One shadow AI tool simultaneously triggers violations under GDPR, the EU AI Act, DORA, and NIS2; not sequentially, but all at once.
Imagine this scenario: an employee wants to boost their productivity. They start using an AI meeting transcription tool - free, instant, no IT ticket required. It seems harmless. Within minutes, sensitive conversations are being processed by a third-party AI vendor. No Data Processing Agreement (DPA) has been signed. No legal basis for processing has been established. No one has performed a risk assessment, and the tool appears nowhere in the organisation's records.
That single act - one employee, one unsanctioned tool - has simultaneously triggered violations across four major EU regulatory frameworks. Not one after the other. All at once. This article breaks down exactly how, with the specific penalties each regulation carries.
80%+ of workers use unapproved AI tools in their jobs - including nearly 90% of security professionals |
"The efficiency gains override any security concerns." - That's the attitude that's creating your compliance exposure.
Violation 1 - GDPR
The General Data Protection Regulation is almost certainly the first framework your legal team thinks of - and for good reason. A single unapproved AI tool can trigger at least three distinct GDPR failures simultaneously.
No Data Processing Agreement
When an employee routes personal data through a third-party AI tool without IT oversight, there is no Data Processing Agreement (DPA) in place. Under Article 28 GDPR, any third-party processor handling personal data on your behalf must be bound by a contract that mandates GDPR-compliant behaviour. Without a DPA, there is no legal instrument governing how the vendor stores, processes, or sub-processes that data. You have, in regulatory terms, handed personal data to a stranger.
No Legal Basis for Processing
Article 6 GDPR requires that every act of processing personal data has a valid legal basis - consent, legitimate interest, contractual necessity, or another listed ground. When employees use unsanctioned AI tools to transcribe meetings that include third-party personal data (client names, contact details, commercially sensitive discussions), no legal basis has been identified or documented. The processing is unlawful from the moment the tool activates its microphone.
Missing Record of Processing Activities (RoPA)
Article 30 GDPR mandates that organisations maintain a Record of Processing Activities - a live inventory of every processing operation. Shadow AI tools are, by definition, invisible to governance processes. They never appear in the RoPA. In the event of a supervisory authority audit, an incomplete RoPA is direct evidence of non-compliance.
€5.88B Total GDPR fines issued since enforcement began in 2018 - with €1.2B levied in 2024 alone |
GDPR Maximum Fine Up to €20 million or 4% of global annual turnover - whichever is higher (Article 83(5) GDPR) |
Violation 2 - EU AI Act
The EU AI Act introduces a risk-tiered approach to AI governance that places specific legal obligations on 'deployers' - organisations that put AI systems into use in a professional context. Any company whose employee uses an AI tool in a work setting qualifies as a deployer. The obligations that attach to that status do not wait for IT approval.
Unclassified AI System Risk
The EU AI Act categorises AI systems from unacceptable risk (prohibited) through high risk to limited and minimal risk. This classification determines what conformity obligations apply. When an employee adopts an unapproved tool, that system has received no classification. Its intended purpose, data practices, and risk level are entirely unknown to the organisation. Using an unclassified AI system in a professional context is a direct non-compliance with the Act's foundational AI risk assessment architecture.
Non-Compliance with Deployer Obligations
Deployers under the EU AI Act are required to: ensure the AI system is used in accordance with its intended purpose; implement appropriate human oversight; maintain technical and organisational measures proportionate to risk; and - for higher risk systems - ensure staff using the system have sufficient AI literacy. None of these conditions can be met for a shadow AI tool the organisation does not know exists. There is no oversight, no instructions of use, no literacy program, and no risk register entry.
€35M Maximum EU AI Act fine for violations involving unclassified AI systems or failure to meet deployer obligations EU AI Act, Article 99 |
EU AI Act Maximum Fine Up to €35 million or 7% of global annual turnover - whichever is higher (Article 99 EU AI Act) |
Violation 3 - DORA
The Digital Operational Resilience Act (DORA) applies to financial entities - banks, insurers, investment firms, payment processors, and their critical ICT suppliers. Its goal is to ensure that the financial sector can withstand, respond to, and recover from ICT-related disruptions. Shadow AI breaks DORA's model at its foundation.
