A company has an AI policy, a few approved applications, and clear guidelines for handling confidential information. Nevertheless, one crucial question remains: Which AI tools are actually used in day-to-day work?
There can be a significant gap between established rules and actual practice. This is exactly where our partnership with Colchix comes in. Together, we want to help companies uncover “shadow AI” and manage AI usage in a transparent and accountable manner.
The partnership is deliberately practical: Colchix contributes the technical perspective on AI applications in use. K11 Consulting helps evaluate the findings and develop appropriate rules, responsibilities, and measures based on them.
Shadow AI refers to the professional use of AI applications outside of the intended approval and governance processes. This can include private chatbot accounts as well as untested AI features in software that is already in use.
This doesn't necessarily stem from a deliberate disregard for company policies. Sometimes there isn't a suitable alternative; other times, there isn't a clear approval process. And occasionally, a familiar program gains new AI features before anyone in the company has had a chance to assess their implications.
This creates an information problem for those in charge: Which tools process which information, under what conditions, and for what tasks?
A policy alone cannot answer these questions. After all, it doesn't know which additional browser tab has just been opened.
Colchix is developing a platform designed to provide visibility into AI usage within the enterprise, protect sensitive information, and provide evidence for governance. The provider focuses on both standalone AI assistants and AI features within other applications.
The publicly described platform consists of three components:
Colchix also emphasizes the European focus of its infrastructure. Which functions and integrations are available and suitable in each company must be determined for the specific use case.
The interesting approach lies in combining detection, protection, and documentation. This not only provides companies with insights into potential risks but also gives them a technical foundation upon which their organizational processes can build.
A detected AI tool does not automatically constitute an assessed use case. And a technical alert does not, on its own, determine what consequences are appropriate within the company.
This is where K11 Consulting brings its expertise at the intersection of AI governance, data protection, information security, and compliance. The partnership is therefore not intended merely as a recommendation for additional software. Colchix can be integrated as a technical component into the ongoing support we provide to our clients.
As part of an AI officer role, insights into actual usage can, for example, help supplement an AI inventory, initiate reviews, and coordinate pending approvals. The relevant departments within the company then decide on permissible use.
For data protection consulting and the role of an external data protection officer, this information can provide important insights for advising and monitoring: Where is personal data processed? Which service providers are involved? Which safeguards require further review?
This is how technical information meets expert analysis. It is this interplay that transforms an anomaly into a manageable process.
A better basis for decision-making. Anyone tasked with evaluating AI applications needs more than just a list of officially acquired licenses. Technical insights can supplement the inventory and enable targeted follow-up questions. This helps set priorities based on actual usage.
Clearer pathways between detection and action. When a previously untested application is identified, it should be clear who will evaluate it and what information is needed. K11 can help structure such processes. After all, a report shouldn’t just be passed from one inbox to the next.
More targeted support for employees. Insights into the tools being used can reveal where practical guidance is lacking. This information can be used to develop clear guidelines for use and appropriate AI training. The goal is to provide a clear path to suitable applications, not a blanket distrust of every new idea.
A more transparent implementation. Technical records can supplement organizational documentation. For internal audits, this makes it easier to determine which controls were actually implemented and where adjustments are needed. They do not replace a professional assessment or comprehensive documentation.
The benefit, therefore, lies not solely in increased visibility. It stems from the fact that companies can put this information to good use.
A hypothetical example: A medium-sized company has rolled out an AI assistant. In addition, other tools are used in specific areas, such as for translations, meeting summaries, or preparing proposals.
As part of a pilot program that has been agreed upon in advance and reviewed for compliance with data protection laws, usage data collected by Colchix could reveal these additional applications. K11 would work with the relevant departments to determine which tasks are performed using these applications and what information is involved.
The results may vary. After review, one tool may be eligible for limited approval. For another, there is insufficient information regarding data processing. A third application meets a need that can be addressed by the solution that has already been approved.
This leads to specific actions: a justified approval, a temporary restriction on use, or specific guidance on a suitable alternative.
This example describes a possible process, not an actual client case that has already been implemented. However, it illustrates the essence of the partnership: Colchix can provide insights; K11 helps develop those insights into clear decisions and practical processes.
A platform for tracking AI usage must, in turn, be implemented with care. If usage data can be linked to specific employees, the purpose, legal basis, access rights, retention periods, and notification of the data subjects must be clarified. Only the data necessary for the specified purpose should be processed.
If there is a works council, relevant co-determination rights regarding technical devices used to monitor behavior or performance must also be taken into account.
Technical protection measures also need to be properly categorized: reversible tokenization does not automatically constitute anonymization. Similarly, a European storage location alone does not address all data protection issues.
That is exactly why it makes sense to combine this with consulting. The goal should not be to gather as much information as possible, but rather to use the right information under the right conditions.
The first step is to ask what a company specifically wants to improve: its understanding of AI applications, its handling of sensitive information, or the traceability of existing controls.
Based on this, a limited scope of application, responsibilities, and success criteria can be defined. Among other things, a pilot project should demonstrate which applications are covered, how reliable the results are, and the effort required to process the reports.
As of the publication of this post, Colchix classifies its platform as a private beta. Therefore, availability, feature set, and technical requirements should be specifically confirmed before implementation.
K11 can assist with technical and organizational preparation. The scope of this assistance depends on what support the company already provides internally and where additional expertise is needed.
Our partnership with Colchix brings together two perspectives that complement each other in the area of AI governance: the technical tracking of relevant usage and the substantive design of responsible practices for handling it.
For customers, this can lead to a clearer path: identifying AI applications, evaluating their use, implementing appropriate measures, and assessing their impact.
Software alone does not automatically ensure that a company complies with the law. Consulting alone, on the other hand, cannot account for every technical process. Together, Colchix and K11 can help bridge this gap and better organize the effective use of AI.