Shadow AI

Shadow AI: Is your company's AI use governed?

Most organizations have less visibility and control than they think. Where does your organisation stand?

Overview

Your employees are already using AI at work

The question is whether you know where your company's data goes. For most teams, it flows into personal ChatGPT or Copilot accounts, with no approval, no policy, and no decision made by leadership.

The Reality

Where governance breaks down

AI already makes teams more productive. What's missing in most companies is oversight and that gap touches three parts of the business at once:

Leadership Exposure

Since February 2025, the EU AI Act's competence obligation (Art. 4) has been in force. Penalties for the most serious violations of the EU AI Act reach up to €35M or 7% of global revenue.

IT & Data Protection

No data processing agreement, no logging, no way to revoke access when someone leaves. There is no visibility into whether teams are paying for the same tools twice.

Works Council

Co-determination rights over employee-monitoring systems are routinely skipped when AI tools roll out quietly — a gap that can stall or block projects later.

AsofAugust2026,theAIAct'stransparencyobligationsarealreadyineffect.Thestricterhigh-riskrequirementslandinDecember2027.

- Art. 50, AI Act

Our Approach

Two pathways.

AI governance sounds like a major undertaking. In practice, it rarely is. These two paths run independently and not every company needs both.

AI Usage

This path is designed for the whole organization and can start right away. The outcome: Documented, approved AI use across the entire company.

Enterprise Licensing

Approved enterprise licenses replace personal accounts, closing off a large share of the data protection risk on their own.

Policy & Compliance Framework

A usage policy, a GDPR framework, and a data processing agreement under Art. 28 make sure AI use isn't just permitted, but properly safeguarded.

Demonstrable AI Competence (Art. 4)

A legal requirement since 2025 — and with the right approach, not a major hurdle for any role.

Custom AI

For processes that don't fit a standard solution, there's a structured path.

Stage 1 — Company GPT / Copilot Studio

Built on your own documents. Delivers measurable value in the short term.

Stage 2 — Vertical Applications

AI applied to specific business processes — part of concrete workflows, not just a general-purpose tool.

Stage 3 — Your Own AI Platform

API access, model choice, governance, and cost control — for using AI strategically rather than case by case.

Stage 4 — Proprietary Models & Fine-Tuning

Relevant for a small subset of companies.

Our Process

From shadow AI to a clear governance strategy

In practice, it takes four steps. The whole process is deliberately lean with a solid result you can act on right away.

01 — Kickoff and Discovery

Interviews with IT, data protection, and business units, to capture which tools and data flows are actually in use today.

02 — Analysis and Assessment

A maturity scorecard maps the current state. Use cases are evaluated and prioritized by impact, feasibility, and data readiness.

03 — Target & Roadmap

Prioritized use cases are translated into concrete initiatives, bundled into a 12-month roadmap with a clear effort estimate for each one.

04 — Handover and Decision

A decision package for leadership and IT, walked through together in a joint results session. We stay involved through implementation if you would like us to.

Why AmaliTech

Why work with us?

Plenty of consultancies can explain an AI strategy. AmaliTech has actually lived through one. In 2023, it was a shared ChatGPT login within the team. Today, it's a company-wide AI platform with a unified API, governance, and free choice of models running in production.

Senior Staffing

Experienced consultants work directly on your project, without the layered structure and cost overhead that often comes with larger firms.

Strategy and Delivery in One Team

No handoff between the people who design the roadmap and the people who deliver it. The same team stays with you throughout.

A German Contractual Framework

AmaliTech Services GmbH is your contracting partner, with a GDPR-compliant data processing agreement under Art. 28. Steering out of Cologne, delivery remote from our service centers.

Let's Connect

Looking to explore how our services can support your business? Leave us a message—we’d be happy to connect.