Absence from the ICT Register
Article 28 DORA requires financial entities to maintain a comprehensive register of all ICT third-party service providers. This register is the cornerstone of DORA's supply chain risk management framework. A shadow AI tool - adopted without IT involvement - will not appear in this register. From the moment the tool is first used, the organisation is operating with an incomplete ICT register and is non-compliant with one of DORA's most fundamental documentation obligations.
No Contractual Arrangements
DORA Articles 30–44 impose detailed requirements on the contracts financial entities must hold with their ICT providers. These contracts must cover service levels, data security, audit rights, exit strategies, and incident notification procedures. A shadow AI tool has no such contract. The financial entity has no visibility of the vendor's security posture, no audit rights over their infrastructure, and no contractual recourse if data is compromised.
Operational Resilience Impact
DORA's primary concern is resilience - the ability to maintain continuity in the face of ICT disruption. Ungoverned AI tools introduce hidden dependencies. If the vendor experiences an outage, suffers a breach, or changes its terms, the organisation may not learn of it until the operational impact is already felt. DORA requires that every such dependency is mapped, assessed, and tested. Shadow AI makes that impossible.
DORA applies from January 2025 |
Scope: Banks, insurers, investment firms, crypto asset service providers, and critical ICT third-party providers |
Key obligation: Comprehensive ICT third-party risk management, including a full register of providers |
Fine level: Up to 2% of total annual worldwide turnover for financial entities |
DORA Maximum Fine Up to 2% of total annual worldwide turnover for financial entities (DORA Article 50) |
Violation 4 - NIS2
The NIS2 Directive establishes minimum cybersecurity standards across essential and important entities throughout the EU. Its supply chain security provisions are particularly relevant to shadow AI - and particularly easy to breach.
Unevaluated Supply Chain ICT Provider
NIS2 Article 21 requires covered entities to implement appropriate cybersecurity risk management measures, which explicitly include security in supply chain relationships. When an employee uses an unsanctioned AI tool, the vendor of that tool becomes a de facto ICT supply chain participant - but without any of the due diligence NIS2 requires. The organisation cannot verify the vendor's cybersecurity posture, data handling practices, incident response capabilities, or subprocessor chain.
Risks of Ungoverned AI Tools
Without evaluation, organisations have no basis to assess whether an AI tool uses adequate encryption, enforces appropriate access controls, practices secure software development, or has ever undergone a penetration test. NIS2's supply chain requirements exist precisely because threat actors increasingly attack organisations through their suppliers. An unevaluated AI tool is an uninspected entry point.
Compliance Challenges
NIS2 compliance requires proportionate and documented cybersecurity measures. For AI tools, this means a documented risk assessment of the vendor, contractual security requirements, and ongoing monitoring. None of this is possible for tools adopted without governance oversight. The compliance failure is therefore both substantive (the tool is unevaluated) and procedural (the failure to assess is itself a violation).
54% of shadow AI tools have been used to upload sensitive company data - creating direct NIS2 supply chain exposure |
NIS2 Maximum Fine Up to €10 million or 2% of global annual turnover for essential entities (NIS2 Article 34) |
The Combined Exposure: Concurrent, Not Sequential
This is the point most compliance briefings miss. These four violations do not queue up politely, waiting for the first to be resolved before the second begins. They occur simultaneously, from the moment a single shadow AI tool touches personal data in a regulated context.
A CISO facing a shadow AI incident does not have one regulator to answer to. They may have four, each with their own investigation timeline, information requests, and fine calculation methodology.
The aggregate exposure from concurrent violations across GDPR, the EU AI Act, DORA, and NIS2 is not simply additive - it is reputational, operational, and financial at the same time. Regulatory investigations consume management time and legal resources. Supervisory authorities share information. A GDPR investigation can trigger scrutiny from an NIS2 competent authority. A DORA ICT register gap can prompt questions about whether adequate due diligence was ever performed under NIS2.
$4.63M Average cost of a shadow AI data breach - before regulatory fines are calculated |
The financial sector faces a particularly acute version of this problem. DORA and GDPR apply simultaneously. An AI transcription tool used in a client meeting may process both personal data (triggering GDPR) and ICT services (triggering DORA), while the EU AI Act overlays its own AI risk assessment requirements and NIS2 adds supply chain scrutiny.
