Your employees most likely use unapproved AI tools. We explain a 5-step method to make this use visible and safe without banning it.
Key Takeaways
A full AI ban usually does not work. Employees move to personal devices and accounts, and visibility is lost. The right path: see the use, define approved tools, protect sensitive data at the prompt level and measure the result.
- Step 1: Discovery. Which AI tools are used, and by whom?
- Step 2: Policy. Approved, restricted and blocked tool lists.
- Step 3: Prompt DLP. Stop sensitive data from reaching the prompt.
- Step 4: Training. A clear message at the moment of blocking.
- Step 5: Measurement. Monthly usage and incident report.
Why is Shadow AI riskier than ordinary Shadow IT?
With classic Shadow IT, the risk is usually a file uploaded to the wrong place. With AI, the employee actively pastes data: customer emails, contract clauses, source code, financial tables. This content goes to the provider servers. OWASP lists sensitive information disclosure among the top risks for LLM applications.
If a prompt with personal data goes to a provider abroad, it raises cross-border transfer questions under GDPR and KVKK. So AI use is a compliance topic, not only an IT topic.
Step 1: Discovery
First see the current state. Three sources together give the most accurate picture.
- Endpoint: AI sites opened in browsers, installed desktop apps and browser extensions.
- Network: AI domains in proxy and DNS logs.
- SaaS: AI apps connected to Microsoft 365 or Google Workspace with OAuth.
The output is a list of user count and usage frequency per tool. This list is the base for your policy.
Step 2: Policy
| Class | Example | Rule |
|---|---|---|
| Approved | AI tool under an enterprise contract | Allowed. Sensitive data rules still apply. |
| Restricted | General-purpose free chat tools | Allowed, but sensitive data cannot be sent. A warning is shown. |
| Blocked | Unknown extensions, tools with unclear data retention terms | Access is blocked. |
Legal, IT and business units should write the policy together. The NIST AI Risk Management Framework gives a structure for these governance decisions.
Step 3: Prompt DLP
This is the most important step. Even in an approved tool, sensitive data should not be sent. Prompt DLP checks pasted or typed text before it is sent.
- Detect patterns such as national IDs, IBAN and card numbers.
- Detect source code and secret key (API key) patterns.
- Detect content copied from documents labeled confidential.
- Choose the action by risk: log, warn, mask or block.
Step 4: Training
The block screen is a training moment. Show the user in a short message why it was blocked, which tool is approved and how to request an exception. This lowers the chance that users move to personal devices.
Step 5: Measurement
- Number of users on unapproved tools (should go down).
- Share of approved tool use (should go up).
- Number and type of blocked sensitive data events.
- Exception requests and approval time.
Controlling Shadow AI with Moftgate
The Moftgate AI Governance module lists AI use on each endpoint. DLP policies block sensitive data from reaching the prompt or show a warning. The SSPM module shows OAuth grants of AI apps connected to your SaaS. Prompts and logs stay on your own infrastructure.
Strategic Takeaway
The goal is not to stop AI but to use it safely. Policy without visibility is not enough, and approved tools without prompt control are not enough.
Product architects and field engineers who build the Moftgate DLP, device management and data security modules and run customer deployments.
Expert Answers to Core Practitioner Questions
What is Shadow AI?
AI tools that employees use without IT or security approval. Chat tools, browser extensions and AI apps connected to SaaS are in this group.
Should I block ChatGPT completely?
Usually not. A full ban pushes users to personal devices. Defining approved tools and protecting sensitive data at the prompt level works better.
Is sending personal data to AI a GDPR or KVKK violation?
It depends. Legal basis, notice and cross-border transfer rules must be assessed. Decide together with your legal team.
How do you detect Shadow AI?
Watch endpoint, network and SaaS sources together. Browser sites, desktop apps, extensions and OAuth connections together give the full picture.
Authoritative Sources & Regulatory Standards
- •OWASP Top 10 for LLM Applications ↗(LLM application risks, including sensitive information disclosure.)
- •NIST AI Risk Management Framework ↗(Framework for managing AI risk.)
- •Regulation (EU) 2024/1689 (EU AI Act) ↗(EU regulation on artificial intelligence.)
- •Kişisel Verileri Koruma Kurumu ↗(Turkish data protection authority guidance on AI and personal data.)