Shadow AI: bring ChatGPT and Claude use into a company rollout
Staff already use AI, but the company cannot identify the accounts, files or connections. Review existing work and move useful tasks into an approved environment.
Syntalith
The first invoice for a business AI plan does not reveal when employees started using AI. Some have personal subscriptions; others use browser extensions or meeting assistants. The company may not know which documents reach those services or who will retain access after leaving.
Shadow AI means AI use outside the organisation's approved arrangements. The label alone does not establish a GDPR breach. Review the actual tools, data, service terms and actions involved. CNIL guidance on generative AI deployment
The purpose of the review is to give staff an approved way to do useful work. Without a practical route, a policy can become a document people rarely consult.
Start with the work people already do
Ask managers to collect tool names, task descriptions and data categories. Do not begin by requesting passwords to personal accounts or copying private conversations. The way you collect employee information must also follow company rules and applicable data protection requirements.
| Inventory field | Illustrative answer to investigate |
|---|---|
| Task | Draft a proposal from a customer brief |
| Tool and account | Claude subscription paid for by an employee |
| Data categories | Project description, customer contact and confidential budget |
| Sources and connections | Manually uploaded file; no approved connector |
| Required result | A draft for a salesperson to review |
| Decision owner | Sales manager and the person responsible for data |
This is an example entry, not a finding about a particular company. It gathers enough information to decide what to examine next without placing customer documents inside the inventory itself.
Group uses by the decision they need
A public marketing draft calls for a different assessment from a customer meeting transcript. Where confidential or personal information is being sent through an unapproved service, pause further transfers until an appropriate route is established. If information may have been exposed, involve the incident owner to assess the facts and the company's obligations. Discovering an application does not by itself establish a reportable breach.
Next, identify the uses worth supporting. Basic drafting may need a company workspace and training. Retrieving information from business systems requires a review of permissions, integrations and output storage. Buying business accounts does not replace that work. Personal AI accounts and company data
Move the workflow, with a selective content review
Prepare company accounts and assign owners. Recreate useful instructions and reference materials from approved sources. Do not assume the provider supports every workspace merge, conversation transfer or feature in the destination plan. Check the available migration options for the chosen service.
Before moving content, establish what the company needs and is entitled to retain. Avoid copying an employee's private conversations. Decisions about deleting old copies should account for retention requirements and any information that must be preserved for an incident review.
Pilot the new environment with a small group. Confirm that staff can complete the task, cannot retrieve another person's restricted documents and lose access when their account is removed. Review shared links, exports and connected applications separately. Keep the test results and unresolved decisions with the rollout record.
Budget for the audit, training and software
A Syntalith AI process audit starts at €600 net. For the selected process it produces a map, architecture, implementation plan and fixed build quote. Include the review of accounts, data scope and transition arrangements in the agreed offer. The starting fee does not cover an organisation-wide audit or a legal compliance opinion.
Private team training starts at €600 net per day. Buying both starting scopes gives a €1,200 net starting subtotal. This is a budgeting reference, not a fixed price for a complete rollout. Licences, integrations, additional groups and work arising from the agreed scope are separate costs.
The client provides a process owner and approves the data decisions. Within the commissioned scope, we help translate those decisions into configuration, working practices and acceptance checks. The practical benefit is a clear record of which tools the company pays for, who can access them and how staff should perform the agreed tasks.
Start with a free 30-minute scan. Bring the user count, known tools and one workflow you want to address first.
Related decisions
- What training opt-out changes in ChatGPT and Claude
- Preparing customer documents for AI
- DPA scope for an AI deployment
Sources and service prices checked on 30 September 2026.
Syntalith is an OpenAI Select Partner in the OpenAI Partner Network.
We help your team respond to customers faster and find information in company documents. We choose and set up the right AI tools, then teach your team how to use them.
How to introduce ChatGPT and OpenAI at workFree process scan
Start with a free process scan.
- A 30-minute call with the engineer who would lead the work.
- A review of the processes that cost you the most time and money.
- A written summary: a possible direction, missing information and the next step.
The scan chooses one process to assess, and within 2 business days you receive a recommendation, including when a simpler route is the better fit.
€0
30 minutes · written takeaway within 2 business days
Times are shown in your own time zone. We work with clients across time zones.
Describe the process in the form