Shadow AI has taken hold in French companies far faster than the rules meant to govern it. According to the ESSCA and Forvis Mazars 2026 AI Business and Sustainability Barometer, 66% of professionals observe Shadow AI in their organization, and France has the highest rate in Europe, with one in five companies describing the practice as widespread. This phenomenon reveals a fundamental gap: employees adopt consumer AI tools before their employer offers validated solutions. Why does this situation persist despite governance efforts? How can companies build a usage framework that covers all practices without blind spots? I explored these questions in depth, and the answers I found show that the problem is less about banning than about understanding, training, and governing intelligently. This article offers a detailed analysis of the issues around Shadow AI, the reasons for its persistence in France, and concrete strategies for building AI governance that actually works.
đź“‹ Table of Contents
Why Shadow AI Persists Despite Validated Tools
I must first clarify a point that surprises many IT managers: Shadow AI does not disappear simply because a company makes its own tools available. It is counterintuitive, but it is the reality shown by the barometer. Three reasons explain this persistence, and they are all rational from the employee’s point of view. The first is habit. An employee who adopted ChatGPT or Claude before their company offered an internal assistant will continue to use what they know. It is human, it is normal 🤖, and it is difficult to combat through bans alone.
The second reason is perceived performance. Company-provided tools are often judged less performant than their consumer equivalents. This may be true or false, but perception matters. An employee who has tested GPT-6 Luna at OpenAI and is offered an older model or one less optimized for their specific use will naturally prefer what they know. The third reason is ease of use. Internal tools may be slower, less intuitive, or require additional authentication. These frictions, even minor ones, are enough to push users toward external solutions.
What I take away is an important lesson for companies: a validated tool that stands comparison with market tools pushes Shadow AI back far more reliably than a reminder of the rules. Bans alone do not work. You need to offer a credible, high-performing, and easy-to-use alternative. It is an investment, but it is also a recognition that employees are not children to be punished, but professionals to be properly equipped.
France, Champion of Shadow AI: Understanding the Paradox
One figure struck me particularly when analyzing the barometer: one in five French companies describes Shadow AI as widespread, compared with one in ten in the three other countries studied (United Kingdom, Germany, Spain). France is therefore twice as affected as its neighbors. Why? I see two explanations that reinforce each other. The first concerns governance and training. In France, fewer than one in two companies train their employees in AI, compared with three in four in the United Kingdom. About one third have drafted ethical guidelines, compared with seven in ten across the Channel. This difference is massive đź“Š.
When rules and training arrive late, usage takes hold on its own. That is the conclusion I draw from these figures. French employees did not wait for their company to make up its mind. They took the available tools and integrated them into their workflow. Now it is too late to ban them. The second explanation concerns the internal offering. More than four in ten French companies still do without tools for querying their internal documents with AI. Employees who need one will look for it elsewhere, naturally. It is an internal offering gap that creates Shadow AI.
What I observe is that France has fallen behind in AI governance. We have talent, we have innovative companies, but we lack a structuring framework and systematic training. It is a problem of strategy, not culture. French companies can catch up, but they must act quickly. Time is against them, because the more Shadow AI takes hold, the harder it becomes to govern.
Governing Rather Than Banning: The Winning Strategy
Here is a question I often ask IT managers: should Shadow AI be banned or governed? The answer the barometer gives me is clear. General bans do not work. One in eight companies observes that Shadow AI continues despite a clear ban. The most common situation is tolerance, which concerns one in four companies. In my view, this is the most fragile position, because the company knows, lets it happen, and the question of its liability arises the day sensitive data leaks đź”’.
Bans retain their meaning when they are specific and justified. Banning the entry of customer data, payroll items, or a contract under negotiation into a consumer tool is something everyone understands and can comply with. It is a rule that makes sense. But a general and vague ban? It creates frustration and Shadow AI. I therefore advocate governance. It means stating which uses are permitted, with which tools and on which data, then providing a validated tool of good quality. A rule that employees understand and can follow generally protects better than an abstract ban.
Concretely, how do you build this framework? I recommend starting with an inventory. Ask teams which tools they use, for which tasks, and with which data, while guaranteeing anonymous responses. Then classify these uses with two simple questions: what data enters the tool? Is the result used to make a decision about a person? You get three lists: what is permitted, what is permitted under conditions, and what is prohibited. Thinking in terms of use rather than tool helps a great deal, because tools change every quarter. Finally, name an identified person responsible, organize training, and plan regular reviews with employee representatives.
Accepted but Underestimated Uses: The Blind Spots of Governance
Beyond Shadow AI, there are uses that the company accepts but that remain poorly governed. I want to talk about three of them, because they represent real risks. The first is meeting transcription. Four in five companies use language models for office work—that is, summaries, video-conference minutes, and help with drafting emails. In France, four in ten respondents say consent to recording is requested explicitly and documented. For another four in ten, it remains informal or has disappeared 🎙️.
This is a major problem. A meeting contains names, opinions about people, sometimes business secrets. It is first and foremost a GDPR issue. It seems essential to comply with the rules on consent to the use of personal data. It is also a question of trust between colleagues. It is necessary to inform all participants in a meeting and ensure their explicit agreement. I would also mention recruitment. Having AI summarize or rank applications seems harmless, but these uses may fall under high-risk systems under the AI Act. Code comes next. More than half of companies that develop software state that at least a quarter of their code is AI-assisted. These tools bring real productivity gains, but this gain can come with technical debt when review falls behind, as well as a risk of skills loss for teams.
