Contents
Key points
- Shadow AI means staff using AI tools that the firm has never checked or approved. In the survey for a ZHAW bachelor's thesis, covering 72 people at small property management firms in the canton of Zurich, one in three did so.
- The three risks are simple: client data ends up in tools without a contract, unchecked text goes out, and later nobody can trace where an error came from.
- According to the FDPIC, Swiss data protection law already applies directly to AI. No separate AI act is needed for that.
- An AI policy for an SME fits on one page: approved tools, four data classes, what never goes into a tool, review before sending, labelling, a named owner, training and a way to report errors.
- Rolling it out takes 30 days in four steps: take stock, choose tools, approve the policy, train the team.
Shadow AI: used, but not governed
A bachelor's thesis at ZHAW surveyed 72 managers and employees of small firms in the canton of Zurich that manage property. All of the firms have 10 to 49 employees. One in three respondents uses AI at work although their own firm officially uses none. According to the press release of 30 October 2026 (in German), very few of these firms have binding rules on the use of AI.
The figure applies to these 72 respondents in one industry and is not an average for all SMEs. The pattern behind it is still worth a look. Most respondents work with general tools such as ChatGPT or Microsoft Copilot, mainly for correspondence and property listings. Managers name data protection, a missing strategy and too little know-how as the main obstacles. The tools are in the office. The rules are not.
That is what shadow AI means: tools that run in daily work but that nobody has checked, paid for or approved. A ban changes little as long as the work stays the same and no approved tool is available. A rule with an approved tool at least shows where the data goes.
Three risks, in plain words
- Client data in outside tools. Anyone who pastes a client email, a quote with names or a payroll list into a free personal account hands personal data to a provider the firm has no contract with. Many of these providers are based in the US. Since 15 September 2024, personal data may go from Switzerland without additional safeguards to US companies that hold a certification under the Swiss-U.S. Data Privacy Framework. For all others, as we understand it, additional safeguards are needed, and with a personal account nobody checks.
- Unchecked output. AI writes fluently even when the content is wrong. An invented contract clause, a wrong date or an amount from another file look as convincing in a draft as the correct ones. If nobody reads it before sending, the error goes out under the firm's name.
- No audit trail. If a client complains, nobody can say which part of the reply came from AI, which data it worked with or who read the text.
None of the three risks is new. Lists went to the wrong address long before AI. What is new with shadow AI is that all three happen at once and management knows about none of them.
Swiss data protection law already applies
Switzerland does not yet have its own AI act. For personal data, that makes no difference. The FDPIC, the federal data protection authority, states that the Federal Act on Data Protection in force since 1 September 2023 is technology-neutral and directly applicable to AI-supported data processing.
Three points from that statement translate directly into a policy. The purpose, functionality and data sources of AI-based processing must be transparent. Anyone corresponding directly with a language model has a right to know that they are dealing with a machine and whether their input is used further. Where risks are high, the law requires a data protection impact assessment.
What this means in your specific case is a question for your legal adviser. For the policy, as we understand it, one conclusion is enough: personal data only goes into tools where it is set out in writing where the data is stored and what the provider uses it for. Offices bound by professional secrecy face stricter points, covered in Client data and AI. When the EU AI Act applies as well is explained in EU AI Act after the Omnibus.
The one-page AI policy: a template
The template is designed for firms with 10 to 49 employees. It fits on one A4 page, and each line can be completed in an afternoon. The right-hand column contains wording to adapt, not requirements.
| Item | What it covers | Wording to adapt |
|---|---|---|
| 1. Approved tools | Which AI tools may be used with a company account, and for which data classes | “Approved: [tool] with a company account. Personal accounts may not be used for company data.” |
| 2. Data classes | Public, internal, confidential, client data | “If in doubt, the higher class applies.” |
| 3. Never into a tool | A short, closed list | Passwords, ID copies, health information, documents under professional secrecy without a contract |
| 4. Review before sending | No AI text leaves the firm unread | “Whoever sends it has read it and answers for it.” |
| 5. Labelling | When a text or a reply must be recognisable as AI-generated | “If a chatbot replies directly, the first line says so.” |
| 6. Named owner | One named person with time set aside, who approves tools and answers questions | “Owner: [name], deputy: [name]” |
| 7. Training | Required before first use | One hour on joining, one refresher a year |
| 8. Reporting errors | How an error or a data leak is reported, without a search for culprits | “Report the same day to the owner, form on the shared drive” |
Eight lines are enough to start. A policy nobody reads protects nothing. If you want more detailed wording, the Federal Office of Communications published a guide on an AI code of conduct in October 2026, with suggested texts on 10 topics at three levels of detail.
