What does shadow AI mean?
Shadow AI means the use of AI systems in an organisation without sufficient transparency, approval or governance. This may sound like deliberate rule-breaking by individual employees. In most cases, however, the risk arises from structural gaps.
Form 1: How does employee shadow AI arise?
Employees use freely available AI tools such as ChatGPT, Claude or AI-supported translation services for work tasks, on private devices or in the office, without formal approval. Classic technical blocks only have limited effect because sensitive customer data or internal documents can also enter external systems via private devices.
Form 2: How does vendor AI arise?
The more sensitive regulatory form is vendor AI: software your institution has used for years increasingly contains AI components introduced through regular updates. These systems were often not consciously classified as AI, yet duties under the EU AI Act may still arise.
Why is shadow AI particularly critical for financial institutions?
The key difference from classic shadow IT: AI systems make or influence decisions. A loan applicant rejected by an insufficiently tested scoring model, an underwriting system calculating premiums based on a machine-learning model, or HR software automatically pre-sorting applications are not mere IT questions. They raise issues of governance, traceability, data protection, labour law and possible liability.
This is exactly why the connection to the AI inventory is central. Without a structured inventory, neither risk classification nor responsibility allocation is reliable.
If shadow AI creates discriminatory effects in HR processes, employee monitoring or customer access processes, it can also become a sustainability and governance topic. CSRD / ESRS reports then need not only incidents, but also policies, remedy channels, measures and internal controls. This presupposes that the institution is subject to reporting at all: Directive (EU) 2026/470 has limited the CSRD scope to EU companies with more than 1,000 employees and more than EUR 450 million net turnover; national transposition, transition years and group-level assessment must also be checked. The impact or risk must also be material – not every bias incident leads to an ESRS disclosure.
Which vendor AI systems are typical in Austrian financial institutions?
Six areas, from core banking and credit scoring through AML/fraud detection and underwriting to HR recruiting and chatbots.
| Area | Examples | What AI may do there |
|---|---|---|
| Core banking | Temenos, Finastra, Mambu | AI copilot in credit processing, next-best-action recommendations |
| Credit scoring | FICO, Moody's Analytics, SAS | ML-based creditworthiness assessment of natural persons |
| AML / fraud detection | NICE Actimize, Oracle FCCM | Anomaly detection in transactions, customer risk rating |
| Underwriting | Guidewire, Sapiens, Duck Creek | Risk assessment and premium calculation with AI support |
| HR recruiting | Personio, SAP SuccessFactors, Workday | Candidate matching and scoring through AI models |
| Chatbots / service | Genesys, NICE CXone, Leena AI | Natural-language processing for customer communication |
The question "Which AI systems do we use?" sounds simple. Providers rarely label ML components explicitly as AI systems within the meaning of the EU AI Act. A reliable survey requires coordinated involvement of IT, procurement, compliance, HR and business units as well as technical and regulatory expertise.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).