Governing Shadow AI

Leadership invites people to say which AI tools they actually use. The reports arrive, and nobody was funded to answer them. So the reports wait, and the people who sent them learn not to send another.

What shadow AI is

Shadow AI is AI use outside an organization’s visibility or authorization. It shows up in three conditions. Some use is already permitted and only needs recording. Some use involves unapproved data access or actions, even inside an approved application, and needs an authorization decision. Some use leaves the recipient of an output without information they need about AI’s role.

Each condition needs a different response from different people. So an invitation to disclose creates work, and someone has to do it.

This page proposes a funded AI governance response team, with a clear reporting route and a named owner for each case. That owner brings in the right authorities and follows the work to an authorized route or an explicit change in what must be delivered. Those authorities keep their decisions.

One case, from workaround to decision

In this constructed case, a customer cannot export reports from a software product. Troubleshooting has failed, so a support employee summarizes the ticket for a technical specialist: what went wrong and which fixes already failed. But the company’s authorized AI assistant cannot reach the ticket records, so the employee pastes ticket details into a personal AI account. Company authorization does not cover that use.

The employee tells their manager, who stops further use of the account for ticket data and calls the incident response lead. That lead coordinates the response to possible exposure, assessing what was sent, what the provider may keep, and which delivered summaries and decisions are affected. None of that waits for the response team or a work decision.

The manager also takes the unfinished work to the response team. The team’s case owner brings in the support leader, who is the business leader accountable for the support service. The support leader sets a safe temporary way to work or changes the service commitment. The case owner records that decision and coordinates the search for an authorized replacement. That search can start once the transfers to the personal account have stopped and the temporary arrangement is in place. The exposure assessment has to be under way, not finished.

The specialist is the summary’s recipient. The customer is whoever needs the export to work. If the summary leaves out a failed fix, such as reinstalling, the specialist may recommend it again and cost the customer time. So faster summaries alone do not establish less total support work or quicker resolution.

The case owner records what decision-makers need to judge whether the work is needed and what an adequate replacement must provide: the output, its recipient, what it contributes for the customer and where the authorized method falls short.

Fund the response

Every step in that case took someone’s time. Someone has to pay for it.

Give the response team a named executive sponsor, an explicit operating budget and assigned staff. It can start small or sit inside an existing function, but it cannot run entirely on spare time, because spare-time work waits. Its job is coordination, not adversarial testing of AI systems.

The sponsor also secures dependable access to security, privacy, legal, procurement, technology and business specialists. Agree how quickly each will respond and when each will give updates, name substitutes, and send missed commitments to the sponsor. Without committed specialists, a coordinator leaves the same queue behind a new front door.

Publish a contact route that says where to report, what to include and what to do about an immediate concern. Employees can report directly, without their manager’s permission. Direct reporting isn’t secrecy: information goes to the people who need it, which can include the manager responsible for the work decision.

The response team is responsible for each report until the team assigns a case owner. The case owner then stays responsible until the work has a usable resolution. That means identifying the decisions needed, bringing in specialists, keeping the shared case record, updating the person who reported and escalating whatever is stuck. Owning a case gives no power to waive controls, direct incident response or commit business funds.

The budget makes the team’s direct cost and capacity visible. Skipping it hides the cost without removing it: scattered coordination across managers and specialists, duplicated effort, inconsistent decisions, costly delays and continued pressure for unauthorized use. A funded team may cost less overall, but its budget doesn’t prove that. Test the claim against your current arrangement.

Prepare before you invite reports

Some reports cannot wait for intake: sensitive information sent through an unauthorized tool, exposed credentials, or an AI tool taking an unauthorized action that could cause harm. Report these promptly through the incident response route. The person reporting doesn’t have to decide whether it is an incident. The incident response lead assesses it and decides what happens next. The response team follows the same rule when a concern reaches it first.

1. Prepare. Fund response capacity, assign authorities, set up incident routes and agree reporting protections.
2. Understand and route. Assign a case owner, describe the work and identify existing permission or the decisions needed.
3. Resolve the work. Decide temporary arrangements immediately. Then secure an authorized route, change what was promised or stop the affected work.
4. Check and maintain. Evaluate changed arrangements in proportion to their consequences, confirm the resolution with the people affected and keep reporting open as uses change.

Start within your current capacity and widen the invitation as it grows. Concerns you already know about need action now, and neither intake nor preparation may delay incident response or the immediate work decision.

Make reporting safe in practice

Protection from discipline is not enough if disclosure makes someone look incompetent, replaceable or undeserving of opportunities. In experiments, people expected others to judge them negatively for using AI, and evaluators judged AI users less favorably on competence and motivation (Reif, Larrick and Soll). That shows a potential deterrent to reporting, but not how common it is in an enterprise or what it does to careers over time.

So agree on managers’ first response before inviting reports: acknowledge the information, deal with any immediate concern, connect the person to the response route and say who will follow up. Judge contribution by quality, judgment and responsible behavior, not by whether AI helped. Give people a route outside their manager for retaliation concerns, with someone accountable for investigating adverse treatment.

Adapt this model protection statement, and get it agreed by the leaders, employee-relations and legal specialists who can honor it:

We will not treat the act of good-faith reporting as evidence of poor performance. We will assess the underlying conduct separately and explain the process. Information will go to people who need it for assessment and response; confidentiality and immunity are not guaranteed.

