Shadow AI in SMEs: Mapping Undeclared AI Usage in Two Weeks

40 to 60% of real AI usage in French SMEs and mid-caps completely escapes IT oversight, a shadow AI that is neither declared nor controlled (field observation from nachnouchi.com). This figure is not a one-off anomaly, it is the norm in nearly every organization I work with.

During a recent engagement, a CFO assured me her company only used AI through a single tool validated by leadership. Two weeks of mapping later, we had identified seven different tools used by the sales, HR, and marketing teams, three of them through personal accounts handling customer data. None of the usage was malicious, each employee was simply trying to save time, and none of it had ever reached a steering committee or an IT review.

This invisibility carries a direct cost. First, budget waste, with AI licenses paid twice over by different departments unaware of each other's existence, sometimes for the exact same use case. Second, legal exposure, since 80% of SMEs have no documented AI governance, while GDPR applies as soon as personal data passes through an unvalidated tool, with or without the AI Act. Third, reputational risk, a customer data leak through a personal ChatGPT account exposing the company without it ever being aware, and without any contract or data processing agreement to fall back on.

Mapping this shadow AI does not require a six-month audit. In two weeks, a structured diagnostic combines three levers: an anonymous self-report survey sent to every team, anonymity removing the fear of sanction and surfacing real usage, a review of expense reports and SSO access to spot unvalidated subscriptions, and short interviews with each department's managers to understand the concrete use cases. This is exactly the second governance principle I defend on nachnouchi.com, mapping shadow AI before governing it, and the first building block of the IMPACT method's Inventory stage.

Governing a single tool while three others circulate unchecked protects nothing. Mapping shadow AI is not a punitive step, it is the mandatory starting point of any credible AI governance, and it takes weeks, not months. A TransformAudit diagnostic includes this full mapping within its 5-business-day assessment.