Shadow AI
Private accounts, unknown servers, no data processing agreement. Nobody allowed it, nobody banned it.
For data protection, legal and IT · GDPR, revDSG, AI Act
Your team learns AI on its own cases, and you get what counts in an audit: an AI policy written by the team itself, training records under Art. 4 of the EU AI Act and a platform hosted in the EU with a data processing agreement. We answer every one of your questions in writing.
Introducing AI safely means: first, the questions from data protection and IT are answered in writing, then comes the course with proof of training, which produces the policy. Everything you need to pass on, you receive as one package.
Answered in writing
On EU-hosted platforms such as nuwacom or Langdock, with a data processing agreement. Models from OpenAI, Google, Anthropic and Mistral run via these platforms. We clarify in advance which platform suits you.
For Switzerland, we align the introduction with the revised Federal Act on Data Protection. The policy and documentation use the appropriate terms.
Every participant receives a certificate of participation listing content and hours. The records are prepared for your documentation.
Yes. Your team writes it on day two, based on the cases from the course: tools, data, approvals, disclosure, tone, agents. You receive it as an editable document for approval.
The policy is developed jointly and contains no performance monitoring. On request, we present the concept to your employee representatives in advance.
The cases in the course are real, the data doesn't have to be. In the questionnaire we define what gets anonymised and what may stay on the platform.
Sound familiar?
Contracts in free chatbots, customer data in private accounts: shadow AI emerges when there is no safe alternative. What's missing: a platform, rules and proof.
Private accounts, unknown servers, no data processing agreement. Nobody allowed it, nobody banned it.
The EU AI Act has required AI literacy since February 2025. Anyone asking for proof today often gets no documents.
A template policy sits on the intranet. In daily work, nobody knows what is allowed.
You bring your challenges.
We work on them live.
No off-the-shelf examples: in the course you create prompts, assistants and agents for exactly the tasks that cost your company time.
Afterwards
A platform hosted in the EU with a data processing agreement.
An AI policy the team writes itself and therefore knows.
Proof of training under Article 4 of the EU AI Act for every participant.
Clear rules on which data gets anonymised and what may stay on the platform.
On request
Before management says yes, data protection and IT want to see documents. We send you these five on request, so you can review and approve internally.
The DPA from nuwacom or Langdock, depending on which platform suits you. With details on hosting, sub-processors and deletion periods.
Content, hours and learning objectives of the courses, broken down by day. The document the certificates of participation refer to.
The six chapters your team fills in during the course: tools, data, approvals, disclosure, tone, agents. You see in advance what it will contain.
One sheet per participant with content, scope and date, referencing Art. 4 of the EU AI Act. As a sample, so you can check whether it fits your documentation.
What gets anonymised, what may stay on the platform, who has access. Agreed with you before the course and made part of the policy.
Anything not answered here, we answer in writing, within one working day, with sources. The uncomfortable questions too.
In black and white
Alongside assistants and agents, you leave the course with two documents: one for each participant, one for the whole company.
For each participant
Since February 2025, companies must ensure a sufficient level of AI literacy among their employees (Article 4 of the EU AI Act). If anyone asks, you need documentation. The certificate records the content, scope and date of the course, one sheet per participant, for the personnel file and the next audit.
For the company
Your own document: on the second day, your team writes the rules it will work with AI by from now on, based on the cases it has just built itself. By the evening the draft is ready for approval by management.
Send us your questions on data flow, hosting, DPA or the AI Act. You receive the answers in writing, ready to forward to management and the business units.
Your trainer
Florian Pagel has advised companies on digital projects for more than 30 years, first in marketing for brands such as Google, Nike and Montblanc, today on introducing AI in mid-sized businesses and large corporations. With Hello White Parrot he builds assistants, agents and automations together with teams and trains around 200 people a year, always on their own tasks.
He created the AI programme unlocktomorrow.ai and founded the AI coaching academy Solo-Helden for solo self-employed professionals. He is also the author of “Der KI-Knigge: Authentisch trifft Agentisch” (with Vivian Hecker, BoD 2026): how we stay human when the machine works alongside us. His principle in both roles: results you can apply right away.
FAQ
Yes. You receive the draft as an editable document and approve it before it takes effect. On request, you can join on day two while the team writes it.
It stays yours. We work on an EU-hosted platform with a data processing agreement, with no training on your data. For exercises we anonymise, and that very practice becomes part of your policy.
With models from OpenAI, Google, Anthropic and Mistral via an EU-hosted platform. If you already have a solution in-house, such as Microsoft Copilot, we work with that.
What your team may and may not do with AI, which tools are approved, how client and personal data are handled, when AI involvement is disclosed, and how your own tone is preserved. Written by your team on day two, tailored to your company.
Yes, same agenda, same price. On site the work is more intensive, remote saves travel costs. Where possible, we recommend on site.
Next step
Tell us what you need to check. You will receive an email with a confirmation link. After that, the answers and, on request, the document package arrive by email.
Name, email and one sentence about your topic. Then an email with a confirmation link. We only see your enquiry after you click it.
Cookies for Google Analytics and Google Ads?We would like to use Google Analytics to understand how our site is used, and Google Ads conversion tracking to measure whether our ads lead to enquiries. For this, Google (Google Ireland Limited) sets cookies, and data may also be transferred to the USA. Without your consent, nothing is loaded and nothing is sent to Google. You can change or withdraw your choice at any time via “Cookie settings” in the footer. Privacy policy