Blog · Published · Updated
Shadow AI: bring ChatGPT and Claude use into a company rollout
Short answer
Shadow AI is the use of AI outside the approved way of working: personal subscriptions, browser extensions, note-taking apps. The aim of the review is to give the team an approved way to do the same work, and a policy is only part of it. Moving 15 people to a business plan with rules and training costs €2,300 net at Syntalith and pays back in 1.2 months at an hour saved a week.
- net for implementation for a team of up to 10 people, paid once
- from €1,150
- from start to work of the entire team
- 2 weeks
- after this time, we measure the effect on the same tasks
- 30 days
- conversation with an engineer and a written plan within 2 business days
- €0
We belong to the OpenAI and Anthropic partner programmes and learn through their official courses. What this means ↓
Author: Syntalith · 3 min read
Statistics
Shadow AI in companies: statistics 2026
78%
of AI users bring their own AI tools to work, according to Microsoft and LinkedIn's Work Trend Index (2024). An account review shows where that happens.
49%
According to the European Commission (2026), 49% of EU SMEs and mid-caps name legal uncertainty as a barrier to AI.
Source: European Commission, Flash Eurobarometer on AI (2026) ↗
15.1%
According to Eurostat (2025), 15.1% of people aged 16 to 74 in the EU used generative AI tools for work.
52%
According to Microsoft's Work Trend Index (2024), 52% of people who use AI at work are reluctant to admit using it for their most important tasks.
Source: Microsoft and LinkedIn, Work Trend Index 2024 (2024) ↗
Figures checked: 22 October 2026
Start with a task employees already do
The first invoice for a business AI plan does not show since when the team has used such tools. Some people have their own subscriptions, others use browser extensions. The company does not know which documents reach these services and who keeps access after leaving. CNIL describes rolling out generative AI in an organisation as establishing the facts about tools and data.
| Field in the review | Example answer |
|---|---|
| Task | A draft quote based on a brief |
| Tool and account | Claude on a subscription paid by the employee |
| Data categories | Project description, the client's contact details, a confidential budget |
| Sources | A file added by hand, with no approved connection |
| Result | A draft for the salesperson to check |
| Decision owner | The sales manager with the person responsible for data |
Do not start by asking for passwords to personal accounts or copying personal conversations. The way you collect information about employees must also follow the company's rules.
Sort the uses by decision
Public marketing text
stays, in a company account
training
Notes from a client meeting
move to the approved environment
company account
Confidential or personal data in an unapproved service
stop sharing
incident assessment
Pulling data from systems
assess permissions and integrations
a separate scope
If data may have been disclosed, report the case to the person responsible for incidents. Finding an app alone does not prove a breach. More is in the guide to personal accounts and company data.
Move the work to company accounts
Prepare company accounts and owners, and rebuild instructions and materials from approved sources. Do not assume the vendor lets you move every conversation or merge workspaces. Before moving anything, settle which materials the company has the right and the need to keep.
- 01TaskThe employee does the needed task in the new environment.
- 02AccessThey do not get other people's documents.
- 03RemovalBlocking the account closes access to the materials.
- 04SharingLinks, exports and connected apps checked separately.
- 05RecordThe test result and a list of open decisions.
Budget: audit, training and licences
- Time saved
- 15 people × 1 h a week × 4.33 = 65.0 h
- Value of that time
- €2,267
- Licences
- $375 (€335)
- Left after licences
- €1,932 a month
Payback of a €2,300 rollout
1.2 months
The hours saved are the scenario's assumption, which we check by timing the tasks before the training and after 30 days. €34.90 an hour is the EU average hourly labour cost for 2025 according to Eurostat. ChatGPT Business or Claude Team Standard at $25 a seat with monthly billing, at the ECB rate of 1.1205 USD per euro on 22 October 2026.
An AI process audit costs from €600 net, and team training from €1,150 net a day, together from €1,750. An AI Act and GDPR audit at Syntalith costs from €700 net and ends with a register of AI tools, a list of settings changes and a training plan for the team. The starting price does not cover an audit of the whole organisation or a legal opinion. Afterwards the company knows which tools it pays for, who has access and how the team does the agreed tasks. The next steps are covered in the articles on switching off training and the DPA.
„I already use AI.”
Your people too. Just no rules.
From our conversations with companies
5 na 10 employees paste sensitive data into private AI accounts: contracts, invoices, customer data.
In ESET survey (2026)
1 na 10 admits this in the survey.
Customer data pasted into a private AI account without an data processing agreement is a violation of the GDPR.
Don't worry, we won't tell anyone :)
What do we see in companies that "already use"
- Only ChatGPT or Claude accounts, without plugins, skills, integrations and MCP servers with company tools.
- Company programs are not connected to AI. People still click through systems and Excel, and enter chat data manually.
