In every organization I walked into over the past year, one question got two answers that did not match: who here uses AI. Management says a small pilot in one department. The floor says, without embarrassment, that everyone has been using it for a year, from personal phones, and that this is what lets them keep up with the workload.
Both answers are true. That is exactly the problem.
Shadow AI is not a malicious employee. It is a good employee trying to finish the day. He pastes a clause from a contract to get better wording, uploads an Excel file of customer data to get a summary, asks the model to draft a letter to a regulator and attaches the original document. He does not think of this as moving information out of the company. To him it is a calculator.
The numbers no longer leave room for interpretation
In IBM's Cost of a Data Breach report for 2025, unauthorized AI use was identified as a factor in 20% of the incidents examined, and added an average of $670,000 to the cost of an incident. In the same report, 63% of organizations said they had no AI governance policy at all, and 97% of the organizations that suffered an AI-related security incident said they had no proper access controls for these systems.
Verizon's DBIR for 2026 analyzed 858,440 DLP events involving generative AI tools. The finding that surprised me most: 45% of employees use AI on corporate devices regularly, up from 15% the year before, and about two-thirds of that activity runs through personal accounts the organization cannot see and cannot manage. The type of data uploaded most often to outside tools was source code.
One more finding from the same report, and every CEO should pin it above the desk: 60% of malicious insider incidents in 2026 came from convenience, not from intent to harm. These were employees who preferred finishing the work to following the procedure.
The Israeli paradox
In Israel the picture is sharper than almost anywhere else. In the Anthropic Economic Index published in September 2025, Israel ranked first in the world in AI usage intensity relative to population size, with a score of 4.9. A joint study by 5WPR and Louder, published in April 2026, found that 95% of Israeli high-tech employees use AI every day.
The other side of the equation: a report by Israel's State Comptroller, published in June 2026, found that only 18% of the bodies it audited had adopted a defined strategy or policy for artificial intelligence, and that 41% operate with no formal data governance framework.
That is the gap. Employees run ahead, the organization is still deliberating. Inside that gap, every use is unmonitored.
Amendment 13 made this personal
Until August 2025 you could still say a data leak was the IT department's problem. Amendment 13 to the Privacy Protection Law, which took effect that month, changed the equation. It expanded the enforcement powers of Israel's Privacy Protection Authority, required certain bodies to appoint a privacy protection officer, and for the first time imposed direct liability on senior officers.
On 21 July 2026 the Authority imposed the first financial sanction under the amendment: 256,000 shekels on a healthcare body, for failing to report a serious security incident immediately. The Authority stressed that the duty to report arises the moment the incident becomes known, without waiting for the investigation to finish. According to a law.co.il report from late July 2026, the Authority is running more than 100 enforcement files.
Put it in your own terms: an employee who uploaded a file with medical, financial or biometric data to an outside tool created a reportable incident. If you have no map of the tools in use, you will not know an incident happened, and you will not be able to report it in time.
Do not block. Channel
The first reflex of most CEOs is to block. I understand the temptation, and I think it is a mistake. Blocking in an organization where employees already use these tools does not reduce usage. It moves the usage to the personal phone, where you have no visibility at all. You have turned a visible problem into a hidden one.
Here is what I recommend, in order:
Map before you write policy. Two weeks of listening. Which tools are actually in use, for which task, and what kind of information goes in. Nobody gets caught. The goal is a picture, not a case file.
At least one approved tool that actually works well. If the approved option is worse than the outside one, employees go back outside. Corporate account, central identity, logs, and a written commitment from the vendor that input is not used for training.
A short list of what never gets pasted. Not "sensitive information" in general, but four or five concrete categories: ID numbers, medical data, credit card details, signed contracts, source code. People remember a short list. Nobody remembers a twelve-page procedure.
A route for requesting a new tool, with an answer within a week. The moment the official route is slow, an unofficial one is born.
And for information that truly must not leave, a local model. On a national platform I built, sensitive content is processed inside the perimeter, on a server we control, for a simple reason: the safest way to protect data is not to send it.
The good news is that the mapping takes two weeks, not a quarter, and most of what you find will be entirely legitimate. If you want to run that mapping in your own organization and see the real picture before you write a policy, talk to me.
