# Shadow AI: what it is and how to find it

> What shadow AI is, why it matters under GDPR, the AI Act and NIS2, how to find it from the network without an agent on each device, and a checklist.

Source page: https://netsenx.com/en/blog/2026-11-12_shadow-ai-guide · NetSenX Team · 2026-11-12

Shadow AI is the use of AI tools at work that the people responsible for IT, security and data protection have not approved and usually do not know about: a chatbot used with a personal account, an AI feature switched on inside software the company already pays for, a browser extension, a coding assistant, a language model running on a laptop, or an AI agent connected to company systems. It is rarely malicious. People want to work faster, and the tools are a browser tab away. The problem is that nobody can answer three questions an auditor, a customer or a regulator will ask: which AI services touch our data, what goes to them, and under which terms.

This guide covers why that matters, how to find shadow AI from the network without installing an agent on every device, what the network cannot tell you, and a policy checklist you can adopt this quarter.

## Why shadow AI matters

**Data leaves without a contract.** Text pasted into an AI service is processed by that provider. With a business account and a data-processing agreement, that can be lawful and controlled. With a personal account on consumer terms, the company has no agreement, no say over retention and often no way to find out what was sent. Under the GDPR, sending personal data to such a provider needs a legal basis, transparency towards the people concerned and, where the provider acts on your behalf, an agreement under Article 28. An unauthorised disclosure can be a personal data breach, with the 72-hour notification duty of Article 33 where it is likely to result in a risk to people.

**The AI Act asks you to know your tools.** Article 4 of the AI Act, Regulation (EU) 2024/1689, has applied since 2 February 2025 to providers and deployers alike, which includes ordinary companies that use AI tools. It asks for measures that support the AI literacy of the staff who deal with AI systems. You cannot plan literacy measures for tools you do not know are in use.

**NIS2 treats AI services as suppliers.** For organisations in scope of NIS2, Directive (EU) 2022/2555, Article 21 lists supply-chain security among the risk-management measures. An AI service that receives company data is a service provider in that sense, whether procurement signed for it or not.

**Customers ask.** Security questionnaires and tenders increasingly ask whether customer data is entered into AI tools, and which ones. "We do not know" is the answer that costs deals.

## How to find shadow AI from the network

A network sensor sees every device on the segments it watches, including the ones that cannot run an agent and the laptops nobody enrolled. It does not decrypt anything. What it sees is enough to answer "what is in use":

- **The service.** Before encryption starts, a TLS connection names the server it wants in the handshake (the server name, SNI), and the device has usually asked DNS for the same name a moment earlier. Together with the destination address, that identifies the AI service.
- **The device.** Each connection belongs to a host, so you can tell which machines or network segments use which services, and when.
- **The volume.** Bytes sent separate a quick question from a large upload. A workstation that sends hundreds of megabytes to an AI service in an afternoon is worth a conversation; a few kilobytes are not.
- **Local models.** A language model served on a laptop or a GPU workstation answers on the local network. Its runtime traffic is visible, and so is a model server that other machines start to call.
- **Agents and remote connectors.** An AI agent that runs on a server calls model APIs on a schedule or in bursts, often at night, and may also reach internal systems. Remote MCP connectors appear as connections from the machine running the assistant to the connector's host.

What the network cannot see matters as much:

- **Content.** Prompts, pasted documents and answers travel inside encrypted sessions. Judging what was shared needs the AI service's own admin logs or a data-loss-prevention tool.
- **What happens on the device.** A local MCP server that talks to the assistant on the same machine never touches the network, and neither does an AI feature that runs entirely on the laptop.
- **Traffic outside your networks.** A phone on mobile data or a laptop on home Wi-Fi is out of view, unless that traffic comes back through a company VPN.
- **Hidden server names.** Where Encrypted Client Hello is in use, the server name is no longer readable in the handshake, and DNS and the destination address carry the identification instead.

## A practical policy checklist

1. **Inventory first.** List the AI services you pay for, the AI features switched on in software you already use, and what the network shows on top. Give each service a status: approved, tolerated for non-sensitive data, or to be replaced.
2. **Offer an approved tool.** A business account with a data-processing agreement and training on your data switched off removes most of the reason people use personal accounts.
3. **Classify the data.** State which data may never go to an external AI service (customer personal data, credentials, source code under contract, unreleased financials) and which may.
4. **Cover connectors and agents.** Publish an approved list of MCP servers and agent integrations, scope their tokens narrowly, rotate them and include them in offboarding.
5. **Check the identity provider.** New OAuth grants to AI applications with broad scopes are the fastest-growing access path nobody reviews.
6. **Train, and keep a record.** Article 4 does not prescribe a certificate or a number of hours; it asks for measures fitted to people's role and the tools they use. Keep a simple record of who learned what and when.
7. **Measure again.** Repeat the inventory every quarter. New AI features arrive with ordinary software updates.
8. **Answer customers from evidence.** Keep a short, true statement of which AI services are approved and how use is checked, and update it when the inventory changes.

## How NetSenX shows it

From the Pro plan, NetSenX flags traffic to external AI services and to locally run language-model runtimes, and shows which host reached which service, when and how much data moved. It works from traffic metadata and never decrypts anything, so no prompt content reaches NetSenX, and customer data stays in the EU. It does not read prompts, does not block AI services and does not decide which ones are allowed: those decisions belong in your AI policy, and enforcement belongs in your proxy, your firewall or the service's admin settings. The details are on the [shadow AI detection page](/en/shadow-ai-detection), and the step-by-step version of the inventory is in [how to find shadow AI in your company](/en/blog/2026-11-12_find-shadow-ai-in-your-company).

## Sources

- [Regulation (EU) 2024/1689 (AI Act), Articles 4 and 113 — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [Regulation (EU) 2016/679 (GDPR), Articles 28 and 33 — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [Directive (EU) 2022/2555 (NIS2), Article 21 — EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)
- [RFC 6066, TLS extensions: Server Name Indication — IETF](https://www.rfc-editor.org/rfc/rfc6066)

---

*Written by the NetSenX Team at TriStiX S.L. Questions: [info@netsenx.com](mailto:info@netsenx.com).*