What shadow AI means
Shadow AI means the use of AI systems in an organisation without sufficient transparency, approval or governance. This may sound like deliberate rule-breaking by individual employees. In most cases, however, the risk arises from structural gaps.
Form 1: employee shadow AI
Employees use freely available AI tools such as ChatGPT, Claude or AI-supported translation services for work tasks, on private devices or in the office, without formal approval. Classic technical blocks only have limited effect because sensitive customer data or internal documents can also enter external systems via private devices.
Form 2: vendor AI
The more sensitive regulatory form is vendor AI: software your institution has used for years increasingly contains AI components introduced through regular updates. These systems were often not consciously classified as AI, yet duties under the EU AI Act may still arise.
Why shadow AI is particularly critical for financial institutions
The key difference from classic shadow IT: AI systems make or influence decisions. A loan applicant rejected by an insufficiently tested scoring model, an underwriting system calculating premiums based on a machine-learning model, or HR software automatically pre-sorting applications are not mere IT questions. They raise issues of governance, traceability, data protection, labour law and possible liability.
This is exactly why the connection to the AI inventory is central. Without a structured inventory, neither risk classification nor responsibility allocation is reliable.
If shadow AI creates discriminatory effects in HR processes, employee monitoring or customer access processes, it can also become a sustainability and governance topic. CSRD / ESRS reports then need not only incidents, but also policies, remedy channels, measures and internal controls.
Typical vendor AI systems in Austrian financial institutions
| Area | Examples | What AI may do there |
|---|---|---|
| Core banking | Temenos, Finastra, Mambu | AI copilot in credit processing, next-best-action recommendations |
| Credit scoring | FICO, Moody's Analytics, SAS | ML-based creditworthiness assessment of natural persons |
| AML / fraud detection | NICE Actimize, Oracle FCCM | Anomaly detection in transactions, customer risk rating |
| Underwriting | Guidewire, Sapiens, Duck Creek | Risk assessment and premium calculation with AI support |
| HR recruiting | Personio, SAP SuccessFactors, Workday | Candidate matching and scoring through AI models |
| Chatbots / service | Genesys, NICE CXone, Leena AI | Natural-language processing for customer communication |
The question "Which AI systems do we use?" sounds simple. Providers rarely label ML components explicitly as AI systems within the meaning of the EU AI Act. A reliable survey requires coordinated involvement of IT, procurement, compliance, HR and business units as well as technical and regulatory expertise.