Article
Shadow AI: The Data Privacy Risk of Sharing Sensitive Information with AI
In recent years, artificial intelligence (AI) has increasingly integrated into our daily lives, and its influence continues to grow. Chatbots and AI assistants help us complete tasks, automate processes, and improve efficiency. But it is astonishing how thoughtlessly corporate and personal data are shared with AI tools without considering the risks. Many fail to realise the extent of the exposure and potential consequences.
Shadow AI and the Leak of Corporate Data
I understand the temptation – uploading a spreadsheet into ChatGPT or Gemini and letting AI assist with analysis. The latest trend is the Chinese chatbot DeepSeek, which is rapidly gaining popularity. However, many employees do not consider that they are copying entire customer databases, internal reports, business strategies, product sales data, and other sensitive marketing information into these tools, without any idea where this data ultimately goes!
Why Sharing Company Data with AI Is a Data Leakage Risk
- Loss of Control Over Data – Do we really think AI simply forgets what we provide? Data can become part of its knowledge base, and even though developers claim they do not store it, the truth is often more complicated.
- Geopolitical Risks – DeepSeek is a Chinese AI, and we all know how things work in China. Companies are under government scrutiny, and if you think your data cannot end up in the wrong hands, it’s time to wake up.
- Violation of GDPR and Other Regulations – Many do not realise that they might be violating GDPR, exposing their company to hefty fines. A single thoughtless action can create serious problems.
- Competitive Threat – If we believe our competitors are not seeking ways to access valuable data, we are mistaken.
How Employees Can Protect Sensitive Data from AI
Employees must recognise that every interaction with AI can have consequences. It is crucial that they:
- Think Before Sharing Data – Before uploading any data into an AI tool, they should evaluate whether it truly needs to be processed this way.
- Consult Company Policies – Companies should have clearly defined rules on what data employees can share with AI. If such policies do not exist, it is in employees' own interest to push for their creation. This can prevent situations where they inadvertently create a problem that jeopardises not only the company but also their own job security.
- Use Internal AI Solutions – Whenever possible, they should prioritise AI models managed and controlled by the company instead of public chatbots.
- Improve Their Digital Literacy – The more employees understand how AI works, the better they can protect sensitive data.
AI, PII and the Profiling of Your Personal Data
Sharing data with AI is not just about databases and business strategies. Every question we ask chatbots provides them with details about our thinking, interests, and values. In the future, these insights could be sold to companies for even more aggressive advertising targeting or to political parties for manipulation of public opinion.
Our interactions with chatbots also reveal our knowledge, problem-solving abilities, and thinking patterns. Essentially, this creates a database of the intelligence of the entire human population. Even my imagination is not enough to grasp how this might be exploited in the future, but the probability that someone will use this information against certain groups of people is very high.
This is a serious issue, and it is high time we start acting responsibly. Let’s not be lulled by convenience and assume that this does not concern us. If we do not wake up now, it may soon be too late.
Common questions on this article's topic
Why is sharing corporate data with AI tools risky?
What are the specific risks of using Chinese AI tools like DeepSeek?
Can sharing data with AI violate GDPR?
What do AI tools learn from our interactions?
How can employees protect sensitive data when using AI?
Why should individuals care about AI data privacy?
What is shadow AI?
What is data leakage in the context of AI?
Is DeepSeek safe to use for work?
Does ChatGPT store and retain the data I share with it?
What personal data should you never share with an AI chatbot?
Related articles
The more I think about it, the more I realize what a fundamental issue this is.
You might say I am being too pessimistic, that I am fearmongering. Fear is useful.
No matter how I look at the future, I see very few answers and far too many questions and problems.
More articles
A few weeks ago I installed a small local AI model on my laptop that watches a live camera feed. I turned the webcam on in the dark, and in near total darkness it recognised me and the objects in the room. That such things exist, I have known for a long time. What opened my eyes was the accessibility. I installed it in one prompt, free, and it runs entirely on my machine, sending data nowhere.
I have Heidegger and my notebook beside me. I am asking where all of this is heading, where artificial intelligence is taking us.
Seventy per cent. That is where the first AI output begins, even when you give it the full company context and the best examples from the past. We are talking about the kind of output that cannot be defined programmatically. It is more complex. Often it is creative work. On one repeated type of output I reached eighty per cent within a week. Every further percentage point is harder than the one before.
For a long time we treated the internet as the main road. The place where work and relationships happen. Yet most of what we see on it today is, or soon will be, AI-generated: text, images, profiles and comments. The internet is turning into an online game full of bots, where you cannot be sure that a human is on the other side of anything. So I ask: was the online world the main road, or only a temporary detour that part of us will return from, back offline?
A few days ago I interviewed a senior marketer. An experienced man, years of practice. I asked him about AI. He said he barely uses it. He had one bad experience with the output and decided he was too senior for it to add value when it is not perfect. I know the other side too: professionals who automate everything that can be automated.
Europe does not have the capacity to face a full-scale, mass drone war of the kind we see in Ukraine. Three dependencies weaken it: China supplies the physical material for defence systems, the United States supplies capabilities Europe does not have, and twenty-seven states cannot agree how fast, or who pays. Rearmament plans exist, but they are being carried out slowly.
AI produces the graphic, the newsletter and the product page faster than a person. What is left for the one who used to do it is the judgement, knowing whether the output is good. But most people have worse judgement than AI. And whoever cannot judge quality cannot delegate either. How do you tell whether yours is the judgement a company relies on, or the kind it can replace?
In April, in the first part of this series, I wrote about an AI prediction system I had started building on my own machine. At the time the software was a few hours old and the prediction record was empty. The record since then has shown one thing: the system does not yet understand the market it is being asked to forecast. It can pull macro context, book value, earnings. But it cannot put those together into something that helps it understand the price.
Prague, 13 May 2026. On my way to work I started thinking about something that stayed with me for days. If most routine work on a computer disappears in the next ten years, and a large share of repetitive manual work disappears with it, what happens to the flow of money? Who pays whom for what? Which economic layers will exist, how large will they be, and what relationships will run between them? This is the six-layer map I sketched as an answer.
I am building an AI system to predict the S&P 500. It runs on my own machine, uses free public data (yfinance, FRED, the Shiller dataset), and grades every forecast against reality. This series documents the build itself: the decisions, the methodology, the mistakes. What I will eventually share from the running system is a separate question, and an honest one.
Four days in Catalonia. No computer, no AI, almost no social media. I bought this notebook so that I could write down what I would think about, and what I would come across and learn on the trip.
