Security leaders are shifting from “ban it” to “govern it” as unsanctioned AI use spreads across teams and tools.

Employees are bringing generative AI into daily work faster than most organisations can approve, audit, or secure it. In a recent analysis by Technology.org, the phenomenon is framed as “shadow AI”: the modern cousin of shadow IT, where staff adopt powerful tools outside official channels. The difference is that AI does not just store or share information—it can transform it, infer from it, and sometimes route it into systems that were never designed for that risk.

For European security and compliance teams, the challenge is no longer whether AI should be used at work, but how to regain visibility and control without freezing productivity. That balancing act is becoming a mainstream governance problem—one that touches cybersecurity, privacy, procurement, and, increasingly, fundamental rights.

What “shadow AI” looks like on the ground

Shadow AI is not limited to someone pasting text into a public chatbot. It can be far subtler: an “AI assistant” switched on inside a collaboration platform; a browser extension that rewrites emails; a plug-in that summarises client calls; or a developer using an AI coding assistant with access to proprietary repositories. In many workplaces, AI is now embedded inside tools that are already approved—making the AI layer harder to spot than classic shadow IT.

The risk profile also changes. Shadow IT typically created blind spots around software versions, access controls, and data storage. Shadow AI adds new failure modes: sensitive data can be included in prompts; outputs can be wrong but convincing; and automated “agent” features can take actions that ripple into other systems. The upshot is that security teams can lose oversight not just of apps, but of decisions.

Why bans tend to backfire

Blanket bans are tempting, especially after high-profile data leaks. But they often push usage underground, degrade reporting culture, and leave leadership with a false sense of security. A more durable approach treats shadow AI as a signal: employees are reaching for new tools because existing processes feel too slow, too manual, or too restrictive.

That is why many guidance documents now emphasise “responsible enablement”—creating clear paths for safe use, not only prohibitions. The EU’s own cybersecurity actors have taken a similar line. In its guidance on generative AI in cybersecurity, CERT-EU argues for actionable internal policies, staff awareness, and controls that keep sensitive data out of public models while organisations still benefit from productivity gains.

Regaining control without slowing innovation: a practical playbook

Security teams trying to “catch up” to shadow AI often start with a simple truth: you cannot govern what you cannot see. But visibility alone is not enough. The goal is to build a safer default environment where employees do not need to improvise.

1) Build an inventory of AI use—especially inside “approved” tools

Start by mapping where AI exists today: chatbots, copilots, meeting transcribers, design tools, coding assistants, and AI features inside common SaaS platforms. Include both IT-approved tools and “bring-your-own” usage. Many organisations discover they already have AI features enabled across products purchased years earlier.

2) Define “safe data” for prompts—then enforce it

Most AI governance fails at the prompt boundary. If staff can paste personal data, customer records, or confidential business material into a model with unclear retention or training terms, the organisation may be taking on avoidable exposure. Guidance from EU bodies increasingly recommends clear data-handling rules—what can be shared, what cannot, and how to redact or summarise safely.

For teams looking for structured risk thinking, the NIST AI Risk Management Framework (AI RMF 1.0) offers a governance approach built around mapping context, measuring risk, and managing controls—useful even for organisations that are not building their own models, but deploying them.

3) Offer approved alternatives that are genuinely usable

If employees turn to shadow AI because the official route takes weeks, governance will lose. Many organisations now provide an approved “AI workspace” (or a small set of sanctioned tools) with clearer contractual terms, logging, and stronger privacy settings. The key is usability: if the approved option is slower, blocked, or underpowered, shadow usage will return.

4) Put guardrails around integrations and “AI agents”

As AI moves from text generation to action—booking meetings, modifying code, sending emails, updating tickets—the risk is no longer only data leakage. It becomes process integrity. Controls should focus on least privilege, approval steps for high-impact actions, and strong audit logs. The French national cybersecurity agency ANSSI, for example, recommends traceability and security-by-design measures for generative AI systems, including logging and separation of environments in its security recommendations.

