What IW measured
The data basis is the representative IW employee survey of March and April 2026. Shadow AI is collected as agreement with the statement of using AI not provided by the employer. Employed AI users were asked (n = 2,793). Of them, 29.1 percent agree. A typical example is private chatbot accounts. IW stresses that not provided doesn't necessarily mean secret or forbidden, but outside company control. It points to risks for efficiency, data protection, trade secrets and compliance.
The authors put it in international context: in a global survey of more than 48,000 employees in 47 countries (Gillespie et al., 2025), almost half say they have used AI against company policies. That is a narrower criterion than in the IW report. IW therefore concludes that the actual spread of AI not provided is probably higher still internationally.
Who uses shadow AI
Use is higher among younger people, managers (34.6 percent versus 25.6 percent without management responsibility) and academics. IW assumes that these groups are more open to AI, have acquired more skills and cover a broader range of tasks that calls for different tools. Private usage habits probably play a role too.
Particularly relevant for the Mittelstand: in small companies with fewer than 50 employees the share, at 33.5 percent, is above that of companies with 250 or more employees (25.5 percent). Even with the same perceived promotion, shadow AI is 10.6 percentage points rarer in larger companies. IW sees this as a hint that employees in small businesses often use AI on their own initiative for lack of official provision. Larger companies can also technically prevent unprovided tools more effectively. A lower value therefore doesn't mean the need is smaller there.
The surprising finding: promotion goes with more shadow AI
The obvious assumption would be that employees turn to private tools when the employer stays inactive on AI. The data show the opposite. Among employees who credit their employer with strong commitment to building AI skills, 44.5 percent use shadow AI. Among those who perceive no commitment at all it is 21.3 percent. In a model that holds age, gender, education, management responsibility and company size constant, the probability of use is 19.9 percentage points higher with full agreement on promotion.
IW reads this as a provision gap. Anyone who promotes skills without providing tools makes use uncontrollable. Anyone who promotes and provides can channel and control it. The authors consider it a fallacy to reduce promotion in order to reduce shadow AI. That would slow down exactly the willingness to use AI from which productivity is meant to benefit.
IW itself names limits: the data are a cross-section of self-assessments. It is conceivable that AI-savvy employees perceive promotion more strongly or demand it. A common driver is equally conceivable: where AI use pays off, companies invest in skills, and the same employees try new tools. The report establishes a robust association but no direction of effect.
What follows for SMEs
Our reading: in practice shadow AI is less a discipline problem than a procurement question. Anyone who trains employees must at the same time be able to say which tool they may use for which data. Otherwise they decide for themselves. That is not a statement of the study but our deduction from IW's three recommendations.
- First get a picture of which tools are actually used. Ask openly, without threat of sanctions.
- Provide at least one approved tool that covers the most common tasks, with checked data protection and a contract.
- Define which data types do not belong in external tools (for example personnel, customer, financial and legal data) and where exceptions with a contract exist.
- Write the rules down briefly and communicate them. A rule nobody knows has no effect.
- Don't ban across the board. According to IW, bans mostly hit engaged employees and change little where AI plays no role anyway.
- Check with data protection and, where applicable, the works council how you may monitor use at all before you control it technically.
What the study doesn't answer
The figures say nothing about which data lands in the private tools. IW points to data protection and secrecy risks but doesn't measure them. Whether a violation exists depends on tool, contract and data, not on the fact alone. The effect of individual countermeasures wasn't studied either. We read the report in full; we could not transfer the age distribution figures completely from the PDF layout and therefore don't cite them.