PRAXIS Paradigma „Shadow AI” şi conformitatea GDPR: riscuri, oportunităţi şi necesitatea guvernanţei centralizate în prelucrarea datelor cu caracter personal
PRAXIS The „Shadow AI” paradigm and GDPR compliance: risks, opportunities, and the need for centralized governance in personal data processing

Summary/Abstract: The rapid technological advancement of generative artificial intelligence (AI) models has created a significant gap between individual adoption of the technology and strategic organizational data governance. Recent statistics indicate a worrying reality on the Romanian labor market: while 4 out of 10 employees currently use AI solutions to optimize their workflows, less than 5% of companies report or officially implement these technologies. This discrepancy reveals the phenomenon of „Shadow AI” – unauthorized and unsupervised use of algorithms by employees – which generates substantial risks regarding data security, privacy and compliance with the General Data Protection Regulation (GDPR) and the new EU Regulation on Artificial Intelligence (AI Act). This article analyzes the legal implications of the ad-hoc use of AI, the risks of uncontrolled data transfer to third-party providers, and argues for the need to move from a reactive to a proactive approach, based on the principles of Privacy by Design and Privacy by Default, through the controlled integration of AI solutions into the organizational infrastructure.

• Details
• Contents