Shadow AI: Your Staff Already Wrote Your AI Strategy
Most conversations about an AI governance framework start in the wrong place: a policy document, a committee, a list of approved tools. Meanwhile the real strategy is already running - written by your employees, quietly, on free tools, with your data.
The numbers aren't subtle. BlackFog's November 2025 survey of 2,000 employees at UK and US companies with more than 500 staff found that 49% have used AI tools their employer hadn't sanctioned, and 51% have connected AI tools to other work systems without IT approval or oversight. And the group most willing to accept the risk? The executives who signed the policy. In the same research, 69% of respondents at President or C-level and 66% at Director or Senior VP level believe speed trumps privacy or security, against just 37% in administrative roles.
This is "shadow AI," and banning it doesn't make it disappear. It pushes it somewhere you can't see - which is exactly where a data leak likes to begin.
Governance isn't permission. It's catching up.
The instinct, when leaders discover shadow AI, is to clamp down. But prohibition just drives it underground and adds the small thrill of breaking a rule. A governance framework that works starts from a different premise: this is already happening, so the job is to make it safe and visible, not to pretend it away.
In practice that means a short list of sanctioned tools good enough that people want to use them, clear and human guidance on what data can and can't go into them, and a way to bring new tools into the light rather than punishing the people who found them first.
The framework people will use
In our view the governance frameworks that survive contact with a workforce share three traits: they're specific (not "be careful"), they're enabling (here's what you can do), and they're alive (updated as fast as the tools change). If your policy is a PDF nobody has opened since last year, that isn't governance - it's theater.
The uncomfortable truth is that your people are voting with their browser tabs every day. The question isn't whether to have an AI strategy. You already have one. The question is whether you'll find out what it is, and shape it, before it shapes you.
Turning the shadow version into a real, people-first AI strategy is the work we do.
Take it with you
Download this as a PDF
A clean, branded version to read offline or share with your team.
With People
Every Tuesday: the people side of making AI pay.
- One story from the week's news about AI at work, read through our book, The Elephant in the Algorithm.
- A few links worth your time, and most weeks a podcast conversation.
Related reading
- What to Ask an AI Consulting Partner Before You Sign
A practical diligence list for buying AI consulting: what you are really purchasing, the questions that expose a weak…
- AI Saved Your Team Hours. Where Did You Send Them?
AI frees up hours, then work expands to fill them and nothing reaches the P&L. Reinvestment is a leadership decision,…
- Why AI Training Finishes and Behavior Stays the Same
Completion rates are high and the work looks identical. The reason is that AI training teaches the tool, while the jo…