A senior employee is preparing a proposal for an important client.

The deadline is short, the material is extensive and leadership has repeatedly encouraged teams to use AI to improve productivity. The organisation has not yet approved a standard tool or issued practical guidance about which information can be used. The employee opens a publicly available AI application and enters sections of the client material. Within minutes, the system produces a strong first draft. The employee revises it, verifies several points and submits the proposal on time.

The result is praised. Nobody asks how it was produced.

Several weeks later, an inaccurate AI-generated statement appears in another document. A review begins and leadership discovers that employees across several functions are using different tools for research, analysis, meeting notes, recruitment and customer communication.

• Some are processing commercially sensitive information.
• The executive team is alarmed.
• Employees are reminded that unapproved AI use is prohibited and may result in disciplinary action.
• The organisation describes the problem as irresponsible employee behaviour.
• The employees describe a different reality.
• They were asked to become faster, saw tools capable of helping and were given neither an approved route nor a safe place to discuss how they were already working.
• The AI use was hidden.
• The leadership contradiction was visible.

Shadow AI Is a Leadership Signal

Shadow AI refers to the use of artificial intelligence tools outside the organisation’s approved technology, governance or oversight arrangements. It creates real risks. Sensitive information may enter systems the organisation has not evaluated. Outputs can be inaccurate, biased or impossible to trace. Employees may rely on generated material without sufficient review.

These concerns require serious governance. But treating shadow AI only as a compliance problem misses what its presence reveals. Employees use unapproved tools because the tools solve a practical problem. They reduce administrative work, accelerate analysis or help people meet expectations that have increased without equivalent increases in time or resources.

When official systems remain slow and policies remain vague, informal adoption becomes likely.

• The organisation should ask not only, “Why did employees break the rule?”
• It should also ask, “What organisational need did leadership leave unresolved?”

Shadow AI is evidence that adoption is already occurring beyond the pace at which leadership has learnt to govern it.

Ambiguous Encouragement Creates Hidden Behaviour

Many executives communicate two messages simultaneously.

The first is aspirational:

“We need to embrace AI.”

“We expect every function to identify productivity opportunities.”

“Competitors are moving quickly, and we cannot be left behind.”

The second is cautionary:

“Do not expose confidential information.”

“Only approved systems may be used.”

“Employees remain fully accountable for every output.”

Each message is reasonable.

The problem is that leadership frequently provides no practical bridge between them.

• Which tools are approved?
• What data may be entered?
• Can AI be used to summarise internal documents?
• Must its contribution be disclosed?
• Who approves a new use case?
• How quickly will that approval occur?

Without clear answers, employees interpret the boundaries themselves. Some become excessively cautious and gain no value from AI. Others experiment privately and hide the method because they are uncertain whether leadership will approve.

The organisation creates unequal adoption, inconsistent risk and very little visibility. A policy that tells employees to innovate responsibly without defining what responsibility means is not governance. It is delegated ambiguity.

Prohibition Does Not Eliminate Use

A blanket ban may appear to be the safest response while governance is still developing. It gives legal, technology and risk teams time to assess exposure and prevents the organisation from appearing careless. But prohibition is effective only when it reflects operational reality.

If employees have easy access to AI tools, face growing performance demands and can use those tools without immediate detection, some will continue. The behaviour simply becomes less visible. This is particularly likely when employees believe the output will be judged but the method will not be discussed. If AI helps someone produce better work faster, disclosure may seem to create risk without providing any benefit.

The organisation then loses the opportunity to understand how the technology is being used. It cannot identify valuable applications, improve controls or intervene before unsafe practices become normal. Strict rules may still be necessary for specific data, decisions and functions. The distinction is between targeted prohibition and organisational denial.

Governance that cannot be followed in practice does not reduce risk. It hides the risk from the people responsible for managing it.

Fear Prevents Early Disclosure

AI use will sometimes create mistakes. An employee may enter inappropriate data, rely on an inaccurate result or use a tool in a way the organisation did not anticipate. The speed with which the issue is reported will influence the eventual consequence.

If disclosure is likely to produce automatic punishment, employees will first try to resolve the problem privately. Records may be deleted, the use may be minimised and the organisation may learn only when the impact becomes visible elsewhere. This repeats a familiar leadership failure. The desire to demonstrate zero tolerance makes early truth more dangerous.

A responsible system should distinguish between:

• Deliberate misuse.
• Reckless disregard of clear rules.
• A reasonable mistake within an approved experiment.
• Behaviour caused by unclear guidance.
• Early disclosure that allows risk to be contained.
• Concealment that increases the eventual exposure.

Accountability still matters. But the response should not teach everyone that reporting an AI-related concern is more dangerous than keeping it hidden.

Governance Must Enable Responsible Use

Effective AI governance is not simply a list of prohibited activities. It gives employees a credible way to use the technology safely.

At minimum, people need to understand:

• Which tools are approved.
• Which categories of data may and may not be used.
• Which tasks require human review.
• Where AI-generated material must be disclosed.
• Which decisions cannot be delegated to an AI-supported process.
• Who remains accountable for the final outcome.
• How a new use case can be proposed and evaluated.
• Where employees can report a mistake or concern.
• What records must be maintained.
• How customers, employees and other stakeholders will be protected.

