We’ve seen this movie before. It was called Shadow IT.
Fifteen years ago the panic was Dropbox and personal Gmail. Employees were moving company files through tools nobody sanctioned, and security teams reached for the same playbook every time: write a policy, block the app, track who acknowledged the rule. It didn’t work. People don’t route around a sanctioned tool because they’re reckless. They route around it because the free one is better.
Shadow AI is that same wave at machine speed. This piece gets the diagnosis right… employees skip the company tool because we haven’t made it worth switching to. That’s the honest part, and it’s the part most vendors won’t say out loud.
Where it drifts is the fix. Leading with written policies and acknowledgment tracking is Shadow IT’s failed answer in new clothes. If four in five people already use AI and all you measure is how many signed the policy, you’re measuring the signature, not the behavior. That’s a rubber stamp, not a control, right?
Both things are true. You do need governance… an inventory, an acceptable-use standard, a real audit trail. And none of it holds if the sanctioned tool is worse than the one a click away.
Monday morning: pick the single workflow where your people keep reaching for the outside tool. Ask why yours loses there. Fix that one gap before you write another policy.
Originally posted on LinkedIn.
RationalAI helps organizations turn ideas like this into results: AI strategy and advisory services. Previous article: The Guardrails Bound the Defenders, Not the Attacker