5) Treat vendors and procurement as part of the security perimeter

Shadow AI thrives when teams can purchase tools directly, or when AI features arrive silently through updates. Procurement and security need shared checklists: data retention, model training exclusions, regional hosting options, access controls, auditability, and incident response commitments. This is especially relevant in Europe, where regulatory expectations around accountability are rising.

6) Make training practical, not abstract

Training works when it matches how people actually use tools: “Here’s what not to paste,” “Here’s how to summarise sensitive content,” “Here’s how to verify outputs,” “Here’s when to use approved tools,” and “Here’s who to contact for fast review.” The aim is to turn employees into informed participants in security, not accidental violators.

The European context: governance is now a competitiveness issue

Europe’s regulatory direction is clear: more accountability for how AI is deployed, and more scrutiny over data and rights impacts. The EU Artificial Intelligence Act establishes a risk-based framework for AI, with stricter obligations for certain high-risk uses and clearer responsibilities across the AI value chain. For organisations, that means shadow AI is not just a technical concern—it can become a compliance issue if uncontrolled tools are used in sensitive contexts such as hiring, credit, education, or essential services.

Meanwhile, privacy expectations are sharpening. The European Data Protection Supervisor has published updated guidance on generative AI and data protection, highlighting the need to keep safeguards aligned with a rapidly evolving ecosystem. See the EDPS page and downloadable document: Guidance on Generative AI (EDPS).

In that wider policy environment, “move fast and break things” is a costly posture. For security teams, the emerging job is to create a controlled runway for innovation: quick approvals, clear safe-use rules, and technical guardrails that scale.

What to watch next

Shadow AI is likely to grow as AI becomes a default feature across office suites, customer platforms, and developer tooling. Analysts have warned that unauthorised AI use is becoming a measurable security and compliance risk in enterprises, increasing pressure on organisations to educate staff and formalise policies. The organisations that adapt fastest may be those that stop treating governance as a brake—and start treating it as product design for internal users.

That is the core message behind the Technology.org framing: security teams can regain control, but only if they build systems that make the safe path the easy path.

Related background: The European Times has previously tracked the EU’s regulatory trajectory as the European Artificial Intelligence Act comes into force.

Overheated and underprepared: European survey finds citizens concerned about heat and ability to cope with climate change

A Europe-wide poll of 27,000 people suggests heat is already a household issue—and affordability is the fault line.

Copenhagen/Brussels — 8 February 2026

Summary: Most Europeans say climate change is no longer an abstract future risk. A new Europe-wide survey analysed by the European Environment Agency (EEA) and Eurofound finds that more than 80% of respondents experienced at least one climate-related impact in the last five years, with heat the most common. Yet household readiness remains patchy, with many lacking basic protective measures and a large share saying they cannot afford to keep their homes cool in summer—raising questions about fairness as Europe tries to adapt.

Heat is becoming the everyday climate risk

The EEA’s new snapshot of public experience comes from an online survey of over 27,000 respondents across the EU-27, collected through Eurofound’s Living and Working in the EU e-survey. The results were published on 4 February and analysed in the EEA–Eurofound report “Overheated and underprepared: Europeans’ experience of living with climate change”.

Across the continent, respondents most often described heat as the impact they feel most directly. Nearly half reported feeling “too hot” in their home, workplace, or place of education, while over 60% said they felt too hot outside in their neighbourhood. Concern about the future was also high: just over half said they were very or quite concerned about extremely high temperatures ahead, and almost half expressed similar concern about wildfires.

Heat matters not only because it is widespread, but because it cuts across policy areas: public health, housing standards, labour conditions, education settings, urban planning, and emergency preparedness. In other words, it is not simply a meteorological problem—heat is a governance and social-protection problem.

