Safe AI & governance
From shadow AI to AI you control
Generative AI is too useful to ignore, and too risky to leave to chance. Here’s how SMEs can capture the benefits while protecting their data, clients and reputation.
What is shadow AI?
AI used at work, outside the company’s control
Shadow AI is when employees use personal or unapproved AI tools for work, such as a private ChatGPT account to draft an email or a free Claude account to summarise a contract.
It usually happens with the best intentions: people want to work faster. But without approved tools and clear guidance, company and client data ends up in services the company has no agreement with, no visibility into and no control over.
Data leaves your control
Client details, contracts and internal documents get pasted into personal accounts, outside your contracts, security settings and visibility.
Compliance blind spots
No record of what was shared, where it went or who used it. That is a real problem under the Swiss FADP, GDPR and, for EU-facing businesses, the EU AI Act.
Fragmented, untrusted results
Everyone uses different tools in different ways. Quality varies, knowledge isn’t shared, and nobody can tell what the company is actually getting out of AI.
Why bans fail
Saying “no” just pushes AI further into the shadows
Blocking AI doesn’t remove the demand, it only removes your visibility. The companies that get this right offer a better, safer alternative and make it the easiest option.
Discover
Find out which AI tools are already in use, by whom and with what data, through an anonymous, blame-free survey.
Set clear rules
A practical AI usage policy: which tools are approved, what data may be used and who is accountable.
Provide approved tools
Business-grade AI services with proper contracts, no training on your data, Swiss/EU hosting where required and single sign-on.
Control access
Connect AI to company data only through your existing permissions, so nobody sees more than before.
Train your people
Workshops that make the safe way the easy way, so employees don’t need workarounds.
Review & improve
Regular check-ins on usage, value and risk as tools and regulation evolve.
The regulatory landscape
Rules that shape how you can use AI
You don’t need to become a lawyer to use AI responsibly, but you do need to know which rules apply. I design solutions with these frameworks in mind and work alongside your legal advisers where needed.
Swiss FADP (revDSG/nDSG)
Switzerland’s revised Federal Act on Data Protection, in force since September 2023. It sets rules on transparency, data security and transfers of personal data abroad, all of which apply when staff paste personal data into AI tools.
EU GDPR
Relevant whenever you process personal data of people in the EU, for example clients, suppliers or employees. It requires a lawful basis, data processing agreements and appropriate safeguards.
EU AI Act
The EU’s risk-based AI regulation, which is being phased in. It can apply to Swiss companies that offer AI-supported products or services in the EU, and it requires AI literacy for staff who use AI systems.
This overview is for general information and is not legal advice.
The principles behind every solution
Your data, your control
Swiss/EU hosting and your own tenant where it matters.
Access rights respected
AI only sees what each person is already allowed to see.
Vendor-neutral
Independent advice. I don’t resell software licences.
Compliance-aware
Designed with the Swiss FADP, GDPR and the EU AI Act in mind.
Humans in the loop
People stay accountable for decisions that matter.
AI only where it helps
Sometimes simple automation is the better answer.
Find out how much shadow AI you have
The AI Readiness & Shadow AI Check shows how AI is really being used in your company, and what to do about it.