Shadow AI is bigger than you think

Why unsanctioned AI is not a discipline problem, and what to become instead.

Ask most leaders about their AI strategy and you will hear about the rollout they are planning. Ask their teams what they did this morning and you will find the rollout already happened, quietly, without them.

This usually gets filed under risk, the thing security warns you about. It is a risk. It is also the most honest map you will get of where AI creates value in your business. Both are true, and how you hold them decides what you get.

What shadow AI actually is now

The old idea of shadow IT was bounded: a list of unsanctioned apps for IT to find and switch off. AI broke that frame in three ways at once.

First, adoption already happened, bottom up. Your people did not wait for a program. Useful tools were one tab away, so they used them.

Second, consumption became creation. AI did not just give people new tools to use, it let them build: their own assistants, agents, automations, and small apps, at every level of polish. The shadow is no longer only what they run. It is what they make.

Third, capability outran awareness. The person building a handy assistant or pasting a document into a chatbot is mostly not thinking about data, IP, or risk, and often the policy is missing or buried. They are empowered, not reckless.

Do you actually know how your people use AI today, and where on the range from a quick chat to a home-built app they sit?

Put those together and you get a fast-growing, largely invisible spectrum of use, from a chatbot sidekick to a homemade app wired into a real process. Those are not the same risk, or the same opportunity, and most leaders cannot see which is which.

Why the crackdown fails

The instinct is to treat this as a discipline problem: find it, block it, enforce the policy. It does not work, for three reasons.

You cannot police what you cannot see. You cannot enforce a policy people do not know. And a blanket ban does not remove the behavior, it moves it onto personal devices and accounts, where you have even less visibility and no way to help.

Treating unsanctioned AI as rule-breaking punishes people for being resourceful, and blinds you to your own best signal.

To be clear, this is not anything goes. Some tools and some data genuinely must be blocked, and in regulated or sensitive contexts prohibition is the right default. That is real governance and it stays. But it is the exception, not the whole strategy.

What you become

So the real question is not how to stamp it out. It is what your leadership and IT function become in response. There are three options, and only one of them works.

You can be the police: control everything, block by default, chase down the rule-breakers. You will lose the trust and the signal, and the usage will go underground.

You can be the order taker: wave everything through, stand up whatever anyone asks for, add no judgment. You will trade one kind of risk for another and never shape the demand into value.

Or you can be the trusted partner: see what people are doing, bring judgment about what is worth building and what is safe, and help them get there. Neither a gate nor a vending machine.

The partner is the only posture that captures the value and holds the risk at the same time.

What a partner actually does

In practice it is not complicated to start.

See it. Run a short, blame-free survey of how people actually use and build with AI. Blame-free is the whole game; the moment it feels like a hunt, the honest answers stop.

Make it legible. Give people a clear, human AI policy and the basics of what is safe, so awareness stops being the gap.

Pave a road. Sanction good tools and give people a safe, guarded way to build, so the easy path is also the safe one.

Read the signal. Treat what people already reach for as your map of where AI is worth investing. They have done the discovery for you.

I watched a team do exactly this recently. Faced with unsanctioned use, they did not reach for a ban. They surveyed what was actually happening, set sensible exceptions, and started building real AI literacy across the organization. The point was not to catch anyone. It was to see clearly, and then lead.

Key takeaways

• AI adoption already happened bottom up; it is a present reality, not a future decision.
• Shadow IT got much bigger because AI turned consumption into creation: people build now, not just use.
• Unsanctioned use is mostly an awareness gap, not defiance, so crackdowns backfire and drive it out of sight.
• Some tools and data must still be blocked; that is real governance, not the whole strategy.
• The winning posture is the trusted partner, not the police and not the order taker: see it, make it legible, pave a safe road, and read the demand as signal.

If your instinct with shadow AI has been to lock it down, it is worth asking a different question first: do we even know what our people are doing, and what do we want to become in response? If that is live for you, I am glad to compare notes.

About Arqvera

Arqvera is an AI and technology transformation consultancy and advisory. We help organisations shape business cases, projects, deliver excellence, and realise change and outcomes that stick. We support organisations before, during, and after projects with an end-to-end service where our domain specialisation comes to life.

Before (Inception): We work with you to clearly define the idea, vision, strategy, and business case for change, as well as help select the right partners and establish governance.

During (Execution): We help deliver the project and change objectives while keeping implementation under control through structured governance and assurance to realise intended outcomes.

After (Value Realisation): We ensure outcomes deliver measurable value and embed continuous improvement from successes and learnings.

Arqvera is led by industry veterans in the UK and USA with 100+ years of technology delivery intelligence across global consulting, digital transformation, and mission-critical projects and programmes.