Study reveals high prevalence of Shadow AI in France

A study conducted in March 2026 among 826 IT and digital professionals in France, the United Kingdom, Germany, and Spain found that 66 percent of respondents noted the presence of Shadow AI in their organizations. In France, one in five companies described Shadow AI as a widespread practice, compared to one in ten in the other three countries.

Factors behind the French AI gap

According to Dejan Glavas, co-author of the Enterprise and Sustainability AI Barometer with Laurent Inard, this discrepancy may be attributed to two factors: regulation and internal offerings. In France, less than half of companies train their employees in AI, compared to three out of four in the United Kingdom. About a third of French companies have written ethical guidelines, compared to seven out of ten in the United Kingdom.

Employee preferences drive Shadow AI

Additionally, more than four out of ten French companies still do not provide tools to query internal documents with AI, prompting employees to seek external solutions. Glavas explained that employees often continue to use unvalidated AI solutions due to habit, performance, and ease of use. Validated tools often arrive after employees have already adopted other solutions, and company-provided tools are sometimes considered less effective or more cumbersome.

Regulation challenges and tolerance

Glavas suggested that a general prohibition on Shadow AI is not effective, as one in eight companies reported that Shadow AI continues despite a clear ban. The most frequent response from companies is tolerance, which concerns one in four companies. He emphasized that specific prohibitions, such as banning the input of customer data, payroll elements, or contracts under negotiation into public tools, are more feasible and understandable for employees.

AI in daily operations and privacy risks

Accepted usages of AI, such as meeting transcription, are often underestimated. Four out of five companies use language models for office tasks, including summaries, video conference minutes, and help with email writing. In France, four out of ten respondents indicated that explicit consent for recording is requested and tracked, while for another four out of ten, it remains informal or has disappeared, with recordings becoming almost systematic. This raises concerns related to GDPR and trust between colleagues.

AI in recruitment and code development

Glavas also highlighted the use of AI in recruitment, noting that while it may seem harmless, these usages can fall under high-risk systems under the AI Act. More than half of companies that develop software declare that at least a quarter of their code is assisted by AI, which can lead to productivity gains but also technical debt and potential skill loss for teams.

New AI Act obligations and limitations

Since August 2, 2026, companies have been subject to new obligations under the AI Act, including transparency requirements. However, the regulatory framework's limitation lies in its scope, as it primarily regulates systems, providers, and deployers, leaving internal policies and GDPR compliance for employees' use of personal assistants largely to company policies.

Building a comprehensive AI policy

To build a comprehensive framework, Glavas recommended starting with an inventory of AI usages, classifying them based on the data involved and whether the results affect decisions about people. This approach helps create lists of allowed, conditionally allowed, and prohibited usages. Regular revision and inclusion of employee representatives are also necessary to keep up with the rapid evolution of AI technologies.

Risks of AI agents and governance

AI agents, capable of performing tasks with limited human intervention, are becoming more common in enterprises. Glavas warned that they could complicate AI regulation further, as the agent acts autonomously, making decisions without direct human input. He recommended using harnesses, such as access rights limitations, action logs, and human validation before irreversible decisions. Governance frameworks like the NIST AI Risk Management Framework and ISO standards are also suggested as references.