In the spring of 2023, engineers at Samsung's semiconductor division pasted proprietary source code and internal meeting notes into ChatGPT to speed up debugging and note-taking. Once the company discovered the pattern, it banned generative AI tools on corporate devices within weeks — a policy response arriving to discover a problem that had already happened, rather than to prevent one.
The pattern is familiar from earlier waves of unsanctioned software adoption — employees bringing in tools that solve an immediate problem faster than the sanctioned alternative, without waiting for procurement or security review to catch up. What is different this time is the nature of the risk: earlier shadow IT mostly created data sprawl across unauthorized apps, while shadow AI creates the possibility that sensitive information has already been sent to a third-party model provider, potentially retained, and effectively impossible to fully claw back.
Regulators noticed the same gap from a different angle. Italy's data protection authority, the Garante, temporarily banned ChatGPT within the country in April 2023 over concerns that OpenAI lacked a legal basis for the personal data it was processing — a national-level version of the same discovery that Samsung made internally: the tool had already been absorbing data nobody had formally agreed to hand over.
IT and security teams discovering this inside their own organizations are not typically dealing with malicious behavior. Employees adopted these tools because they worked and because the sanctioned alternative, if one even existed, was slower or worse. That makes the response harder to design than a simple ban, which tends to just push the same behavior further underground rather than eliminating it.
What organizations are converging on instead is a two-part response: rolling out an approved, monitored alternative — Microsoft Copilot for Microsoft 365 is the one most large enterprises are actually deploying — that is fast enough employees genuinely prefer it to the unsanctioned option, paired with a genuine accounting of what has already been shared with external tools before the policy existed.
This creates a strange incentive problem for the employees who adopted these tools early and productively. They are, in a real sense, the reason the organization discovered a genuine capability gap — and they are also the population most exposed if a retroactive audit treats early adoption as a disciplinary matter rather than as useful signal about what the organization actually needed.
The more forward-looking response treats shadow AI usage as market research that already happened for free: wherever employees adopted a tool without being told to, that is a reliable indicator of where an approved workflow like Copilot is actually needed, rather than a violation to be stamped out.
Samsung's initial response was a blanket ban, since narrowed as the company rolled out its own internal generative AI tools instead. The organizations now deploying Copilot are making the same bet in a gentler form: that the fastest way to prevent the next Samsung-style leak is to make the sanctioned tool good enough that nobody feels the need to reach for the unsanctioned one.