“I just wanted to save five minutes.”
A vague instruction, a personal tool and a copy-and-paste are enough for sensitive data to leave the intended framework.
Recommendations / Shadow AI and usage charters
Recommendations · Undeclared uses · AI charter
Shadow AI and usage charters: frame rather than ban
Employees already use AI tools that the organisation has neither chosen nor validated. This page explains how to spot them, what a usage charter should contain and what it does not replace.
The essentials
Uses that are already there, to be framed.
The definition, then what a charter can and cannot do.
Direct answer
“Shadow AI” refers to uses of AI tools that are neither validated nor supervised, with in particular the risk of entering sensitive information into public chatbots.
A usage charter serves to frame these practices rather than ban them: it says which data must never be entered, which tools are authorised and who checks. It replaces neither the consultation of the works council nor the risk assessment.
Présanse, awareness material, 2025 (in French) ↗ · Guide to AI in occupational health services, Shadow AI
01 / Spot
Three signs that uses already exist.
The risk exists before any official deployment.
Undeclared AI uses.
They are among the warning signs of the axis on social relations at work, along with a decline in informal exchanges. The same axis describes divides between advanced users and non-users.
No sensitive data in a non-validated tool.
The Présanse charter prohibits entering personal, medical or identifying data into a tool that the service has not validated.
02 / Act
Four actions, in this order.
Understand before setting rules, then give an alternative.
| Action | What it makes possible |
|---|---|
| Map existing uses | Understand practices, needs and workarounds without driving them underground. |
| Set out the prohibited data | Give concrete examples for personal and health data. |
| Offer authorised solutions | Meet real needs with a framework that teams can use. |
| Train and document incidents | Improve the framework from the errors and difficulties observed. |
03 / Draft
What should an AI charter contain?
The ten principles of the Présanse charter, turned into decisions. Written for French occupational health services, it presents itself as an adaptable template.
| Principle | Decision to write down |
|---|---|
| Human oversight | Identify who checks, validates, challenges and takes responsibility for the use. |
| Medical data | Do not send personal or health data to an unauthorised tool. |
| Transparency | Document the tool, its purpose, its limits and the exact role of AI. |
| Fairness | Look for biases and effects that differ between groups. |
| Traceability | Document uses, validations, errors, incidents and corrections. |
| Governance | Define who is responsible, the decision path and the conditions for stopping. |
| Proportionate use | Start from a real need and choose the least intrusive system possible. |
| Security and reliability | Assess the environment, access, errors and dependencies. |
| Training | Train before use and maintain professional skills. |
| Eco-responsibility | Do not call on AI when its usefulness has not been shown. |
Présanse AI charter, official page (in French) ↗ · Guide to AI in occupational health services, the ten principles
04 / Limits
What a charter does not replace.
Four points to deal with separately, charter or not. The references are to French and European law.
| Subject | What to remember | On this site |
|---|---|---|
| Works council consultation | In the case decided in Créteil on 15 July 2025, access to ChatGPT was governed by an IT charter: the use of the tools was nevertheless suspended until the consultation was closed. The Paris Court of Appeal upheld this on 21 May 2026: the fact that employees had already used these tools on their own initiative does not set the consultation aside. | Créteil, 2025 · Paris, 2026 |
| Risk assessment | At the annual update of the risk assessment document (DUERP), review the AI uses in place, including those that appeared without a formal project. | AI and the DUERP (in French) |
| Monitoring of activity | A system for monitoring activity requires employees to be informed beforehand (Article L. 1222-4 of the French Labour Code) and the works council to be consulted (Article L. 2312-38). | Monitoring vigilance? |
| Training | Article 4 of the EU AI Act asks providers and deployers to ensure a sufficient level of AI literacy. | Training each occupation |
05 / For employees
Two habits before using a tool.
Drawn from the pathway for employees.
- The tool is not authorised for this use? Enter no personal, health, confidential or identifying data. Instead, explain your need to your manager to obtain an authorised solution.
- The tool is authorised? First check where the data goes, how long it is kept and whether it is used for training; for health data in France, certified hosting (HDS). Send only what is strictly necessary, with nothing identifying.
Key answers
Three frequent questions.
Short answers, with the page that gives the detail.
What is shadow AI?
Uses of AI tools that are neither validated nor supervised by the organisation, with in particular the risk of entering sensitive information into public chatbots. Présanse, the French federation of occupational health services, uses the term about those services.
Should ChatGPT be banned at work?
The pointers on this site go the other way: rather than a blanket ban, map existing uses, set out the prohibited data with concrete examples and offer authorised solutions. The aim is to understand practices and workarounds without driving them underground.
Does an AI charter remove the need to consult the works council?
The known French decisions do not point that way. In July 2025, the Créteil court suspended the use of AI tools whose access was governed by an IT charter, until the works council (CSE) consultation was closed. The Paris Court of Appeal upheld those orders on 21 May 2026.
Point of caution
This page is an information and prevention resource about the French framework. It is not legal advice and does not replace analysis by a legal professional.
Update log
- First version, drawn from the guide to AI in occupational health services, the recommendation flowcharts and the timeline of court decisions.