Shadow AI Is a Demand Signal: What Leaders Should Do
Shadow AI often reveals where employees are finding value faster than official programmes can respond. Dr Jan van Niekerk outlines a 90-day path from hidden AI use to governed adoption.
Shadow AI, meaning employees using AI tools that IT never approved or doesn't know about, is already the norm in most organizations, not the exception, and it's happening at the top of the org chart as much as the bottom. A steering committee I sat with was 40 minutes into drafting a stricter Shadow AI policy when the CIO said the quiet part out loud: "You all know we're describing ourselves."
If you want the fuller picture of what Shadow AI actually looks like inside an organization, we've laid it out in our Shadow AI governance whitepaper.
Nobody disagreed. The meeting got more useful after that. It's a pattern we've seen before: employees using AI without approval almost always turns out to be widespread once anyone actually looks.
The numbers say that room is every room. 78% of AI users bring their own tools to work (Microsoft Work Trend Index, 2024). Meanwhile 49% of employees have hidden their AI use from a manager (WalkMe, 2025), and Ethan Mollick gave the hiders a name that stuck: secret cyborgs.
The standard corporate response is a policy document and a firewall rule. Here's why that fails, and the 90-day path that works instead.
Why bans fail, mechanically
Bans don't remove demand; they relocate it. When Samsung banned ChatGPT in 2023 after a source-code leak, usage didn't stop. It moved to personal devices, where the company had even less visibility than before. Substitution, not compliance, is the reliable outcome, and it comes with a bill. Breaches involving high levels of shadow AI cost an average of $670,000 more (IBM, 2025), and shadow AI detections are rising fourfold year on year (Verizon DBIR, 2026).
There's also an enforcement problem nobody likes saying plainly. The people who would enforce the ban are its heaviest violators. A rule the leadership breaks daily isn't a rule; it's décor.
Reframing Shadow AI as a Demand Signal
Read shadow AI as a demand signal and the whole picture reorganises. Your people have already found where AI creates value in their jobs, quietly redesigned their workflows around it, and are running the result on personal accounts. MIT's 2025 data made the scale plain. Roughly 90% of workers use personal AI tools daily, against about 40% of companies with official subscriptions.
That's not a compliance crisis. That's the most detailed, most honest requirements document your AI programme will ever receive. It's just written in browser histories instead of workshops.
The 90-day path you should look at
Days 1 to 30: amnesty and inventory. Announce a no-consequences window. Tell us what you actually use and what for. The goal is a map, not a confession booth. Pair it with data tiers on a single page. Green data (public, low risk) goes anywhere; amber needs an approved tool; red never leaves governed systems. One page. If your classification needs a workshop to explain, it will be ignored.
Days 31 to 60: the fast lane. Stand up an approved-tool route with a real service commitment. Requests answered in days, not quarters. Cover the top 5 use cases the amnesty surfaced. This is the same principle behind adopting AI without disrupting operations: the sanctioned path only wins if it's faster than the workaround.
Days 61 to 90: make it stick. Start the tool registry (owner, outcome, sunset date, per tool). Instrument usage of the approved stack so you can see adoption move. Flip the incentive. Publicly credit the first team that discloses a clever unsanctioned workflow and helps migrate it. Reward disclosure and you'll get more of it; punish it and you'll get 49% hiding again by Christmas.
The honest edge
Amnesty is not absolution. Some data can never touch a personal tool, and if the inventory surfaces genuine exfiltration of red-tier data, that's an incident, not an amnesty item. The tiers are what make the generosity safe. Governance without teeth is theatre; teeth without a fast lane is just a slower way to fail.
FAQs
What is Shadow AI?
Shadow AI is employees using AI tools that IT hasn't approved or doesn't know about, usually because those tools solve a real problem faster than the official options do.
Why do bans on unsanctioned AI tools fail?
Bans don't remove the demand, they relocate it, often onto personal devices where IT has even less visibility. That's what happened when Samsung banned ChatGPT in 2023.
What does the 90-day governance plan involve?
Three phases: 30 days of no-consequences amnesty and inventory, 30 days building a fast approved-tool route, and 30 days making it stick with a tool registry and usage tracking.
Does amnesty mean no consequences for past AI use?
Amnesty covers disclosure, not a blanket pass. If the inventory turns up an actual exposure of sensitive data, that's treated as a security incident, not an amnesty item.
Conclusion
One more honest note. I don't know a reliable way to reach the last few percent who'll hide usage no matter what. I've stopped designing for them. Design for the 90% who'd happily use the sanctioned path if it were good.
The Monday move fits in three sentences at your next town hall: "We know most of you use AI tools we haven't approved. For the next 30 days, we just want to know what and why, no consequences. Then we'll build you a faster legal way to do the same thing."
Say that, mean it, and you'll learn more about your organisation's AI readiness in a month than any maturity assessment will tell you. If your team needs a faster, sanctioned way to run AI today, that's exactly what our Secure AI platform is built for.
