real AI usage in SMEs and mid-caps escapes this oversight, a field observation from nachnouchi.com rather than an external quantified study.
How long does it take to map a company's shadow AI?
A structured diagnostic can map the bulk of real usage in two weeks, combining an anonymous self-report survey, a review of expense reports and SSO access, and short interviews with each department's managers.
Why does an anonymous survey work better than a direct audit?
Anonymity removes the fear of sanction, which surfaces the real usage that employees would otherwise hide out of fear of being identified as responsible for an unvalidated tool.
What percentage of French SMEs have no documented AI governance?
80% of SMEs have no documented AI governance (nachnouchi.com).
Does GDPR apply to AI usage that teams have not disclosed?
Yes. GDPR applies as soon as personal data passes through an AI tool, whether or not leadership has validated it, regardless of the AI Act's timeline.
Where should a company start to address shadow AI?
Mapping shadow AI is the first building block of the usage inventory, in week 1, and the second of the eight governance principles defended on nachnouchi.com.
Is shadow AI a sign of a discipline problem among teams?
No, in the vast majority of cases observed, employees are simply trying to save time, not bypass a rule. This is a field observation, not an external quantified study.
What does a company risk by ignoring its shadow AI?
Budget waste from redundant licenses, legal risk under GDPR and the AI Act, and reputational risk if data leaks through an unvalidated personal account.