Shadow AI 2026: When company knowledge reaches AI training through a private account
One in ten employees in Germany uses AI without their employer knowing. Another 45 per cent use it with their employer's knowledge. Both figures come from the study report “Künstliche Intelligenz in Deutschland” (Artificial Intelligence in Germany), which the German digital association Bitkom published in 2026. It draws on representative surveys from 2025 of 1,005 people aged 16 and over and of 604 companies with at least 20 employees.
How big the risk behind this is depends on the account the AI is used through.
A private account for 20 dollars a month
One example is a private ChatGPT account on the Plus plan at 20 dollars a month. According to OpenAI, it is set by default so that inputs may be used to train the models. The account holder can switch this off under “Improve the model for everyone”. Because the account is private, your company can neither see nor change this setting.
A typical case: shortly before a deadline, a sales employee pastes a draft proposal with its pricing into her private ChatGPT to have it tightened. With the default setting, OpenAI may use that text to train its models. The same goes for source code a developer has checked there. If the account holder switches training off later, that applies to new conversations, according to OpenAI. By then the draft proposal is already with the provider.
With other providers, the decision also lies with the individual user. Google uses Gemini chats for training generative AI models as well, as long as the “Keep Activity” setting is on. Human reviewers read a subset of chats. With Anthropic's Claude, chats go into training if the user has allowed it. Incognito chats are excluded.
For business customers, OpenAI reverses the default. According to the company, it does not use inputs from ChatGPT Business, ChatGPT Enterprise or the API for training by default. That default applies to access the company books. On an employee's private account, the user has to switch training off themselves.
Neither the user nor the employer can check from outside whether a provider leaves switched-off or excluded inputs unused. In both cases, it remains the provider's promise.
Company knowledge becomes model knowledge
A language model learns from its training data and then answers the questions of all its users. Germany's Data Protection Conference, the body of the German data protection authorities, points out that inputs to open AI systems leave the user's protected area. Depending on how the application is designed, they can also be used to answer other users' requests. Among the risks, it explicitly names internal business information that is not meant for the public.
This is where we see the real risk for a company. Pricing or source code that goes into training through private accounts becomes part of what a model knows. Everyone who uses that model can later benefit from it, including your competitors.
It is established that models retain parts of their training data word for word. In 2023, a research team led by Milad Nasr and Nicholas Carlini showed that targeted queries can extract memorised training data from ChatGPT. The finding does not establish that user inputs can be extracted in the same way.
What this means for your trade secrets
Section 2 no. 1 of the German Trade Secrets Act (GeschGehG) sets several conditions for a trade secret. One of them is that its lawful holder has taken secrecy measures for the information that are appropriate in the circumstances. That can become hard to show once documents end up with outside services through private accounts and the company does not know about it.
Shadow AI also shows up in data on security incidents. Verizon's Data Breach Investigations Report 2026 analyses data from 2025. It defines shadow AI as employees using unapproved AI tools at work. Among the most common non-malicious activities related to data leakage, shadow AI now ranks third.
Personal data turn this into a data protection case
If the pasted documents contain customer data or details about employees, data protection comes into play. As a rule, your company is the controller for this data under the GDPR. Yet the private account is taken out by the employee, not by your company. The private account itself gives your company no contractual safeguards for this processing. For processing on a controller's behalf, Art. 28(1) GDPR requires sufficient guarantees from the processor. The provider processes the data under its own terms, and depending on the setting, for training as well.
The GDPR counts an unauthorised disclosure of personal data as a personal data breach (Art. 4(12)). Under Art. 33, the controller has to report such a breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. This does not apply if the breach is unlikely to result in a risk to the people concerned. A customer record in an employee's private AI account can be such a case. With shadow AI, however, this is exactly what the company does not learn about.
Many companies know about it, few offer access of their own
A quarter of the companies surveyed know of generative AI being used outside their own offerings. Eight per cent call it widespread, and 17 per cent know of individual cases. A year earlier, these figures were 4 and 13 per cent. Another 17 per cent suspect such use without knowing for sure.
At the same time, only 26 per cent of the companies surveyed give their employees direct access to generative AI services or applications themselves. Firm rules for using generative AI are in place at 23 per cent, and another 31 per cent plan to introduce them. Anyone who wants to work with AI in a company without such access has to rely on private accounts.
What management can do
To us, shadow AI is above all a supply gap. Where the company provides no suitable tool, employees turn to private services. A ban alone does not close that gap. It only makes the use invisible. We therefore recommend four steps in this order.
1. Establish the actual need
Ask your departments which tasks they already use AI for, and make clear that candid answers have no consequences for individuals. The answers show what an in-house tool has to deliver. Involve your data protection officer and your works council from the start.
2. Provide a familiar working environment with AI in-house
An in-house tool only replaces the private service if it does the same work and is as easy to use. That means the tasks employees already use AI for: summarising texts, translating, writing emails, drafting proposals, creating presentations. This calls for an interface like the one the well-known services offer, and a model that handles these tasks at comparable quality. If that model runs in-house, the data does not flow to third parties without control, and you can check for yourself what happens to it. The Data Protection Conference considers technically closed systems preferable from a data protection point of view.
An in-house system can also do more than a private account. Each department gets a shared collection of its documents, such as earlier proposals or manuals. The AI draws on it when it drafts a proposal or answers a specialist question, and it cites the passage it used. Anyone who uploads the same documents to a private account hands them to the outside service again. With this collection, the in-house system makes the work more convenient than individual private accounts. That is the strongest reason to stop taking the detour.
3. Set rules and train people
Set out in an AI policy which data may go into which tool. Internal documents, trade secrets and personal data belong only in the approved system. The Data Protection Conference recommends concrete examples of permitted and prohibited use cases for this, and a works agreement can lay down the framework. If your company uses AI systems, Article 4 of the AI Act also requires measures that support the AI literacy of your staff. Rules of this kind that are applied in practice can also count among the appropriate secrecy measures under the GeschGehG.
4. Only then block outside services
Once the in-house system is in place, IT can block private AI services on the company network without slowing the work down. Before that, a block only moves the use to private devices.
Our Sovereign AI page shows what such an environment looks like inside your own network and how you can try it for three days with your own documents. Why bans alone rarely hold is the subject of our article Shadow AI in Mid-Market.
Statements without a cited source are our own assessment.
Sources: Bitkom, “Künstliche Intelligenz in Deutschland. Perspektiven aus Bevölkerung und Unternehmen”, study report 2026, DOI 10.64022/2026-kuenstliche-intelligenz; OpenAI, How your data is used to improve model performance; Google, Gemini Apps Privacy Hub; Anthropic, Privacy Center on model training; Datenschutzkonferenz, guidance “Künstliche Intelligenz und Datenschutz” (AI and data protection), 6 May 2024, paras. 17, 18, 20, 36, 37; Nasr et al., Scalable Extraction of Training Data from (Production) Language Models, 2023; Verizon, press release on the Data Breach Investigations Report 2026, 19 May 2026; Section 2 GeschGehG; Regulation (EU) 2016/679 (GDPR), Art. 4(12), Art. 28, Art. 33; Regulation (EU) 2024/1689 (AI Act), Art. 4.