A marketing manager uploads a client list to ChatGPT to segment the database. An HR specialist uses AI to summarize candidate CVs. A finance team member tasks generative AI with drafting a quarterly presentation. These actions are well-intentioned and driven by a desire for efficiency—yet, they often occur without the company’s knowledge.
This is a daily reality in almost every organization following the integration of Generative AI (GenAI) into professional life.
In literature, this phenomenon is dubbed "Shadow AI." It refers to the individual use of artificial intelligence that bypasses corporate oversight, audit trails, and established protocols.
Türkiye’s Personal Data Protection Authority’s (“the Authority”) document titled “The Use of Generative AI Tools in the Workplace,” published in March 2026, serves as a stark warning: the fact that AI use remains invisible to the corporation does not absolve the company of legal liability. On the contrary, it allows liability to
