An insurer has rolled out Microsoft 365 Copilot. A claims handler does not want to type out a forty-minute client call and uses the free transcription service she also uses at home. An underwriter has ChatGPT summarise a valuation report. On the IT side, Copilot is on record as "the company's AI tool".
That is how it goes at almost every firm that has arranged one AI tool. The other tools have not gone away; they run next to it, mostly on a free account, and none has been decided on. That is shadow AI: self-serve, without a decision, and actually in use. In financial services it weighs more for three reasons, and it can be tracked without following anyone.
What runs next to the approved environment?
The list differs per firm, but a number of tools come back almost everywhere. They are there because the approved tool is not the obvious route at that moment. Why that happens is in we have Copilot, so why do employees use other AI tools.
| What gets opened | Why people choose it | What the firm needs to know about it |
|---|---|---|
| ChatGPT on a free account | Write up a meeting note, rewrite a letter, answer a complaint | Whether input is used for training, and whether an IBAN was in the text |
| Perplexity or another AI search engine | Look up tax rules or product terms with sources | Free or business account, and what the query said about the client |
| Transcription of client conversations | Not typing out an hour-long advice meeting | Where the recording is processed, and that the whole conversation was about the client |
| Tools that read documents | Pull payslips and valuation reports out of an application | Whether there is a data processing agreement, and where the document goes |
| AI features in existing software | The advice software or policy system gained an assistant in an update | No new domain, no purchasing decision, but a new processing operation |
| Browser extensions | Summarise an email or check a text, right in the tab | Which read permissions the extension has in the browser |
The last two rows are the hardest: nothing new was requested, and yet text goes to a model it did not go to last year. Why an extension with read permissions is an AI tool too is explained separately.
Why does it weigh more in this sector?
The first reason is the content. A meeting note contains an income and two IBANs. In this sector the default content of a working day is a client detail. With a free account there is no data processing agreement and input can be used for training; the difference per account type is in free versus business AI accounts. The Dutch Data Protection Authority reported several breach notifications in which employees had put personal data into an AI chatbot.
The second reason is supervision. Supervisors such as the AFM and DNB in the Netherlands look at sound and controlled business operations, and careful handling of client data is part of that. But an AI service nobody has decided on, and that nobody knows is in use, does not fit the word "controlled". What a supervisor then wants to see is in AI in financial services.
The third reason is DORA. The European regulation on digital operational resilience has applied since January 2025 and asks financial entities to manage ICT risk and the ICT services they obtain from third parties, with a register of information on those arrangements. Which obligations apply exactly differs per type of entity and by size. The direction is clear, though: an AI service employees use every day is a third-party ICT service, and if nobody knows it is in use, it is in no register.
Why does a survey fall behind?
A mortgage advisory firm with forty advisers has allowed Copilot. In February the IT lead surveys all the teams and finds, next to Copilot: ChatGPT on free accounts, Perplexity, a transcription service for client conversations, a tool that reads application files, and the summarising feature the advice software gained in its latest update. Two of them are recorded nowhere in the register. That is not an incident. It shows that the register does not keep up with the working day.
In May the February list is already out of date. The team using the transcription service has switched to one that fits Teams better. And the portal of an insurer the firm works with has gained an AI assistant. Nobody did anything wrong. The survey described February.
Every survey is a snapshot; the mechanisms behind it are in why tool catalogs age. Which methods find use, and what each misses, is in how to discover which AI tools employees really use. For an advisory firm one thing comes on top: the proxy logs see the office, not the adviser's laptop at the client's kitchen table.
How do you keep track without following employees?
By recording only what the decision needs. The question is: which AI services are opened in our organisation, how often, and is there a decision. For that answer, the service's domain is enough. Who opened it, which page and what was on it do not change the decision, and they do change the measurement: from a count of services into a record of people. That distinction, and what it means for the GDPR and the works council, is in AI monitoring versus employee monitoring.
That is why the BeeSensible extension records only the registrable domain, at most once a day per device, with no user id, no path and no page content. The observed domains are matched against a catalog of 865 AI tools, with per tool the vendor, the country, the training policy and a risk score. An admin sees which tools have no decision yet and records it; BeeSensible never chooses itself.
