Shadow AI in the Workplace: ChatGPT, Copilot and Free Tools — Practical Policy, GDPR and AI Act Guide for Portugal

Employees adopt ChatGPT, Claude, Gemini, Copilot and browser extensions faster than IT can approve them. That gap is shadow AI: generative AI used for work without a contract, without data classification and often without management knowing. In Portugal, INE data shows most organizations still lack adequate in-house AI skills; field studies describe adoption as scattered and chaotic. Banning tools does not work; governance, approved accounts and a one-page policy do. This guide is for CEOs, HR, legal, IT and engineering leads who need practical rules that survive RGPD and the EU AI Act. It complements enterprise AI security (technical LLM threats) and AI-ready data governance. Damascode helps European companies design approved AI stacks, integrations and policies through IT consulting and secure delivery via nearshore software development.

Table of contents

• Why shadow AI is the default in 2026
• Portugal and EU context (INE, EY, AESE/IST)
• Shadow AI vs shadow IT
• Risk matrix: tool × data × consequence
• RGPD when pasting into an LLM
• AI Act obligations that already apply
• Approved tools: ChatGPT Business, Copilot, Claude Team, Gemini Workspace
• One-page AI usage policy (template)
• Rollout in 30 days: IT, HR and comms
• When to move from SaaS chat to custom RAG or agents
• Monitoring and incidents (including CNPD timelines)
• FAQ
• References

Why shadow AI is the default in 2026

Generative AI is the first enterprise technology that requires no procurement to start using. A personal account, a free tier and a client spreadsheet are enough. Productivity gains are immediate: email drafts, meeting summaries, proposal text, code snippets, job ad wording.

The failure mode is not malice. It is invisible data processing:

• Customer PII in prompts
• Unpublished prices and contracts
• CVs and performance notes
• Source code and API keys
• Health or financial data in attachments

Without enterprise accounts, the organization cannot enforce retention, training opt-out, SSO, audit logs or incident response. Security teams discover usage only after a leak, a client question or a CNPD inquiry.

Treat shadow AI as a governance problem with a technical fix, not a discipline problem solved by prohibition.

Portugal and EU context (INE, EY, AESE/IST)

Public statistics and surveys relevant to policy design:

• INE (2025): AI use in Portuguese enterprises rose to about 11%; lack of internal skills (~74%) and legal uncertainty (~57%) are top barriers; among adopters, text/code generation (~46%) and written language analysis (~59%) dominate.
• EY European AI Barometer (2025): Most employees want more AI training; only about 24% in Portugal say their employer provides adequate training.
• AESE / IST study (2025, ~81 organizations): Top management is often committed, but dedicated AI roles are rare; adoption is frequently person-by-person; data quality blocks advanced use; information security acts as a gate for projects.

Policy and approved tooling directly address skills, legal clarity and security gates without slowing legitimate productivity.

Shadow AI vs shadow IT

Shadow AI inherits shadow IT risks and adds model behavior risk (hallucination, wrong legal text, biased HR wording).

Risk matrix: tool × data × consequence

Use this matrix in workshops. Severity combines confidentiality, volume and reversibility.

Rule of thumb: if you would not email the content to a personal Gmail address, do not paste it into a non-approved LLM.

RGPD when pasting into an LLM

Using an AI assistant with personal data is processing under RGPD. Minimum program:

1. Lawful basis — contract, legitimate interest (document balancing test) or consent where appropriate; not “because the tool is cool”.
2. Data minimization — redact names, identifiers and amounts; use synthetic examples.
3. Processor agreement — enterprise vendor as processor with a signed DPA; you remain controller for employee/customer data.
4. International transfers — verify sub-processors and transfer tools (SCCs, adequacy).
5. Transparency — privacy notice and workplace policy mention AI-assisted processing where relevant.
6. Rights — procedures if a data subject asks what was sent to AI (usually: avoid sending identifiable data).
7. DPIA — when systematic processing or high risk (HR, monitoring, large-scale profiling).

Portugal’s supervisory authority is the CNPD. Article 33 breach notification: if personal data was exposed through misuse of AI, run your incident playbook (often 72 hours to CNPD when risk to rights).

This article is not legal advice; pair it with your DPO or counsel.

AI Act obligations that already apply

Regulation (EU) 2024/1689 applies directly in Portugal. As of 2026, relevant milestones for everyday business use include:

Shadow AI often violates transparency by definition: customers and employees do not know a free chatbot answered them. Centralizing on approved tools lets you implement disclosure, logging and vendor management.

