Key takeaways
- Shadow IT covers every device, app, and cloud service that employees use without the IT team's knowledge or approval. It now includes AI chatbots, often called shadow AI.
- Shadow IT emerges where official approval takes longer than a click. Most of the time it is a process problem, not a discipline problem.
- It becomes a legal issue through four GDPR duties: the record of processing activities (Art. 30), the data processing agreement (Art. 28), security of processing (Art. 32), and notifying the supervisory authority of a personal data breach, where feasible within 72 hours (Art. 33). Infringements of these articles can be fined under Art. 83(4) with up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.
- ISO 27001 requires an inventory of information and other associated assets (Annex A control A.5.9) and rules for cloud services (A.5.23). For entities in scope of NIS2, Art. 21(2) of the directive lists ten minimum measures, including supply chain security and asset management.
- Four steps work, in a fixed order: make it visible, assess it, decide, and prove your rules and training. A ban without an approved alternative is not enough.
What is shadow IT?
Shadow IT is hardware, software, and cloud services that employees use at work without the IT department knowing about them or approving them. The term describes a state, not an intent: something is in use, but nobody lists it in the inventory.
For any information security management system (ISMS), that is a basic problem. An ISO 27001 certification assumes that the company knows which information and assets it protects. Annex A control A.5.9 requires an inventory with owners. What is missing from it can be neither assessed nor secured. Shadow IT is therefore first a gap in the inventory and only then an entry point for attackers.
A common misconception is that shadow IT comes from careless employees. In practice it appears wherever the official route is slower than the unofficial one. Someone who has to email three departments for a tool while a free trial starts in two minutes is acting rationally from the team's point of view. Business units also buy without IT, for example with the company credit card, because the budget sits with them.
Examples of shadow IT in everyday business
Shadow IT shows up in five areas: devices, software, cloud services, connections between apps, and AI services. The table below shows which risk typically comes with each and where you can start.
| Area | Typical example | Risk | Starting point |
|---|---|---|---|
| Hardware | Personal smartphone with access to company email, USB drive, smartwatch on the Wi-Fi | No patch status, no device lock, data leakage | A.8.1 User endpoint devices, BYOD rule |
| Software | Unapproved password manager, messenger for customer conversations, free PDF converters | Data with unknown providers, no data processing agreement | A.8.19 Installation of software on operational systems, offer an approved alternative |
| Cloud services | Project tool or file storage that a team set up itself with a company email address | Personal data without a DPA (Art. 28 GDPR), missing entry in the record of processing activities (Art. 30 GDPR) | A.5.23 Information security for use of cloud services, A.5.19 Information security in supplier relationships |
| App connections (OAuth) | Plug-in that gets access to a mailbox or calendar through "Sign in with Google" | Permanent access without review, which often survives a password change | Approval process for third-party apps, regular review of granted permissions |
| AI services | Chatbot into which customer data or source code is pasted | Inputs leave the company (Art. 28 and Chapter V GDPR) | Rules for AI use, approved access |
App connections are the most underestimated area. Once someone has granted an app access to a mailbox or cloud storage, that connection appears in no asset list. Repeated consent prompts also lead users to approve them without checking at some point.
What risks does shadow IT create?
Shadow IT creates three kinds of risk: data protection violations, security gaps, and missing proof. All three have the same cause, which is that nobody knows what is in use.
Data protection
As soon as an unapproved service processes personal data, the GDPR basics are missing. Without a data processing agreement, the use violates Art. 28, and without an entry in the record of processing activities, Art. 30. If the provider is based in a third country, the transfer rules in Chapter V (Arts. 44 to 49) apply as well. Infringements of Arts. 28, 30, 32, and 33 fall under Art. 83(4) (up to EUR 10 million or 2% of worldwide annual turnover), and unlawful third-country transfers under Art. 83(5) (up to EUR 20 million or 4%). The higher amount applies in each case. You can read the exact wording in the official legal text.
How to find personal data across all your systems is covered in our guide to data discovery for GDPR compliance. The legal basics are summarized in the GDPR guide for companies. And how a data protection officer reviews a contract with a service provider is explained in the article on reviewing a data processing agreement.
Information security
IT cannot patch what it does not know. Unapproved services appear in no vulnerability scan, and endpoint protection and the security operations center cannot see them as long as nothing is installed and nothing is connected. On top of that come accounts that stay active after an employee leaves because they never appeared on an access list. How to handle access rights cleanly on joining, moving, and leaving is covered in the article on the onboarding and offboarding process.
When a breach happens, the clock is also running: under Art. 33 GDPR, you notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If you do not know which services are in use, you cannot even say after an incident at a provider which data might be affected.
Proof and traceability
An illustrative scenario, not a customer case: a SaaS company with 80 employees is preparing for its first ISO 27001 certification. The IT inventory lists 40 approved services. When the list is compared with single sign-on logins and card statements, 15 more tools turn up, three of them holding customer data: a note-taking tool, a transcription service, and an AI chatbot. For all three, the data processing agreement and the entry in the record of processing activities are missing.
In an audit, the question is less whether you have shadow IT than how you know your inventory is complete. For companies that fall under NIS2, management responsibility comes on top: management bodies must approve the risk-management measures and oversee their implementation (Art. 20(1) of the directive). In Germany, § 38(1) BSIG requires management to implement and oversee the measures, and the law has applied since December 6, 2025. What these duties are in detail is explained in our NIS2 directive guide.
