Employees bring their own AI tools to work. What is the risk?
Mainly that company data leaves under terms nobody agreed to, and that nobody can account for it later. Bring-your-own AI covers personal chatbot subscriptions, AI apps on private phones, browser extensions, AI meeting recorders and models run on personal hardware. The data risk: documents, customer details or recordings go to providers with consumer terms, possibly outside the EU, without a data-processing agreement, and stay in personal accounts after the employee leaves. The quality risk: work products built on outputs nobody checked. The compliance risk: you cannot answer a client, an auditor or a data subject who asks where their data went. AI meeting recorders deserve special attention, because they capture other people's voices and words, often without everyone's consent. The practical answer is to offer a good approved tool, say clearly which personal tools may be used for what, and require that meeting recording is announced. From the Pro plan, NetSenX shows which AI services company devices reach; personal phones on mobile data stay outside any network view.
This answer is part of the guide: Shadow AI: what it is and how to find it