See the dedicated AI Act checklist for Portugal and AI in recruitment.

Approved tools: ChatGPT Business, Copilot, Claude Team, Gemini Workspace

Selection criteria for Portuguese SMEs and mid-market:

Microsoft 365 Copilot inherits SharePoint/OneDrive permissions — good when permissions are messy, dangerous when they are messy. Audit sharing before rollout.

ChatGPT Team/Enterprise and Claude Team/Enterprise suit mixed stacks and engineering teams; still require policy on what may be pasted.

Google Gemini in Workspace fits Google-native organizations.

None of these replace custom integration when you need ERP/Primavera, ticketing, or permission-aware RAG on proprietary data — that is an engineering engagement, not a licence checkbox.

One-page AI usage policy (template)

Adapt for your intranet. Version, owner, review date required.

1. Scope

Applies to all staff and contractors using AI for company tasks on any device.

2. Principle

You may use AI to work faster. You remain accountable for outputs sent to clients, authorities or colleagues.

3. Approved tools

Only: [list e.g. Microsoft 365 Copilot with company account, ChatGPT Enterprise tenant].
Request new tools via [IT or AI governance contact] before use.

4. Never paste into non-approved AI

• Personal data (customers, employees, candidates)
• Credentials, keys, tokens
• Unpublished contracts, pricing, board materials
• Medical, credit or special-category data
• Full proprietary source repositories unless tool is approved for code

Anonymize first when possible.

5. Always do

• Fact-check numbers, dates, legal references and citations
• Human review before external send
• Disclose AI assistance when client policy or regulation requires
• Use company accounts only — no personal free tiers for work

6. People decisions

AI may prepare summaries; humans decide hiring, firing, promotion, discipline. See recruitment AI rules.

7. Incidents

If restricted data was pasted, notify [security/DPO] same day — no blame for reporting.

8. Training

Company records AI literacy sessions (AI Act Art. 4). Review policy every six months.

Rollout in 30 days: IT, HR and comms

HR messaging should emphasize enablement, not surveillance. Engineering needs secure alternatives (internal chat with no training, or IDE agents with repo boundaries) so shadow use drops.

When to move from SaaS chat to custom RAG or agents

Signals that chat licences are not enough:

• Answers must cite internal docs with permissions (SharePoint alone insufficient)
• Workflow spans CRM + ERP + ticketing with write actions
• You need audit trails per decision for regulated clients
• Volume makes per-seat Copilot cost exceed building a governed pipeline
• Product embeds AI for your customers (you become deployer under AI Act)

Architecture path: classify data → index with ACL-aware retrieval → tool gateway with human approval for mutations → monitor cost and quality. Damascode typically scopes a 90-day pilot with one department and one golden use case.

Monitoring and incidents (including CNPD timelines)

Incident steps: contain (revoke keys, disable integration) → assess personal data → notify DPO → CNPD if required → client notification if contractually required → post-mortem and policy update.

FAQ

Is it illegal to use ChatGPT at work in Portugal?
No. It becomes a compliance problem when personal data or regulated decisions are processed without basis, contract or transparency.

Can we block all AI websites?
Technically partial; practically drives mobile and personal devices. Prefer approved paths.

Do we need a DPO for AI?
If you already need a DPO under RGPD, involve them. AI does not automatically create a DPO requirement.

Copilot vs ChatGPT for a 50-person company?
If already on Microsoft 365 with solid SharePoint hygiene, Copilot is natural. Mixed stacks or heavy engineering may add ChatGPT Enterprise or Claude. Run a two-week pilot on the same tasks.

Does AI Act forbid internal brainstorming?
No for most internal drafting at minimal risk. Customer-facing chatbots need transparency from Aug 2026.

How does this relate to prompt injection?
Custom bots and RAG face technical abuse. Policy stops data entering wrong tools; engineering secures the tools you build.

What about students and interns?
Same policy; extra training on anonymization.

Can HR use AI to write job ads?
Yes with human review; watch bias and transparency if ads target individuals algorithmically.

References

• INE — use of AI technologies in enterprises (Portugal, 2025)
• EY — European AI Barometer 2025 (Portugal press release)
• AESE / IST — AI Use and Organizational Capabilities (2025)
• Regulation (EU) 2024/1689 (AI Act) and Regulation (EU) 2026/1744 (Digital Omnibus amendments)
• CNPD — cnpd.pt
• OWASP Top 10 for LLM Applications
• Damascode insights: AI Act checklist, AI recruitment, data governance