Shadow AI: why public AI tools are a risk and how Microsoft Copilot offers a secure alternative

Today NOS Nieuwsuur published an alarming investigation into the use of public AI in the workplace: https://nos.nl/nieuwsuur/artikel/2617591-waarschuwing-voor-personeel-dat-met-ai-aan-de-slag-gaat-kans-op-datalek-groot

More than a thousand documents with sensitive personal data, including national identification numbers and social care files, uploaded in a short period to public AI tools. Not fiction, but the reality at several well-known organizations in the Netherlands and beyond [1].

In this article you'll read what's going on, why the problem is growing, and how organizations can offer their employees a safe alternative with Microsoft Copilot. You'll also learn why an AI e-learning with Copilot and targeted workshops are the key to letting your team work with AI responsibly.

What is Shadow AI?

Shadow AI is the use of AI tools by employees without the organization knowing about it or having approved it [1]. Think of an employee summarizing a confidential file in ChatGPT, an HR professional running a CV through a public AI tool, or a policy officer pasting a youth-care file into Gemini to write a report faster.

The risk? Free versions of public AI tools may store the data entered and could use it to further train the AI models. That means sensitive information can indirectly resurface in answers given to other users [1].

Ethical hacker Jan van der Put, who works extensively for the Dutch government, puts it like this in the NOS article: "The biggest risks lie with employees who want to work with AI but don't know how to do so safely." [1]

What happened: the facts

City of Eindhoven

A sample over the period 23 September to 23 October 2025 showed that municipal employees in Eindhoven had uploaded more than a thousand documents containing personal data to public AI websites [2]. These included national identification numbers, social care data, youth-care files containing information about the mental and physical health of minors, and internal CVs [2][3].

The municipality reported the data breach to the Dutch Data Protection Authority, blocked all public AI websites and asked OpenAI to delete the data. Whether that actually happened has not been confirmed [1][2]. Municipal employees have since been restricted to working with Copilot inside the secured municipal environment [2].

Amazon

Technology giant Amazon also ran into trouble. Internal company documentation was found in ChatGPT, after which the company restricted AI use by its employees [1].

AI researcher Remco van der Schoot of Utrecht University of Applied Sciences explains in the NOS article: "If we put data into an AI model, that data can be used to train the model. So it can happen that this information becomes publicly accessible." [1]

The numbers: Shadow AI is growing explosively

According to the Verizon Data Breach Investigations Report (DBIR) 2026, use of unauthorised AI tools on company devices rose from 15% of employees in 2025 to 45% in 2026. Of those users, 67% use personal accounts, completely out of sight of the organization [4][5].

Shadow AI is now the third most common cause of non-malicious internal data loss [5].

Why banning doesn't work

It's tempting to ban all public AI tools as an organization. But practice shows this isn't a solution. Employees will always look for ways to work more efficiently. If the organization doesn't offer a safe alternative, they'll use their private phone, a personal account or a browser on their home network.

Jan van der Put confirms this in the NOS article: "The best thing you can do is to facilitate something, so you can also monitor how it's being used." [1]

The Verizon DBIR 2026 supports this: even though more and more organizations are trying to limit AI, use has tripled in just one year [4]. The researchers argue for regulated, controlled AI access instead of a blanket ban.

The smart approach is therefore not to ban, but to facilitate. Give employees the same AI power they know from ChatGPT and Gemini, but within the secure boundaries of your own organization.

Microsoft Copilot: AI power within your own walls

That's exactly where Microsoft Copilot comes in. Microsoft Copilot is fully integrated into the tools your team uses daily: Word, Excel, PowerPoint, Outlook and Teams. The big difference with public AI tools lies in the way data is processed and protected.

According to Microsoft's official documentation, Microsoft Copilot offers the following data protection:

• No training on your data. Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train the underlying AI models. This applies to all commercial Microsoft 365 customers [6].
• Works within your tenant. Copilot only retrieves information the user has access to, based on existing permissions and policies in the Microsoft 365 environment [7].
• Respects existing security measures. Think Sensitivity Labels, DLP rules, retention policies and access rights via Microsoft Purview [7][8].
• Compliant with GDPR. According to Microsoft, Microsoft Copilot meets existing privacy, security and compliance obligations for commercial customers, including the GDPR and the EU Data Boundary [6].
• Enterprise Data Protection. Prompts and responses are protected by the same contractual terms that apply to email in Exchange and files in SharePoint [8].