Four data classes and one test
| Data class | Examples | Allowed in |
|---|---|---|
| Public | Property listings, website copy, general professional questions with no client reference | Any approved tool |
| Internal | Process descriptions, templates, notes without names | Approved tools with a company account |
| Confidential | Quotes, margins, supplier contracts, the firm's financial figures | Only tools with written terms on data location and use, after checking with the named owner |
| Client data | Anything that identifies a client, tenant or employee: names, addresses, accounting and payroll data, correspondence | Only tools with a data processing agreement and a known data location, otherwise anonymised only |
One sentence works as a test before pasting: anything you would not email unencrypted to an outside firm belongs at least in the confidential class. Employee data is treated like client data. Four things go into no tool, not even with a company account:
- Passwords, login details and codes for e-banking or portals.
- ID copies and signatures.
- Health information about employees, clients or tenants.
- Documents under professional secrecy, as long as no contract passes the confidentiality obligation on to the provider and the question has been settled with your legal adviser.
Rolling it out in 30 days, in four steps
- 01Week 1: take stockAsk anonymously who uses which AI tool, for what and with which data. Three questions on one sheet are enough. Honest answers must carry no penalty, or the use stays in the shadows.
- 02Week 2: choose toolsChoose one or two tools with a company account. Get written confirmation of where the data is stored, whether input is used for training and whether a data processing agreement is available.
- 03Week 3: approve the policyThe named owner fills in the template, and management approves and signs it. From that day it applies to everyone, management included.
- 04Week 4: train the teamOne hour with examples from your own work: a client enquiry, a quote, the minutes of a meeting. Everyone confirms that they know the policy. After 90 days, ask what works and what does not.
The first step matters most. Without it, you regulate tools nobody uses and miss the ones everybody uses. In the ZHAW survey, written communication was where AI was used most. You can count how many hours sit in your inbox with the free Inbox Hour Counter on a single working day.
What a policy does not do
- Errors remain possible. The policy makes sure they are caught before sending and reported afterwards.
- No substitute for legal advice.
- No answer on where AI pays off. Only your own hours per process show that.
- It stays current only with upkeep: the named owner reviews the list of approved tools at least twice a year and removes whatever nobody uses any more.
A policy brings use out of the shadows. The next step brings more: a process in which AI prepares the work by fixed rules, a named person approves, and a log records who approved what and when. Review before sending then becomes a fixed step in the workflow and no longer depends on goodwill. Timon Wick, Founder and CEO of Grow Amplified, built reporting and forecasting with AI and approval as COO of a consulting boutique. How we measure such a process in your hours before building anything is described under Approach.
Frequently asked questions
Does a small firm really need a written AI policy?
As soon as staff use AI for company work, yes. The ZHAW survey shows that this happens even without an official decision. One page is enough if it covers approved tools, data classes, review and a named owner.
Can I simply ban ChatGPT at work?
A ban is quick to write, but the work the tool was used for remains. An approved tool with a company account and clear data rules works better. Employment law questions about instructions to staff are for your legal adviser.
Which AI tools are suitable for client data?
Tools where it is agreed in writing where the data is stored, whether input is used for training and who has access, ideally with a data processing agreement. For US providers, also check certification under the Swiss-U.S. Data Privacy Framework. With a free personal account, none of these points is contractually settled for your firm.
Do I have to tell clients that a text was written with AI?
According to the FDPIC, people corresponding directly with a language model have a right to know. For texts that a person has read, edited and sent under their own name, your policy sets out what applies. Borderline cases are for your legal adviser.
Does the EU AI Act apply to my SME?
It can apply if your firm offers AI systems in the EU, is established there, or if the output of an AI system is used in the EU. Deadlines and typical cases are set out in EU AI Act after the Omnibus.
Who should be responsible in a small team?
Someone who knows the workflows and is given time for the role, not necessarily someone from IT. They approve tools, answer questions and receive error reports. A deputy makes sure the rule does not lapse during holidays.
15 years in banking and consulting, in transformation and finance operations. Today he builds review lanes with Grow Amplified: agents read and reconcile, a person approves, and a replay log records who decided what.