Skip to content
Back to insights

AI

Your company is already using AI. Do you know where?

An AI chat assistant open on a phone next to a laptop

Ask most leadership teams “where are we using AI?” and you’ll get a short list: a chatbot pilot, maybe a recommendation feature, perhaps a data science initiative. Ask the people actually doing the work, and the list gets a lot longer, and a lot less official.

Adoption doesn’t wait for a project

AI tools reached individual employees before they reached IT procurement. A marketer drafting copy in a chat tool. A developer pasting code into an assistant for a second opinion. An analyst summarizing a client document in a browser extension nobody asked to install. None of this shows up in a project roadmap, because none of it was sanctioned as a project. It was just someone trying to get their work done faster.

This is normal, and it isn’t a failure of policy. It’s what happens when a technology’s individual utility is obvious and its individual risk is invisible. Nobody weighing “should I summarize this in a free AI tool” is thinking about data residency or model training terms. They’re thinking about the meeting in ten minutes.

Why “shadow AI” is the wrong problem to focus on first

The instinct is to treat this as a security problem to shut down. That’s usually the wrong first move. Blocking tools without offering an alternative doesn’t stop the behavior, it just pushes it somewhere less visible: a personal device, a personal account, a browser in incognito mode. Now you have the same risk with less visibility than before.

The more useful frame: this isn’t a compliance violation to punish, it’s a signal to read. If people across the organization are independently reaching for the same category of tool, that’s real evidence of where AI could create value, and evidence you didn’t have to commission a study to get.

Making adoption visible instead of invisible

A more workable sequence looks like this:

  1. Find out what’s actually being used. A short, low-pressure survey usually surfaces more than a technical audit alone, because people will tell you what they’re doing if the question isn’t framed as an investigation.
  2. Look at what’s already being paid for. Expense reports and SaaS subscription data often reveal tools nobody centrally approved but plenty of people are using.
  3. Decide what to formalize. Some of what surfaces should become an approved, governed tool. Some should be replaced with a safer equivalent. Very little needs to be banned outright.
  4. Set the boundary once, clearly. What data can and can’t go into an external AI tool is a policy people can actually follow, unlike a vague instruction to “be careful with AI.”

The goal isn’t to eliminate the behavior that got you here. It’s to bring it into a place where it can be supported, secured, and, where it’s actually working, invested in properly.