Your Staff Are Already Using AI. The Question Is Whether You Know What They're Doing With It.

When you accept that AI use is already happening, the first instinct is to write a policy. Don't paste customer data into public tools. Don't upload contracts. Sanitise before you send. These are reasonable rules, and you should write them. But the policy itself is the easy part, and it's not the part that matters most.

What matters is what you discover while writing it. You discover that nobody has a clean answer to the question "where does our customer data actually live?" You discover that there are folders on your shared drive that haven't been touched in four years and that nobody is sure who owns. You discover that the boundary between "internal" and "confidential" was never really defined — it was just understood. You discover that half of what people are pasting into AI tools is data they shouldn't have had quite such easy access to in the first place.

This is the real value of taking shadow AI seriously. It is a forcing function. It surfaces a generation of accumulated information mess that the business has been able to ignore because nothing was reaching into it at the speed an AI does. Suddenly, the question of who has access to what — and whether that file is current, draft, or abandoned — becomes urgent in a way it wasn't before.

The reflex, once leadership accepts that AI is in the building, is to centralise it. Form an AI committee. Pick a tool. Lock down everything else. Channel all use through a sanctioned platform with the right guardrails.

I understand the instinct, and there is a small piece of it that's correct — you do need a single sanctioned tool with proper data handling, and you do need to make it the easy default. But the broader move toward centralisation is almost always the wrong one, because it doesn't actually solve the underlying problem. People didn't start using shadow AI because they wanted to break rules. They started using it because the work in front of them was tedious and the tool was right there. If your sanctioned alternative is harder to access, slower, or limited to certain departments, the shadow use simply continues.

The counterintuitive answer is that you have to make the sanctioned tool more available than the unsanctioned one. Every department, every role, every level. Not because everyone needs AI for their job today, but because the moment someone needs it and your tool isn't easier than the free alternative, you've lost them.

You will not find these from the top. You find them by giving access broadly and watching what people build.

In every business I've worked with, the people who turn out to be most useful in shaping AI adoption are not the ones leadership would have predicted. They are rarely the most senior people in their department, and they are almost never the IT team. They tend to be mid-career operators who are fluent in the actual texture of their work and impatient enough with its inefficiencies to experiment.

These people exist in your business already. They are probably already the shadow AI users. The shift, once you've accepted the reality of what's happening, is to stop treating them as a compliance problem and start treating them as the natural seed of your adoption strategy. Bring them into the conversation. Let them show colleagues what they've figured out. Let them tell you which workflows are obviously broken and which are quietly fine.

By the time you've worked through the data hygiene, the access patterns, the unexpected champions and the reality of distributed adoption, you start to notice that you've been dealing with management problems — not technology ones. Process clarity. Decision rights. Accountability for outcomes. Honesty about what work is and isn't being done well today. These are the things that determine whether AI lands cleanly or makes a mess.

The model itself is the cheapest, fastest-changing, most replaceable part of the entire equation. Whatever tool you pick will be obsolete within a year. The organisational changes you make in process — the data you cleaned up, the access you rationalised, the conversations you had about what tasks should and shouldn't be automated, the trust you built or didn't build with anxious staff — those will outlast every model upgrade.

Whether your business benefits from any of it depends almost entirely on the unsexy work of getting your own house in order.