Insights / Perspective / AI governance, risk and compliance
PerspectiveShadow AI is the first governance problem
Staff adopt AI tools faster than policies appear. Without guidance, sensitive data can leave the organisation unnoticed, so start by finding out what is already in use.
Ask a leadership team how their organisation uses AI, and they will usually describe one or two approved pilots. Ask the people who do the work, and the answer is different. Sales staff draft emails in a free chatbot. Analysts paste spreadsheets into an online tool to get a summary. A marketing team pays for an image generator on a personal card.
Staff adopt AI tools faster than policies appear. Without guidance, sensitive data can leave unnoticed. Our view is that this shadow AI, not some future autonomous system, is the first governance problem most organisations face. It is also a useful one, because it shows exactly where people see value.
Why it happens
Shadow AI is not a sign of a careless workforce. It happens because the tools are easy to reach, cheap or free, and genuinely helpful for everyday tasks. When the organisation offers nothing, or offers something slower and more awkward, people find their own way.
The risks are real. Confidential documents, customer details or pricing may be entered into services whose terms allow the provider to retain or reuse them. Output may be used without checking. And because nobody knows which tools are in use, nobody can respond when one has a security problem or changes its terms.
Find it
Ask teams what they use and why. The most effective discovery method is a conversation, not surveillance. A short, non-judgemental survey or a series of team discussions will reveal most of what is happening, provided people believe they will not be punished for honesty.
- Which AI tools do you use for work, including free ones?
- What tasks do you use them for, and how often?
- What kind of information do you put into them?
- What would you lose if you could no longer use them?
Technical sources help fill in the picture. Expense claims and card statements show paid subscriptions. Network and browser data can show which AI services are visited most. Use these to confirm what people tell you, not as a substitute for asking.
Provide alternatives
Offer approved tools that meet the same need. Telling people to stop using something useful, without offering a replacement, rarely works. They will either ignore the instruction or comply and lose productivity, and neither outcome helps the organisation.
The discovery work tells you what the alternatives need to do. If most use is drafting and summarising, a business-grade assistant with appropriate data terms may cover it. If a particular team relies on a specialist tool, assess that tool and approve it with conditions, or find an equivalent. Speed matters: an approved option available next month is worth more than a perfect one next year.
Once we gave people a sanctioned assistant that was as easy as the free one, the shadow use mostly disappeared on its own.
Head of IT, professional services firm
Approval need not mean a long procurement process. For lower-risk tools, a short checklist covering data terms, security basics and who will own the relationship is often enough. Reserve fuller assessment for tools that will handle personal data, customer information or anything critical to operations.
Explain the rules
People follow rules they understand. A rule that says ‘do not enter confidential data into unapproved AI tools’ is easy to agree with and easy to misapply. Explain what confidential means in practice, why it matters and what to do instead.
Short examples work best: a customer list, a draft contract, unreleased financial results, an employee’s performance notes. Show the approved route for each task. Repeat the message in team meetings rather than relying on a single announcement.
Keeping it under control
Discovery is not a one-off exercise. New AI tools appear every month, and existing tools add AI features without much announcement. A note-taking app, a design tool or a customer platform may start sending content to an AI service after an update. What was approved last year may need a second look.
- Repeat the survey or team conversations every six months.
- Ask suppliers to tell you when they add AI features that process your data.
- Give people a simple, quick route to request a new tool, with an answer within days.
- Publish the list of approved tools where everyone can find it, and keep it current.
The quick route matters more than it seems. When requesting a tool takes weeks and approval feels unlikely, people stop asking. When it takes a short form and a few days, most will ask first, and the organisation stays aware of what is in use.
Shadow AI as a signal
It is tempting to treat every unapproved tool as a breach. A more useful view is that shadow AI is a map of demand. It shows which tasks people want help with, which teams are most eager and where the approved toolset falls short. Organisations that study it often find their best first AI use cases already in progress, just without safeguards.
In other words, the people already using AI without permission are often the ones best placed to help design the approved approach. Involve them rather than sidelining them.
Start with a two-week discovery exercise: a short survey, a few team conversations and a look at expense data. You will come out of it with a list of tools to approve, replace or stop, and a clear sense of where AI is already helping your people.
Source: Intelliversal analysis.
