Telefónica Details Shadow AI Risks, Urges Workplace Policies

Telefónica, the Spain-based telecommunications company, published a report describing the risks created when employees use artificial intelligence tools without an employer's knowledge or approval — a practice the report calls "shadow AI" — along with steps companies can take to manage it, according to the report, indexed by Google News. The headline frames the report around two questions employers are increasingly asking: what the risks are, and what can be done about them.

What Did Telefónica Publish on Shadow AI?

The report, titled "Shadow AI: What Risks It Poses and How to Manage It in the Workplace," was published by Telefónica and surfaced through Google News. The company's framing ties the term to employee use of AI tools that falls outside sanctioned IT channels, positioning it as a workplace governance issue rather than a purely technical one. Readers looking for the full set of recommendations should consult the original report directly, since the indexed version available for this story did not include the complete body text.

What Counts as Shadow AI in a Workplace?

The term describes employees adopting AI chatbots, writing assistants, image generators or coding tools on their own, often because approved software is slower, more restrictive or simply unavailable for a given task. It mirrors the older concept of "shadow IT," in which workers installed unapproved apps or cloud services to get work done faster. The distinction with AI tools is that many of them ingest whatever text, files or data a worker pastes in, which is part of why companies like Telefónica are treating the practice as worth a dedicated report.

What Risks Does Unapproved AI Use Create?

Telefónica's headline signals that the report addresses risk directly, though specific examples from the full text were not available for this story. Broadly, the category of risk that shadow IT and shadow AI share includes information leaving a company's control once it is typed into a third-party tool, work product that cannot be audited because it was generated outside sanctioned systems, and compliance exposure in regulated industries where data handling rules are strict. None of those categories are unique to Telefónica's report — they are the standard concerns raised whenever employees route company information through tools an employer did not vet.

How Are Companies Expected to Manage It?

Organizations confronting shadow IT and shadow AI typically respond with a mix of policy and infrastructure: a published list of approved AI tools, employee training on what can and cannot be entered into them, and monitoring of network activity to flag unsanctioned applications. Telefónica's report, by its own title, is built around the same two-part structure — risk, then management — which is consistent with how enterprise security teams generally approach the issue. The report does not appear, based on its headline, to treat shadow AI as a problem that can be solved by banning AI tools outright, but rather one that requires defined channels for using them.

How Does Shadow AI Fit Into Broader Workplace AI Trends?

Telefónica's report lands alongside other recent workplace-AI coverage. A separate report on the emotional dynamics of AI in the workplace examines how employees feel about AI tools, a factor that can push workers toward unsanctioned apps if sanctioned ones feel unfamiliar or unwelcoming. Separately, industry reporting on the AI productivity tools market has tracked continued growth in workplace adoption of AI software generally, a backdrop against which shadow AI becomes more likely simply because more employees have access to more tools.

The underlying concern about where company data ends up is not limited to AI. A separate breach affecting Florida's motor vehicle database illustrates, in an unrelated context, why organizations are increasingly focused on tracking where sensitive data flows and who has access to it — the same principle that underpins concern about shadow AI inside a single company.

Telefónica's report does not set a deadline or regulatory requirement tied to its recommendations. It reads as guidance aimed at employers assessing their own exposure, with the company positioning itself as a source on both the risk and the response.