The toughest conversation in a shadow AI incident is not with the supervisor. It is with the employee who adopted the tool. They did nothing wrong by their own understanding. They found a tool that made their work easier, used it, and told no one about it because there was nothing to tell. The meeting got recorded. The summary was useful, and the tool cost nothing. By every logic available to them, it was a good decision. What they could not see was that one tool, used once or twice in a meeting, had simultaneously created exposure under four regulatory frameworks. No single training programme, no acceptable use policy, and no onboarding module had ever explained that this was possible. The compliance failure is real, but it did not come from negligence or bad intent. It happened because of the gap between what employees understand about their regulatory footprint and what the compliance team knows, a gap that keeps growing wider every time a new AI feature gets shipped inside a tool the firm has already approved.feature gets shipped inside a tool the firm has already approved. Namita Razdan, Co-Founder, Montro |
Discovery Is the Unlock
The only way to prevent concurrent regulatory violations from shadow AI is to know which AI tools are in use across your organisation before an incident forces the question. AI discovery is not a luxury governance activity - it is the prerequisite for every compliance obligation listed in this article. You cannot sign a DPA with a vendor you do not know exists. You cannot add a tool to your ICT register if it is invisible to IT. You cannot perform a NIS2 supply chain assessment on an unevaluated provider.
AI discovery gives CISOs and DPOs the visibility they need to: triage tools by risk level; prioritise DPAs and contractual arrangements; populate the ICT register accurately; perform EU AI Act deployer assessments; and establish NIS2-compliant supply chain due diligence. It transforms a reactive shadow AI governance posture into a proactive one.
The Concurrent Violations Checklist |
☐ GDPR - DPA signed, legal basis documented, RoPA entry created |
☐ EU AI Act - AI system classified, deployer obligations assessed, human oversight confirmed |
☐ DORA - Tool added to ICT register, contractual arrangements in place (financial entities) |
☐ NIS2 - Supply chain risk assessment completed, vendor cybersecurity posture verified |
☐ Montro AI Discovery - Full inventory of AI tools in use across the organisation |
Start With a Discovery Audit
Most organisations do not know how many AI tools are actively in use across their workforce. Research suggests the number is consistently higher than IT teams estimate - and that the gap between sanctioned and unsanctioned AI is growing as generative AI capabilities expand.
Montro's AI Discovery Audit gives CISOs and DPOs a complete, actionable inventory of every AI tool in use across the organisation - mapped against GDPR, EU AI Act, DORA, and NIS2 obligations. Centralised visibility. Custom compliance reporting. Financial accountability.
The audit is the first step from exposure to control.
Don't wait for a regulatory inquiry to discover which AI tools your organisation is running. By then, the violations have already occurred.
Frequently Asked Questions
Can a single regulatory investigation trigger scrutiny from other supervisory authorities?
Yes. European supervisory authorities increasingly share information and coordinate investigations. A GDPR inquiry from a data protection authority can prompt questions from an NIS2 competent authority about supply chain security. A DORA ICT register gap identified by a financial supervisor can trigger scrutiny of whether adequate due diligence was performed under NIS2. The four frameworks are enforced by different authorities, but those authorities are not operating in isolation.
Does DORA's ICT register requirement apply to free-tier AI tools?
Yes. DORA defines ICT services broadly as digital and data services provided through ICT systems on an ongoing basis. A free-tier AI tool processing business data is an ICT service regardless of its commercial model. The absence of a contract does not remove the registration obligation,it creates both a registration gap and a contractual gap simultaneously, and AI tool discovery is the only mechanism that surfaces these gaps before a supervisor does.
What is the difference between a GDPR DPA and a DORA contractual arrangement?
They serve different purposes and are not substitutes. A GDPR Article 28 DPA establishes the processor's obligations regarding personal data; lawful basis, security measures, sub-processor notification, data return. A DORA Article 30 contractual arrangement covers ICT service resilience; service levels, audit rights, exit strategies, incident notification, concentration risk. A shadow AI tool in a financial entity lacks both. Signing one does not satisfy the other.
When does NIS2 apply to an organisation using a shadow AI tool?
NIS2 applies to essential and important entities as defined in Annex I and Annex II of Directive (EU) 2022/2555; covering sectors including energy, transport, banking, health, and digital infrastructure with 50 or more employees or €10 million or more in annual turnover. For in-scope entities, using an unsanctioned AI tool processing business data without supply chain due diligence creates immediate Article 21(2)(d) exposure from the moment the tool is first used.