Preparedness exists, but it is uneven—and often unaffordable

The survey asked about practical, household-level measures designed to reduce risks from extreme weather. The findings point to a persistent “readiness gap”. Around 22% of respondents said they had none of the listed protective measures in place at home, such as shading, ventilation or air conditioning, flood proofing, rainwater collection, insurance against extreme weather, backup power, or an emergency kit.

Even where measures exist, they are not universal. For heat, the most commonly reported home adaptations were shading (about 49%), roof or wall insulation (48%), and air conditioning or ventilation (32%). Yet the most politically sensitive result may be economic: over 38% of respondents said they could not afford to keep their home adequately cool during summer. Among those who reported financial difficulties, that share rose to about 66%.

These numbers underline a basic tension in climate adaptation: Europe can encourage households to prepare, but “do more at home” becomes a hollow message if the costs land on those least able to pay. In the EEA’s framing, household readiness must be paired with affordability and fairness—otherwise adaptation can deepen existing inequalities.

Water access and wildfire smoke: an equity warning

The report additional findings point to unequal impacts, not just unequal preparedness. Respondents with the lowest financial means were far more likely to report problems accessing safe and clean water—about 15% compared to 4% among those with the highest financial means. Exposure to wildfire impacts also showed an income gradient: about 11% of respondents with the lowest financial means reported being affected by wildfires and associated smoke, compared with 5% in the highest-income group.

Other groups also appear structurally disadvantaged. Renters, compared to homeowners, were less likely to report resilience measures in place at home. Respondents with poorer self-assessed health reported being more affected by climate impacts while also being less likely to have protective measures. The report also notes that women and younger respondents (16–29) were among the most concerned about future impacts.

In practical terms, this is what “no one left behind” looks like when tested against heatwaves, drought and smoke: it becomes about access to cooling, water, information, and safe housing—not merely about awareness of climate risks.

Local action is visible—but often non-structural

At neighbourhood level, respondents most commonly reported seeing non-infrastructure measures. The most frequently noticed local actions included warnings or alerts for extreme weather (reported by 57% of respondents), awareness campaigns about risks and what to do (43%), and water-use restrictions during dry periods (42%). Just over a third said they had noticed tree planting or improved access to green space (36%).

By contrast, some measures often discussed in heat preparedness debates—such as cooling centres or more robust flood-prevention works—were not reported as widely observed. The report’s conclusion is not that local authorities are inactive, but that behaviour-oriented measures need to be matched with structural investment where risks are rising.

For Europe, this connects directly to a broader adaptation question already posed in The European Times’ earlier reporting on preparedness and extreme weather: are countries building long-term resilience at scale, or mainly managing immediate risk communication?

Why this matters now for EU policy

The EEA and Eurofound are careful to note that the survey sample is not fully representative of Europe’s population, though weights were applied to better reflect key demographics. Even with those cautions, the report provides a rare Europe-wide view of what people say they are experiencing and doing at home—precisely the level at which policy success or failure becomes real.

The timing also matters. European institutions have increasingly framed resilience as a core pillar of prosperity and security, with the EEA’s European Climate Risk Assessment (EUCRA) warning that many climate risks have already reached critical levels and can become catastrophic without urgent action. The new household-focused evidence adds a social dimension to that risk map: it suggests that vulnerability is not only geographic, but economic.

For policymakers, the report points toward a straightforward, if politically difficult, implication: adaptation is not just about building defences against hazards. It is about ensuring that the ability to cope—cooling a home, getting safe water, reducing smoke exposure, receiving timely warnings—is not reserved for those with higher incomes, better housing, or greater local capacity.

As EEA Executive Director Leena Ylä-Mononen put it, household-level actions must be “affordable and… socially fair so no one is left behind.” In the same release, Eurofound Executive Director Ivailo Kalfin summarised the gap bluntly: climate change affects the lives of four in five citizens, but only a quarter are equipped with appropriate tools to cope.