What I take away is that AI governance cannot be limited to Shadow AI. It must cover all uses, including those that seem harmless. It is foundational work, but it is also an opportunity. Companies that build complete and intelligent governance gain trust, compliance, and productivity. They also create a culture in which AI is a tool serving employees, not a threat.
The AI Act and Internal Governance: Two Levels of Regulation
Since August 2, 2026, companies have been subject to new obligations under the AI Act, particularly regarding transparency. This regulatory framework is useful, but it has its limits. The text does well what it was written to do. It classifies systems according to risk. Since August 2, it has required telling a person that they are interacting with a machine and making AI-generated content identifiable. Since February 2025, it has also required companies to give their teams a sufficient level of knowledge about these tools. These are useful rules đź“‹.
Those for high-risk systems, such as recruitment, will apply in December 2027. But the AI Act’s limitation lies in its object. It governs systems, those who provide them, and those who deploy them. An employee who pastes a document into their personal assistant falls mainly under the company’s internal policy and the GDPR. A well-made usage charter remains the indispensable complement to the law. Our barometer mainly shows a problem of ownership. Fewer than three in ten respondents say their company knows the text well, and one in eight in small organizations. In France and the United Kingdom, this level has remained stable since 2024. The priority is to make the rule known.
I therefore see two levels of regulation that must coexist. The first is legal: the AI Act. The second is internal: the usage charter and governance. Both are necessary. The AI Act sets a minimum baseline, but it is internal governance that creates a culture of trust and responsibility. Companies that understand this and invest in both levels will be the winners of this transition.
AI Agents: The Next Frontier of Governance
AI agents, capable of chaining tasks with limited human intervention, are beginning to take hold in companies. More than one in three companies already uses autonomous agents in France according to our barometer, and nearly half of European companies use or test them. This is a major change, and it makes governance even more complex. Why? Because the agent acts. With an assistant, the employee reads a response before using it. With an agent, the email is sent, the file is modified, the order is placed 🤖.
The question therefore changes. We used to ask what data entered the tool; now we must decide what the tool is allowed to do. It is a new and heavier responsibility. Control mechanisms exist, fortunately. Developers speak of harnesses, meaning limits set on the agent, with reduced access rights, a log of its actions, and human validation before any irreversible decision. Software development has served as a testing ground, with agents tasked with reviewing the work of other agents. I advise keeping a register of agents, with an owner for each, from the first deployment. There are also governance frameworks, such as the NIST AI Risk Management Framework or the ISO 42001, 42005, and 23894 standards. These tools exist; they must be used 🛡️.
What I see is that AI agents will force companies to be more rigorous in their governance. That is a good thing. Companies that build solid governance now will be ready for agents. Others will have to catch up, and it will be harder. I therefore recommend not waiting. Start with current uses, build a framework, then adapt it for agents. It is a continuous process, not a final destination.
Building Complete Governance: From Theory to Practice
How do you concretely build a complete framework that covers all uses without blind spots? This is the question I have been asking since the beginning of this article, and I will give you my answer based on the barometer and my experience. I would start with an inventory. Ask teams which tools they use, for which tasks, and with which data, while guaranteeing anonymous responses. This inventory is crucial because it shows you reality, not what you think reality is. You will probably discover uses you did not suspect đź“Š.
Then classify these uses with two simple questions. What data enters the tool? Is the result used to make a decision about a person? You get three lists: what is permitted, what is permitted under conditions, and what is prohibited. Thinking in terms of use rather than tool helps a great deal, because tools change every quarter. A rule based on a specific tool quickly becomes obsolete. A rule based on a use remains relevant. Finally, you need an identified person responsible, training, and regular reviews with employee representatives. Given the speed at which these technologies are developing, it is important to provide review clauses to keep up with their evolution. I recommend a review every six months, at minimum.
What I see in best practices is that successful companies combine three elements. First, clear and understandable governance. Employees must understand the rules and why they exist. Second, continuous training. AI evolves quickly, and employees must stay up to date. Finally, a culture of trust. Employees must feel that they are trusted, that they are listened to, and that the rules are adapted based on their feedback. It is a delicate balance, but it is possible.
Conclusion
Shadow AI is not a problem to be solved by force; it is a symptom to be understood. It reveals a gap between the speed at which employees adopt AI and the speed at which companies implement governance. In France, this gap is particularly pronounced, and it is an opportunity for companies that act now. I am convinced that companies that build intelligent governance, based on understanding real uses rather than on bans, will gain in productivity, compliance, and trust. They will also create a culture in which AI is a tool serving employees, not a threat. It is an investment, but it is also a necessity.
AI agents will complicate things, it is true. But they will also force companies to be more rigorous. That is a good thing. I therefore recommend starting now, with current uses, and building a framework that can evolve. Think in terms of use rather than tool, appoint responsible people, train teams, and review regularly. It is simple in theory, but it is work in practice. It is also work that pays off.
đź“ť In Brief
- Shadow AI persists in France because validated tools often arrive after the habit has formed, and employees prefer high-performing, easy-to-use solutions
- France is twice as affected by Shadow AI as its European neighbors, due to insufficient training and a gap in the internal offering of AI tools
- Intelligent governance works better than general bans: define which uses are permitted, conditional, or prohibited, then provide validated tools
- AI agents will complicate governance by shifting the question from “what data?” to “what can the tool do?”, requiring harnesses and an agent register
