In many companies, someone has already pasted an internal document into a free AI tool. A salesperson summarised a client contract before a meeting. Someone in finance asked for help with a spreadsheet formula and pasted the sheet. An assistant had a meeting recording transcribed to write the minutes. None of them meant any harm. Each was trying to go faster, and nothing written told them where the limit was.
This is what people call shadow AI: tools used for work without the company having chosen them. The risk is not the tool itself. It is that a free consumer tool may keep what it is given, under terms nobody at the company has read, and that a document, once sent, cannot be called back.
Why it happens, and why banning it rarely works
Unofficial use grows for simple reasons. The tools are free, fast and genuinely useful. Nobody has said which tools are allowed, or for what. And the people closest to repetitive work are the first to see what an assistant could take off their hands.
The reflex answer is a ban. It rarely holds. The need does not disappear, so the use moves to personal phones and home laptops, where nobody sees anything at all. A ban also throws away the time the tools save. The more durable answer has two parts: clear written rules on what may go where, and an approved tool so that people have no reason to look elsewhere.
Ten questions, ten yes or no
Answer honestly, then count your “no” answers. There is no trick: each question stands for a simple protection that either exists in your company or does not.
- Do you know which AI tools your teams actually use today?Not the ones you bought: the ones people really use.
- Does a written document say what may and may not be shared with an AI tool?An instruction given in a meeting does not survive the first departure.
- Do your teams know that a free tool may keep what it is given?Most people do not, and it is rarely written in large print.
- Are client data explicitly banned from tools the company has not approved?Explicitly means written and dated, not assumed to be obvious.
- Is one named person responsible for AI questions?A name, not a committee.
- Is there a list of approved tools, and a way to request a new one?Without a list, everyone picks their own. Without a procedure, nobody asks.
- Do your suppliers tell you what they do with your data in AI tools?Your agencies, advisers and subcontractors use AI too, with your files.
- Are new joiners told the AI rules when they arrive?That is when habits form.
- Would you know if a confidential document had been pasted into a public tool?If not, you will not know on the day it matters either.
- If a client or an authority asked tomorrow, would you have a document to show?This question sums up the other nine.
0 to 2 “no”
Well framed. Use a charter as a final check.
3 to 6 “no”
Exposed on several points. A written charter closes most of them.
7 to 10 “no”
Assume data is already going out. Start this week, not this quarter.
One rule everyone can remember: three colours
The heart of a good charter is a rule that anyone can recall in thirty seconds. Sort what people handle into three colours.
May be used with an AI tool.
Public information: website content, published brochures and job offers, texts with no internal data.
Only in a tool the company has approved.
Internal documents with no personal or client data: procedures, drafts, anonymised working notes.
No AI tool, unless your AI lead approves that specific use in writing.
Client data, staff personal data, contracts, unpublished figures, passwords, internal code.
Add one sentence underneath, and repeat it often: when in doubt, it is red until someone says otherwise. Ask before, not after.
The ten sections of a usage charter
A rule told once fades. A short charter, adapted to the company and signed by everyone concerned, makes it hold. Ten sections are enough.
- Who it applies to: staff, interns and contractors alike.
- The three-colour rule, with examples from your own documents.
- Approved tools: each tool, what may go into it, who approved it.
- Five golden rules, such as reviewing every output before it is sent.
- Requesting a new tool: a procedure that takes minutes.
- The AI lead: one named person who answers questions.
- When something goes wrong: report quickly, without fear of blame.
- Breaches: what happens when the rules are ignored.
- Personal data: how the charter fits your data protection duties.
- Entry into force: handed to every joiner, reviewed once a year.
Two of these sections carry more weight than they seem. The golden rules should include one that no AI tool decides alone about a person, whether in hiring, evaluation or sanctions. And the section on errors should say plainly that someone who reports their own mistake in good faith will not be punished for it. Without that, nobody reports anything, and the company is back to seeing nothing.
What the rules say
Two frameworks are worth knowing, depending on where you and your clients are.
In Morocco, Law 09-08 governs the processing of personal data, under the supervision of the CNDP. Pasting a file that contains personal data into an outside tool is a processing operation, and often a transfer abroad, which the law surrounds with conditions. A signed charter is one of the first documents you can show to demonstrate that the question has been taken seriously.
In the European Union, Article 4 of the AI Act, on AI literacy, has applied since 2 February 2025 to providers and deployers of AI systems, that is, organisations that use AI systems in their professional activity. The AI Omnibus, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, rewrote the article: providers and deployers must take measures to support the development of AI literacy among their staff and others who operate AI systems on their behalf, without being required to reach a set level for each person. The AI Act can also reach companies established outside the Union, for example when the output of an AI system is used in the EU. For a Moroccan company with European clients or subsidiaries, whether it applies depends on the facts.
Check with your counsel
These are working summaries, not legal advice. Have your counsel confirm how Law 09-08 applies to your processing, whether the EU AI Act reaches your activity, and the final wording of your charter before anyone signs it.
A charter is also only half the answer. It governs use; it does not remove the need. Pair it with an approved tool and a short training on real files, and the rules become a habit rather than a constraint.
