This week I demoed AI to a room of business owners. The questions afterwards weren’t about features or clever prompts. They were about control. The one that kept coming back, in different words each time: “How do I know what my team is doing with this?”
The honest answer is that most owners don’t. And two numbers explain why.
According to Gartner, 69% of organisations suspect or have confirmed that employees are using AI tools the business has prohibited. Only 37% have an AI governance policy in place at all. That gap, between what leadership believes is happening and what is actually happening, has a name now. The industry calls it shadow AI, and it is quietly becoming the biggest unmanaged risk in ordinary businesses.
How the ban backfires
When AI tools first landed in the workplace, plenty of businesses did the sensible-sounding thing. They told staff not to use them. Some wrote it into policy. Most delivered it as a corridor instruction: not on client work, not until we’ve looked into it.
The trouble is that a ban doesn’t stop the using. It stops the telling.
Your people are not trying to cause a data breach. They are trying to hit Friday’s deadline, and a free AI tool gets the report drafted in twenty minutes instead of two hours. So the client information goes into a personal account, on a free tier, with no audit trail and no data agreement. Then they keep quiet about it, because the official answer is “don’t”.
Look at what that chain actually produces. The riskiest possible version of AI use: unvetted tools, sensitive data, zero visibility. And the business created it by providing a rule without providing a route.
Shadow AI is a demand signal
Here is the reframe worth sitting with. Staff using AI behind your back are not a discipline problem. They are a demand signal.
Your team has already run the pilot you were nervous about commissioning. They have found the tasks where AI saves them time, tested it on real work, and voted with their behaviour. The initiative you want from your people is already there. The only part that failed is the channel it flows through, and that part belongs to leadership, not to staff.
That is uncomfortable, but it is also good news. It means the hardest part of AI adoption, getting people to actually want to use it, has solved itself. What remains is a management job.
Four steps to bring it into the open
Ask, with amnesty. One honest question to your team, with no punishment attached: “What are you already using, and what for?” You will not get honest answers if the question smells like an investigation. You need the map more than you need the enforcement.
Approve a route. Give people a sanctioned way to do the things they are already doing. That might be paid business accounts of the tools they have adopted, with proper data terms. It might be an assistant grounded in your own approved content, so answers come from your policies and documents rather than the open internet. Either way, the test is simple: is the official route as convenient as the secret one? If not, the secret one wins.
Train everyone to the same baseline. Two enthusiasts on ChatGPT and forty people guessing is how mistakes happen. The risk isn’t the person who uses AI daily. It is the person who uses it once a month, without knowing what it gets wrong. A shared foundation, what these tools are, what they are good at, what never goes into them, turns a scattered risk into a capability.
Review what the questions tell you. Once use is in the open, the questions people ask become management information. If half the team is asking AI how to handle a certain customer situation, that is a gap in your documentation or your training, found for free.
“We’re not ready yet”
The most common objection I hear is some version of not being ready. The uncomfortable reply is that readiness stopped being available some time ago. Your team already started. The choice left is not whether AI enters the business. It is whether it enters through the front door, with your data protected and your standards attached, or through the side door it is using now.
The second objection is the bubble question: what if this is all overhyped? Some of the market probably is. But client data sitting in free consumer tools is not a someday problem that deflates with the hype. It is a today problem, and it exists whether or not the AI industry corrects.
The businesses pulling ahead on this are not the ones with the strictest policies. They are the ones where nobody needs to hide.
Ask the question this week. Start with amnesty, and see what your map looks like.
Next steps
Most boards are living with two fears at once: falling behind on AI, and getting it wrong.
Our is six one-hour sessions that replace both with decisions the board can stand behind.