Shadow AI: the new part of the problem
Shadow AI is shadow IT with different inputs: employees paste text, customer data, or source code into a chatbot that would previously have stayed in internal systems. Technically, every input is a data transfer to a provider. If it contains personal data, that provider needs a data processing agreement (Art. 28 GDPR), and if it is based outside the EU, the rules in Chapter V apply as well.
In addition, approved tools are gaining AI features, such as meeting transcription or writing assistants, which may already be switched on by default. Check with every provider whether inputs are used for training and where they are stored. The obligations that the EU AI Act places on companies that use AI are explained in our article on EU AI Act compliance.
A ban looks like the easy solution but rarely creates clarity. The usage does not disappear, it tends to move to personal devices where IT sees even less. A short rule on which data never belongs in a chatbot (customer data, source code, credentials), combined with approved access, works better.
How to detect and control shadow IT
There are four steps, and the order matters: if you write rules before you know what is in use, you regulate past the actual need.
- Make it visible (IT and information security). No single source shows everything, so you compare several: single sign-on logins and OAuth permissions, cloud accounts with company email addresses, card statements and expense claims, and network logs. Small amounts on expense reports in particular reveal many subscriptions that nobody reports otherwise.
- Assess it (information security and data protection). For every service you find, answer three questions: What data is stored there? Who is the provider and where are they based? Is there a data processing agreement? Then enter the service in the record of processing activities and in the inventory under A.5.9.
- Decide (business unit and IT together). Every service is approved, replaced, or switched off. Set a target time for new requests, for example five working days. The faster the official answer arrives, the less reason there is for the detour.
- Prove your rules and training (management and the information security officer). A policy on acceptable use (A.5.10), a simple process for new tools, training with proof of attendance (A.6.3), and a recurring check, for example quarterly.
Which measures Annex A requires in detail is covered in the overview of the 93 controls in Annex A. The table below shows which framework asks for what, and where. The NIS2 column applies only if your company falls within the scope of the directive.
| Task | GDPR | ISO 27001:2022 | NIS2 (Directive (EU) 2022/2555) |
|---|---|---|---|
| Capture the inventory | Art. 30, record of processing activities | A.5.9 Inventory of information and other associated assets | Art. 21(2)(i), asset management |
| Check providers and cloud services | Art. 28, processing on behalf of a controller | A.5.19 Information security in supplier relationships, A.5.23 Information security for use of cloud services | Art. 21(2)(d), supply chain security |
| Rules and training | Art. 32, security of processing | A.5.10 Acceptable use of information and other associated assets, A.6.3 Information security awareness, education and training | Art. 21(2)(g), basic cyber hygiene practices and cybersecurity training |
| Detect and report incidents | Art. 33, notification to the supervisory authority | A.5.24 Information security incident management planning and preparation | Art. 21(2)(b), incident handling, and Art. 23, early warning within 24 hours |
How Kertos helps you make shadow IT visible and documented
The Shadow IT Data Discovery from Kertos scans your website, SSO, and cloud accounts, finds tools and data sources that nobody reported, and adds them to your record of processing activities. That automates step 1 and part of step 2. The limit is the sources the scan can see: a subscription that someone pays for privately and never set up with a company account does not show up there. Looking at expenses and card statements therefore remains worthwhile.
For every service found, Vendor Management maintains the vendor record, collects data processing agreements and evidence, and reminds you when a review is due. That way the proof for Art. 28 GDPR and A.5.19 is created during day-to-day operations instead of during the audit.
You put the rules from step 4 into practice with Policy Management: templates for the policies that ISO 27001 requires, approval, versioning, and documented acknowledgment. Employee training assigns the courses and records each person's completion as evidence in the ISMS. Certified Kertos experts support you in building your ISMS. If you would like to see how this looks in your environment, book a demo.
Frequently asked questions
What is shadow IT?
Shadow IT is hardware, software, and cloud services that are used in a company without the IT team's knowledge or approval. Typical examples are personal smartphones with access to company email, unapproved messengers, self-created cloud accounts, and AI chatbots.
Why is shadow IT dangerous?
Because a company cannot protect what it does not know about. Unapproved services usually have no data processing agreement (Art. 28 GDPR), no entry in the record of processing activities (Art. 30), and no patch and access control. Infringements of Arts. 28, 30, 32, and 33 can be fined under Art. 83(4) GDPR with up to EUR 10 million or 2% of worldwide annual turnover.
Is shadow IT illegal?
No law prohibits shadow IT as such. What the law addresses are its consequences: processing personal data without a data processing agreement and without an entry in the record of processing activities violates the GDPR. Anyone aiming for ISO 27001 certification must also show a complete inventory (A.5.9), and companies in scope of NIS2 must keep their assets and supply chain under control.
How do you detect shadow IT in a company?
No single source shows everything, so you compare four: single sign-on logins and OAuth permissions, cloud accounts with company email addresses, expense and card statements, and network logs. Platforms like Kertos automate the comparison for your website, SSO, and cloud accounts and add the findings to the record of processing activities.
What is shadow AI?
Shadow AI means AI services such as chatbots or transcription tools that employees use without approval. Every input is a data transfer to the provider. If it contains personal data, the provider needs a data processing agreement under Art. 28 GDPR, and if it is based outside the EU, the rules in Chapter V apply as well.
