TLDR: A new report highlights that ‘Shadow AI’ – the unauthorized use of generative AI tools by employees – is exposing sensitive data within Israeli firms. This widespread practice, driven by a desire for increased productivity and a lack of adequate official tools, poses significant risks including data breaches, regulatory non-compliance under the new Amendment 13 to the Privacy Protection Law, and reputational damage. Many companies lack the necessary oversight to track and control data flow into these unapproved AI systems.
A recent analysis reveals a growing concern within Israeli businesses: the pervasive and often unmonitored use of artificial intelligence tools, a phenomenon dubbed ‘Shadow AI.’ This practice is putting sensitive corporate and customer data at significant risk, as firms struggle to align with new, stricter privacy standards, particularly Amendment 13 to the Privacy Protection Law.
‘Shadow AI’ refers to the deployment of generative AI tools, such as ChatGPT, Gemini, or Copilot, by employees without the explicit approval, security vetting, or oversight of their organization’s IT and security departments. While often well-intentioned, aimed at boosting productivity, streamlining processes, or drafting communications, this ‘backdoor’ adoption of AI bypasses established governance and review mechanisms.
The consequences of Shadow AI are critical and far-reaching. A primary risk is data security breaches. When employees upload internal documents, client information, or financial data into public AI interfaces, organizations lose control over that data. This information may be stored, logged, or even used to train future AI models, irrespective of disclaimers. For sectors with stringent confidentiality obligations, such as finance and law, this represents a severe breach of client trust.
Regulatory and legal exposure is another major concern. The use of unvetted generative AI tools can inadvertently violate privacy regulations like GDPR, FCA, HIPAA, SRA rules, and, crucially for Israeli firms, the newly amended Privacy Protection Law. Amendment 13 aims to significantly tighten supervision over how organizations in Israel manage and secure personal data, imposing heavy sanctions on violators. The law presumes that managers are fully aware of the data they hold, its location, and its usage – an assumption that is often incorrect in the age of Shadow AI.
An illustrative case involved a marketing employee at a financial institution who uploaded an Excel sheet containing customer data into an analytics tool, unaware that the data was being stored externally and potentially exposed. Without real-time monitoring, companies have no way of knowing what sensitive data is being fed into external AI tools, where it goes, or how it’s being processed.
According to Intapp’s 2025 Technology Perceptions Survey, a staggering 50% of professionals admit to using unauthorized AI tools at work. This indicates that half of the workforce might be operating outside their organization’s defined risk framework. Furthermore, a survey of 300 corporate legal departments revealed that 81% are using unapproved AI tools without proper data controls. Alarmingly, 38% of legal organizations reported that over 16% of data sent to AI tools contains private or sensitive information, with 23% stating that more than 30% of their AI-processed data is private.
Israel’s Privacy Protection Authority (PPA) has also released draft guidance on applying the Privacy Protection Law to AI applications, emphasizing the risk of ‘inference attacks’ where personal data is extracted from trained databases. The PPA expects organizations to disclose AI interactions to individuals, detailing data processing, and to implement ‘Privacy-by-Design’ principles, appoint dedicated AI privacy officers, conduct Privacy Impact Assessments (DPIAs), and establish internal policies for generative AI use. Some proposed requirements, such as implementing a ‘data deletion’ feature in AI training processes upon consent withdrawal, raise feasibility questions.
Also Read:
- Workplace AI Adoption Disparities Fuel Widening Productivity Gaps, Reports Indicate
- Fortifying AI: The Evolving Landscape of Generative AI Security
In an era where AI transcends organizational boundaries, from employee phones to public clouds, robust data control is no longer a luxury but a fundamental condition for survival. Firms that fail to implement safe AI practices risk substantial financial penalties, loss of accreditation, and legal liability, alongside severe damage to customer trust and brand reputation.
