# Shadow AI on your network: what is visible and what is not > What network monitoring can and cannot see about unapproved AI use: which hosts reach AI services and local model runtimes, but not what is in a prompt. Source page: https://netsenx.com/en/shadow-ai-detection Last reviewed: November 6, 2026 Shadow AI is the use of AI services and tools the organisation has not approved: a chatbot in the browser, an AI plugin, a coding assistant or a language model running on someone's laptop. From the network you can see which machines reach which AI services, when and how much data they send. You cannot see what was typed or pasted, because that traffic is encrypted. ## The fact to plan around Article 4 of the EU AI Act (Regulation (EU) 2024/1689) requires providers and deployers of AI systems to take measures to support the AI literacy of their staff; since its amendment by Regulation (EU) 2026/1744 in July 2026, it does not require them to guarantee a specific level for any individual. Under Article 113, it has applied since 2 February 2025. Source: [Regulation (EU) 2024/1689 (AI Act), Article 4 (AI literacy) and Article 113 (dates of application) — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) ## What the network shows, and what it does not Network visibility answers the first question of any AI policy: what is actually in use today? 1. **Visible: which AI services are used** Connections to external AI services can be identified from the destination and the server name in the TLS handshake, so you can see which services are in use and how often, without decrypting anything. 2. **Visible: who uses them, and how much** Each connection belongs to a host, so you can tell which machines or segments use AI services and how much data they send, which separates a quick question from a large upload. 3. **Visible: models running locally** Language models run on your own machines show up as local runtime traffic, which NetSenX flags as well. 4. **Not visible: the content** Prompts, pasted documents and answers travel inside encrypted sessions. Network monitoring cannot read them, and NetSenX never decrypts traffic. Judging what was shared needs the AI service's own admin logs or a data-loss-prevention tool. ## What NetSenX does today - From the Pro plan, flags traffic to external AI services and to locally run language-model runtimes. - Shows which host reached which AI service and how much data moved, so you know what is in use before you write the policy. - Analyses the traffic from metadata and never decrypts it, so no prompt content reaches NetSenX. - Keeps customer data in the EU and explains every alert in plain language. ## What NetSenX does not do NetSenX does not read prompts, files or answers, does not block AI services and does not decide which ones are allowed: those decisions belong in your AI policy, and enforcement belongs in your proxy, your firewall or the service's admin settings. It sees AI use only on the networks it monitors; a phone on mobile data or a laptop at home is out of its view. ## Questions buyers ask ### How can I detect shadow AI on my network? Look at outbound connections to AI services: the destination and the server name in the TLS handshake identify the service without decrypting anything. NetSenX flags this traffic, and traffic to locally run language-model runtimes, from the Pro plan. ### Can network monitoring see what employees type into an AI chatbot? No. The content of the session is encrypted, and NetSenX never decrypts it. It shows that a host used an AI service, when, and how much data it sent; for the content you need the service's own enterprise logs or a data-loss-prevention tool. ### Does the EU AI Act require us to manage employees' AI use? If your organisation uses AI systems in its work, Article 4 of the AI Act requires it to take measures to support the AI literacy of its staff, and that duty has applied since 2 February 2025; since July 2026 the amended text states that no specific level has to be guaranteed for each person. Knowing which AI services are actually in use is a practical first step; your legal counsel can tell you what else applies to you. ### Is shadow AI detection included in every plan? No. It is part of the Pro plan and above. The Free plan covers behavioural detection, such as beaconing, scanning and lateral movement, with no time limit. ## Sources - [Regulation (EU) 2024/1689 (AI Act), Article 4 (AI literacy) and Article 113 (dates of application) — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) - [Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending Article 4 of the AI Act — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) - [Regulation (EU) 2016/679 (GDPR), Article 28 (processors) — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) This page is general information, not legal advice. Check your obligations with your national authority or legal counsel. ## Related pages - [Shadow AI guide: what it is and how to find it](https://netsenx.com/en/blog/2026-11-12_shadow-ai-guide) - [How to find shadow AI in your company](https://netsenx.com/en/blog/2026-11-12_find-shadow-ai-in-your-company) - [Encrypted traffic analysis](https://netsenx.com/en/encrypted-traffic-analysis) - [EU data residency](https://netsenx.com/en/eu-data-residency) - [Features](https://netsenx.com/en/features) - [How to tell if someone is inside your network](https://netsenx.com/en/is-someone-inside-your-network) - [Pricing and the Free plan](https://netsenx.com/en/pricing)