Shadow AI & Tool Chaos: A Study of AI in Contract Work Across DACH 2026

AI has arrived in everyday contract work at companies in Germany, Austria and Switzerland, often faster than processes and governance can keep up. Our brief report "AI in Everyday Contract Work & Document Management in DACH 2026" combines our own conversations with General Counsels, Procurement leads, CFOs, COOs and Contract Managers with recent studies from Docusign & Deloitte, Bitkom, BearingPoint, ESCRIBA and the Commerce & Contract Management Institute.

The result: the biggest risk is not a lack of AI knowledge but a lack of systems. Tool fragmentation slows daily work down, and shadow AI fills the gap that missing approved tools leave behind. This article summarizes the key findings. The full business-case calculation is in the report.

Key Takeaways

• 84% of surveyed companies have already integrated AI into their contract processes (Docusign & Deloitte, 2026).
• 59% name tool fragmentation and scattered file storage as their biggest daily bottleneck, not a lack of expertise (top.legal, DACH 2026).
• 47.8% of office employees in Germany use AI tools without their employer's approval (ESCRIBA, 2026). That is shadow AI.
• Only 26% of companies provide officially approved AI access, although 40% assume employees use private AI tools (Bitkom, 2026).
• The EU AI Act's high-risk obligations have been postponed to December 2027. AI literacy, transparency and traceability are already required today.

Short answer: How do companies in DACH use AI in contract work?

Most companies in the DACH region already use AI in their contract processes, but only around a third have productive, approved tools for it. Shadow AI fills the gap: employees use private AI tools and enter internal and sometimes strategic information into them. The real bottleneck is not legal but operational: scattered tools, long document searches and handovers between Sales, Procurement, Finance and Legal.

The key figures at a glance

AI has reached contract work, but the processes have not

Contract work used to be manual labor: scattered across emails, folders and approvals shouted across the office. That is changing fundamentally. According to Docusign & Deloitte, 84% of surveyed companies have already integrated AI into their contract processes. German companies using a fully integrated AI platform report an average ROI of 33% within twelve months and around 22 working hours saved per contract process.

At the same time, the focus is shifting. Earlier surveys mostly highlighted productivity. In 2026, accuracy, risk control and the strategic allocation of working time move to the foreground. In a survey of 518 professionals and executives across 16 industries by the Commerce & Contract Management Institute, 79% expect a noticeable reduction in routine work and 76% expect faster drafting and review.

A gap between expectation and execution remains: two thirds of companies see concrete potential for AI in contract processes, but only one third has the corresponding tools in productive use (BearingPoint, 2025). For a broader look at where AI adds value in contract work, see AI in contract management: benefits and opportunities.

The real problem: tool fragmentation, not a knowledge gap

For the report, we spent months talking to General Counsels, Procurement leads, CFOs, COOs and Contract Managers across DACH and across industries. The picture matches the external studies but sharpens it: the root cause is rarely a lack of knowledge. It is a lack of system.

• 59% point to tool fragmentation and scattered file storage as their biggest daily bottleneck.
• 31% lose up to five hours every week just searching for the right contract document.
• 91% of the pain points named are operational in nature, not a legal problem.

“

The biggest problem in everyday contract work is not a legal problem. It is a systems problem.

Contracts move between SharePoint, Outlook, Word, DocuSign and Google Drive, and every handover loses context. Sales, Procurement, Finance and Legal end up negotiating the same contract in parallel Word versions and email ping-pong. The typical failure points are covered in 5 contract management challenges and how to fix them.

What is shadow AI?

Shadow AI is the use of AI tools by employees without their employer's knowledge, approval or oversight, typically through private accounts on public AI chatbots. It is the AI version of classic shadow IT: it appears wherever the demand for AI is greater than what the company officially provides.

How widespread is shadow AI in German companies?

Two independent surveys measure it from two directions:

• The company view: According to Bitkom (2026, more than 600 companies with 20 or more employees), 40% of companies assume employees use private AI tools at work, yet only 26% provide an officially approved way to access one.
• The employee view: In a survey of 1,000 office employees in Germany (ESCRIBA, 2026), 47.8% say they use AI tools at work without their employer's approval. Of those, 42.7% enter internal emails and 15.7% even enter strategic information.

Companies are, if anything, underestimating the scale. The gap between assumed use and approved access is exactly where shadow AI takes hold.

Why shadow AI is especially risky in contract and document management

Contracts and business documents hold some of a company's most sensitive data: pricing, terms, liability clauses, personnel agreements. When they end up in an unapproved AI tool, several risks arise at once:

• Data protection: If a contract contains personal data, there is usually no legal basis for the private AI tool and no data processing agreement (DPA) under Art. 28 GDPR.
• Trade secrets: Under the EU Trade Secrets Directive and Germany's Trade Secrets Act (GeschGehG), information is only protected if the company takes reasonable confidentiality measures. Uncontrolled AI use can weaken that protection.
• Confidentiality obligations: Many contracts and NDAs prohibit disclosure to third parties. An external AI service can be such a third party.
• No audit trail: Nobody can later show which clause was suggested by AI and who accepted it.

EU AI Act: what applies to contract work in 2026

The EU AI Act (Regulation (EU) 2024/1689) takes effect in stages. It has applied generally since August 2, 2026. However, the Digital Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026) postponed the obligations for high-risk AI systems under Annex III to December 2, 2027.