- Lack of company standards: everyone writes instructions in their own way, no one shares what works.
- No rules for personal data, GDPR and company secrets.
- No limits and no visibility: no one knows who uses AI, how much and for what.
62% Polish employees use AI at work · 27% companies have written rules for working with AI.
Source: ESET and DAGMA, Cyberportrait of Polish business 2026 (March 2026, 1,026 people) ↗
ChatGPT or Claude space review
Accounts, permissions, rules for working with data and 5 tasks set for the team. 1 day.
€450 net
Company accounts, rules of working with data and team training in 2 weeks, from €1,150 net.View implementation for the team →
„Is my data safe?”
Yes. You choose where they go: from your company account to the model on your server.
00Employee's private account
Customer and company data ends up in an account that the company cannot see or control. There is no data processing agreement, so it is a violation of the GDPR. When an employee leaves, the chat history goes with them.
01ChatGPT or Claude corporate account
The provider does not use your data to train models. A copy of the queries remains in his logs for up to 30 days.
02API with zero retention (ZDR)
The provider processes the request and does not save anything. It requires his consent, we prepare the application together.
03Processing in the EU
Queries are counted and stored in Europe: OpenAI in the EU region, Claude via clouds with the EU region.
04Model at your place
The open model runs on your server or in your cloud in the EU. The data does not go outside the company.
What we do with every implementation
- Confidentiality agreement and data processing agreement before we receive any data.
- You choose the cases for the prototype and we anonymize them upon request.
- The data stays in the EU and we delete it after the test.
- Corporate accounts with an administrator on your side.
When data cannot leave the company
The open model runs on your server or in your cloud in the EU. To choose from:
- White-tailed eagle
- Polish model, SpeakLeash and ACK Cyfronet AGH
- PLLUM
- Polish model, HIVE consortium commissioned by the Ministry of Digitization
- Qwen
- Alibaba
- GLM
- Zhipu AI
- DeepSeek
- DeepSeek
We select a model for the task and check it on your cases. We run it, tune it and maintain it.
Source: Bielik and PLLuM, ACK Cyfronet AGH ↗ · PLLuM, Ministry of Digitization ↗
Do you have a lot of your own data? We will fine-tune the small model.
- 1 Your examples
- 2 tuning
- 3 test on new cases
- 4 model at your place
When you have thousands of similar emails, documents or reports, we teach a small open model based on your examples. It works for you, responds quickly and costs less to maintain than a large model. We measure quality on issues that the model has not seen while learning.
Przemysław and Piotr did it in large programming and consulting companies. Artem did it before and does it today at Syntalith. It's about models on your own infrastructure, tuning and quality measurement.
You choose the protection level during the interview. We sign the data processing agreement before we see any data.Schedule a free analysis →
Price
Three packages. You know the price right away.
Team of up to 10 people
from €1,150
net, paid once · 2 weeks
Company, from 11 to 40 people
from €2,300
net, paid once · 3–4 weeks
Organization, over 40 people
from €4,600
net, paid once · 6–8 weeks
- The same packages once you have licenses. To start, an inspection of the space in 1 day is enough: €450 net.
- You buy Claude Team licenses directly from Anthropic, without our markup: USD 20 per person per month for annual payment or USD 25 for monthly payment, from 2 to 150 people.
From conversation to measurement
01 · 30 min
Free process review€0
An engineer picks 3 to 5 of your team's tasks with you. Written plan within 2 working days.
02 · 2 weeks
Rolloutfrom €1,150
Accounts and roles, rules for working with data, training on your team's tasks. You buy licences directly from the provider.
03 · after 30 days
Measurementincluded
We compare task times before and after. We name in writing the tasks worth handing to a system.
or call+48 888 78 48 78WhatsAppMon–Fri 9:00–17:00 CET
Questions
What is shadow AI?
The use of AI tools outside the way of working the organisation approved, for example personal ChatGPT or Claude subscriptions for work tasks. The term alone does not settle whether GDPR was breached: you establish the facts about the tool, the data, the service terms and the actions.
How do we audit AI accounts in a company?
Managers collect the names of tools, the types of tasks and the categories of data, without passwords to personal accounts and without copying personal conversations. Then you sort the uses by decision: keep, move to a company account or stop.
How much does it cost to sort out shadow AI?
An AI process audit from €600 net and training from €1,150 net a day, together from €1,750. A ChatGPT or Claude rollout for a team of up to 40 people costs €2,300 net, with accounts, rules for working with data and training. An AI Act and GDPR audit costs from €700 net and ends with a register of AI tools, a list of settings changes and a training plan for the team.
What should we do when confidential data went into a personal account?
Stop further sharing until the right path is settled. If data may have been disclosed, report the case to the person responsible for incidents, who will assess the facts and the company's obligations.