Concretely: your employees get the same AI power to write documents, analyze data, summarize emails and recap meetings, but without the risk of sensitive information ending up in public systems.

Important: the effectiveness of this protection depends on a proper configuration of your Microsoft 365 environment. Access rights, labels and policies must be set up correctly to get the most out of the security.

The EU AI Act makes training mandatory

Besides offering secure tooling, there's another reason organizations must act now. Since 2 February 2025, Article 4 of the EU AI Act is in force. This article obliges all organizations using or providing AI systems to ensure an adequate level of AI literacy among their staff [9][10].

This is not optional advice. It's a legal obligation. Organizations must be able to demonstrate that they have taken action to prepare employees to work with AI. The Dutch Data Protection Authority advises organizations to make AI literacy a priority and to address it strategically [9].

Concretely, this means employees must understand what AI can and cannot do, what risks exist (such as bias, hallucinations and privacy breaches), when human intervention is required, and how to handle AI output responsibly [9][10].

How AmeCoda makes your organization AI Ready

At AmeCoda we take organizations from beginner to Microsoft Copilot expert. We do this in two ways: via our AI Ready Program and via the AmeCoda Academy [11][12].

The AmeCoda AI Ready Program

Our most popular program is the AI Ready Program. In four concrete steps, we make sure your team learns to apply Microsoft Copilot Chat effectively in their daily work. No dry theory, but interactive workshops and practical assignments that directly connect with the work of your employees [11].

The program consists of:

• Scan & Report We map the opportunities for AI and Microsoft Copilot and translate them into a concrete report that serves as the foundation for all next steps.
• Introduction to AI Explanation of AI, fundamentals, effective prompting, opportunities and risks and an introduction to Microsoft Copilot Chat.
• Three practical assignments Between workshops, participants work for three weeks on practical Microsoft Copilot assignments (one per week), tailored to their work based on the scan.
• AI Ready Workshop Participants deepen their knowledge of Microsoft Copilot Chat and learn to apply it effectively in their daily work using use cases from the scan.

After the program, optional follow-up steps are available, such as an Microsoft Copilot Premium workshop (deep dive into Word, Outlook, Excel, Teams and PowerPoint), Copilot Studio Agents and continuous support via a monthly subscription [11].

The AmeCoda Academy: AI e-learning with Copilot

Alongside workshops, we offer the AI e-learning with Copilot in the AmeCoda Academy, our online learning platform that lets employees build AI skills step by step. From the first introduction to AI to advanced applications with Microsoft Copilot Chat and Microsoft Copilot Premium, all within one platform [12].

What makes the Academy unique:

• Five learning paths from beginner to advanced: AI basics, effective prompting, Microsoft Copilot Chat, Microsoft Copilot Premium and Copilot Agents
• Practical No long theory, but realistic scenarios you can immediately apply in your own work
• Quizzes and certificates After every lesson you answer quiz questions. Complete a full learning path and receive an AmeCoda Academy certificate
• Gamification XP, streaks, leaderboards, datachips and avatars keep employees motivated and make learning fun
• Team functionality Compare progress within your team and challenge colleagues to learn together
• Learn at your own pace No deadlines, no pressure. Learn whenever it suits you

The Academy is ideal as a complement to the workshops, but also works on its own for organizations that want to offer an AI e-learning with Copilot to their employees [12].

Why workshops AND e-learning?

Organizations that truly want AI to stick combine workshops with e-learning. Workshops create immediate impact and enthusiasm on the floor. E-learning anchors knowledge, lets employees continue at their own pace and makes onboarding new colleagues easy. Together they form a complete journey from first introduction to daily use [11][12].

Cybersecurity and technical setup

Working safely with Microsoft Copilot starts with a properly configured Microsoft environment. Think configuring access rights, setting up Sensitivity Labels, activating DLP policies and ensuring the right license structure.

Need help with this? Via our network we're happy to refer you to BEEREPOOT, a specialized ICT and cybersecurity firm with over 25 years of experience. They are ISO 27001 certified and the force behind the BeterBeschermd security label.

The question isn't whether your employees use AI

Let's be honest: your employees are already using AI. The real question is whether they're doing it safely. With the right tooling (Microsoft Copilot), the right training (Copilot workshops and e-learning) and the right technical setup, you give your organization everything it needs to deploy AI responsibly and productively.

Want to know how your organization can work safely and effectively with Microsoft Copilot? Schedule a free intake call directly using the button below the references.