The rules should be specific enough to guide ordinary work. A policy understood only by legal, risk or technology specialists will not govern everyday behaviour. Employees need examples relevant to their roles and a rapid route for resolving uncertainty.

If approval takes several months while business expectations continue increasing, informal experimentation will move faster than the governance process. Speed is therefore part of responsible governance.

Leaders Need Visibility Into Real Use Cases

Boards and executive teams often begin AI governance with technology selection and risk frameworks. They should also examine how work is actually being performed.

Employees may already be using AI to:

• Draft internal and external communication.
• Summarise meetings and documents.
• Analyse customer or employee information.
• Develop code.
• Screen candidates.
• Prepare performance feedback.
• Create forecasts and scenarios.
• Translate confidential content.
• Support commercial or operational decisions.

Each use creates a different level and type of risk. Leadership cannot govern this environment through assumptions. It needs a realistic inventory of current and proposed use cases, including activity employees may be reluctant to disclose.

This requires creating temporary safety for truth. A confidential discovery process can ask teams what they are using, what value it creates and where they remain uncertain. The immediate objective should be understanding and risk containment, not searching for people to punish.

If the organisation begins with blame, it will receive incomplete data about its own exposure.

Human Review Must Be More Than a Disclaimer

Most AI policies state that people remain responsible for reviewing outputs. That principle is necessary but insufficient. Review quality depends on expertise, time and the nature of the task. An employee cannot reliably identify a plausible inaccuracy if they lack independent knowledge of the subject. A manager may approve an AI-supported analysis without understanding how the underlying conclusion was produced.

The phrase “human in the loop” can therefore create false reassurance. Leadership should define what meaningful human review requires.

• Does the reviewer have relevant expertise?
• Can the source information be checked?
• Is the reasoning traceable?
• What level of uncertainty is acceptable?
• Could bias affect a person’s employment, access or treatment?
• What happens when the AI recommendation conflicts with professional judgement?

Human involvement creates accountability only when the human has enough capability and authority to challenge the system. Otherwise, the person becomes the final signature on a decision technology has already shaped.

Leaders Must Model the Transparency They Expect

Senior executives also use AI. They may prepare speeches, summarise documents, develop scenarios or refine strategic communication. This use can be entirely appropriate. But leaders cannot demand transparency from employees while treating their own AI use as private or inconsequential. Executive behaviour establishes the norm.

If leaders disclose how AI supports their work, explain where they verify output and acknowledge limitations, employees receive a model for responsible use.

If senior people present AI-assisted work as entirely their own while introducing strict disclosure rules below, the governance system loses credibility.

The same principle should apply across levels: the greater the consequence of the work, the stronger the expectation for transparency, verification and accountability. AI governance should not become another system in which powerful people retain discretion while everyone else receives rules.

Create Safe Routes for Experimentation

Organisations need structured environments in which employees can test AI without exposing customers, confidential information or critical decisions.

A safe experimentation model may include:

• Approved tools with appropriate data protections.
• Synthetic or non-sensitive information.
• Clearly bounded pilot projects.
• Named business and risk owners.
• Defined success and failure criteria.
• Human review requirements.
• A process for documenting lessons and unintended effects.
• Rapid escalation when a concern appears.
• A decision about whether the use case should stop, change or scale.

This approach treats experimentation as organisational learning rather than private initiative. It also makes responsible behaviour easier than hidden behaviour. Governance becomes credible when the approved route is practical enough that employees have little reason to bypass it.

Questions Leadership Should Ask

Boards and executive teams should consider:

• Where are employees already using AI, whether approved or not?
• Which performance expectations make hidden use more likely?
• Are our rules specific enough for ordinary decisions?
• How long does it take to approve a legitimate use case?
• What data would employees be afraid to disclose about current practice?
• Does our response to mistakes encourage early reporting?
• Which AI-supported decisions carry the greatest human consequence?
• Do reviewers have enough expertise to challenge the output?
• Are leaders following the same transparency standards expected from employees?
• Is our governance helping responsible adoption, or merely protecting leadership from visible risk?

These questions move the conversation from policy compliance to leadership responsibility.

Govern the Reality, Not the Presentation

AI adoption will not wait for every organisation to become comfortable. Employees will experiment because the technology is accessible and because it helps them meet real demands. Some uses will create value. Others will create risks the organisation has not yet understood. Leadership has a choice. It can govern the behaviour that already exists by making it visible, discussable and accountable. Or it can publish strict rules, maintain the appearance of control and allow adoption to continue underground.

Shadow AI becomes dangerous not only because employees use unapproved tools. It becomes dangerous because the organisation has no honest view of how deeply those tools have entered the work.

• If employees must hide responsible experimentation, governance is too restrictive to be useful.
• If they can hide reckless use, governance is too weak to be credible.

Strong AI leadership creates a system in which people can tell the truth about how technology is being used before that truth arrives as an incident.