For contract work, this means:

• AI literacy is already mandatory. Since February 2025, companies must ensure that employees who use AI systems have a sufficient level of AI literacy (Art. 4). Shadow AI directly contradicts this, because nobody knows who uses which tool for what.
• Most contract AI use cases are not high-risk. Contract analysis, clause suggestions or deadline extraction generally do not fall under Annex III. That can change where AI influences decisions on hiring or creditworthiness, for example.
• Traceability is becoming the standard. Even without a high-risk classification, auditors, customers and regulators expect you to show who made an AI-assisted change to a contract, and when.
• Fines are tiered. Up to EUR 35 million or 7% of global annual turnover for prohibited practices, and up to EUR 15 million or 3% for breaches of other obligations, such as the high-risk requirements.

ISO/IEC 42001 offers a structured framework for AI governance. We explain what ISO 42001 certification means for contract software on a dedicated page.

Germany's BEG IV: more digital contracts mean more documents

At the same time, the volume of digitally executed contracts keeps growing. Under Germany's Fourth Bureaucracy Relief Act (BEG IV), text form has replaced written form in many areas since January 1, 2025, for example for the written statement of essential employment terms. Commercial lease agreements can also be concluded in text form, and since 2026 this applies to existing leases too. Details are in our article on the digital employment contract under BEG IV.

More digital contracts mean more documents, more versions and more opportunities to paste them into an unapproved AI tool. Without central storage and clear contract governance, the problem grows with every signature.

AI policy for companies: 4 recommendations from the study

The conversations and studies point to four recommendations for effective AI governance in contract management:

1. Create controlled access instead of banning tools. One vetted, approved tool beats any ban that gets worked around in daily practice anyway.
2. One shared environment instead of siloed tools. Otherwise Sales, Procurement, Finance and Legal end up negotiating the same contract in parallel Word versions and email threads, costing time, oversight and ultimately trust.
3. Build in accountability from day one. Logging, roles and documentation belong at the start of AI use, not tacked on at the end.
4. Think beyond the legal department. The biggest efficiency gains come from involving Sales and Procurement early in the contract cycle, not just at signature.

How AI analyzes and reviews contracts in practice, and what a rollout needs, is covered in our guide to AI contract analysis.

5 fixes you can start this week

Each finding in the report is paired with a first step that needs neither a budget nor a project:

1. Map your tools. Spend 15 minutes listing every place contract work actually happens today: SharePoint, Outlook, Word, DocuSign, Drive. That list alone makes the problem visible to the whole team.
2. Publish a one-page AI policy. State which tool is approved and what must never be entered into it, such as pricing or customer data. It closes the biggest gap without an IT project.
3. Measure the search. Time the next contract request, from the ask to the document being found. A single number is often enough to win internal priority.
4. Check your logging. Find out whether anyone currently records who made an AI-assisted change to a contract, and when. If not, that belongs at the top of the list.
5. Count the Word ping-pong. During your next three negotiations, count how often the contract is emailed back and forth as a Word file. That number usually explains the whole process.

Methodology and sources

The report combines our own qualitative research with published studies:

• top.legal, "State of Legal AI & Contract Collaboration · DACH 2026": our own conversations with General Counsels, Procurement leads, CFOs, COOs and Contract Managers across DACH and across industries.
• Docusign & Deloitte (2026): AI adoption, ROI and time savings in contract processes.
• Commerce & Contract Management Institute, "AI in Contracting 2026": 518 professionals and executives across 16 industries.
• BearingPoint (2025): potential and productive use of AI in contract processes.
• Bitkom (2026): more than 600 companies with 20 or more employees.
• ESCRIBA (2026): 1,000 office employees in Germany.
• Regulation (EU) 2024/1689 (EU AI Act) and Germany's Fourth Bureaucracy Relief Act (BEG IV).

Frequently asked questions

What is shadow AI?

Shadow AI is the use of AI tools by employees without their employer's approval or oversight, usually through private accounts on public AI services. It appears when the demand for AI is greater than what the company officially provides.

How many employees use shadow AI?

According to an ESCRIBA survey of 1,000 office employees in Germany (2026), 47.8% use AI tools without their employer's approval. According to Bitkom, 40% of companies assume private AI use, but only 26% offer an officially approved alternative.

Is shadow AI illegal?

There is no general legal ban. Shadow AI can, however, breach the GDPR, confidentiality agreements and internal policies, and weaken the legal protection of trade secrets. In addition, the EU AI Act has required companies to ensure their employees' AI literacy since February 2025.

Does the EU AI Act apply to AI in contract management?

Yes, but usually not through the high-risk obligations. Typical use cases such as contract analysis or clause suggestions are generally not high-risk systems under Annex III. What matters most is AI literacy (Art. 4), the transparency duties and traceable documentation of how AI is used.

What should a company AI policy include?

At a minimum: which AI tools are approved, which data must never be entered (such as pricing, customer and personnel data), who approves new tools, and how AI-assisted changes are logged. One page is enough to start.

How many companies use AI in contract management?

According to Docusign & Deloitte (2026), 84% of surveyed companies have already integrated AI into their contract processes. According to BearingPoint (2025), however, only around a third use approved tools productively.

Where can I download the report "AI in Everyday Contract Work & Document Management in DACH 2026"?

The four-page report is available for free on the report page. Once you enter your details, the PDF downloads right away.