Office professionals have reported using AI tools at work that they believed their company prohibited (PagerDuty survey). Self-reports can’t show why. People may misunderstand the policy, prefer a tool, disagree with a restriction or knowingly evade it. So don’t treat every case as an organizational failure, or drop accountability for conduct. Technical discovery of a use doesn’t by itself show deliberate concealment. Assess conduct and circumstances under the same rules.

Explain the statement’s limits before collecting anything. Say how you will assess conduct such as knowingly handling data in prohibited ways, deliberate concealment or intentional harm. Say when information must be shared for an investigation or applicable obligations. Your organization’s rules set those limits. They do not withdraw the protection for reporting.

The case owner also makes sure the work itself gets a decision. If the support employee loses the workaround and the summaries cannot get done another way, disclosure has cost them. Others watching may learn not to report.

Route each use by its condition

In the support case, two facts set the route: a personal account and ticket data. For any report, the case owner gathers the facts that set the route: the task, the tool or account, data categories and sources, connected systems, actions, the recipient, influence on decisions and current authorization. Ask what AI has made possible, not only what it has sped up. Include embedded features and integrations, because approving a host application does not authorize every AI action inside it.

Limit the case record to people who need it. By default, don’t collect complete prompts or customer records. People overlook uses and connections, so combine what they say with proportionate, authorized technical discovery. Before any monitoring, define its purpose, access, retention and privacy limits, and any employee consultation required.

Then route the case:

• Suspected incident. Specialists triage it immediately, without waiting for intake or approval. The incident response lead owns the response. The case owner coordinates decisions about the work alongside it, without copying restricted evidence. Applicable obligations depend on the facts, and an invitation to report cannot waive them.
• Already authorized. The authorization owner (in the support case, security), or someone delegated through existing authority, confirms that the task, data and actions meet existing conditions. The case owner records it. An incomplete inventory is no reason for fresh approval. A response team member may do this check only with that delegation.
• Authorization missing or unclear. The case owner secures a decision owner, an interim decision about the work and a next update date. Priority follows consequences and business urgency. Low risk does not grant permission, and neither does silence.

Document permitted paths and their conditions with the authorization owners, so a repeat question doesn’t become a new investigation. Apply them to matching cases, and reopen review when data, actions or other material conditions differ.

On any route, tell recipients about AI’s role when it changes how they should check, rely on or attribute an output, and say what verification was done. In the support case, the specialist needs to know the summary is AI-assisted and how it was checked. Trivial uses need no announcement.

Leave each decision where it belongs

In the support case, security explains the boundary that protects ticket information. The support leader owns what that boundary means for service delivery. The case owner holds neither decision.

Permission comes from authorization owners acting under existing security, privacy, vendor-risk, procurement or change-control responsibilities. A use may need several permission decisions, each with a named owner in the case record. The case owner brings them together, so employees and managers don’t have to. If nobody clearly holds a decision, ask the sponsor to assign it before the use goes ahead.

The support leader is also the workflow owner, accountable for operating and accepting the resulting arrangement against the agreed conditions. Elsewhere the two roles can sit with different people, so name both in the case record.

The case owner records reasons, conditions, dependencies, next updates and, while a decision is pending, which work may continue under existing authority. Missed responses and unresolved disagreements go to the sponsor, who secures the decision or settles the resource conflict through the right authority. The team’s budget doesn’t automatically fund every proposed implementation.

An adequate replacement gives an acceptable result, within necessary boundaries, at an acceptable cost. Another approved chat window that can’t see the tickets leaves the problem where it was. But restricted retrieval, a smaller authorized information set, a different allocation of the work, conventional automation or manual work may be enough. The replacement need not reproduce every preferred feature or newly demonstrated capability.

When no route works, the business leader accountable for the work changes scope, timing or commitments, or stops the affected work. The case owner follows through until that decision reaches the affected recipients and is in effect.

If the restriction itself may need revising, Reviewing AI Rules covers how to examine its purpose, dependencies and evidence. Investigating a restriction does not suspend it.

Verify the resolution and its cost

Suppose a replacement arrangement for the support summaries is ready to try. Get the trial itself authorized, and match its rigor to the consequences. A small recipient check may do for a low-consequence drafting change. Sensitive access or consequential decisions need stronger evidence. Agree acceptance and stopping conditions that fit the risks.

Use representative and difficult tickets. The specialist checks whether the summaries keep the facts and uncertainties needed for diagnosis. Look at preparation, checking, corrections, elapsed time and control failures. Compare with an authorized baseline, and never reproduce unsafe handling to get one. Note changes in workload, staffing, training or tools that could explain results. Even then, a before-and-after observation does not isolate cause, and a small trial cannot show protection against rare, severe failures.

Keep three kinds of evidence apart, because each answers a different question:

• Visibility and response. Track uses understood, cases unanswered, time to an interim work decision, time waiting on decisions or delivery, time to a usable outcome, recurring workarounds and reopened cases. Read reports alongside authorized discovery and confidential feedback, because fewer reports can mean less use or less willingness to speak.
• Control. Check compliance with access, action permissions and required boundaries. Alerts depend on monitoring coverage and definitions, so they are not automatically confirmed breaches or comparable risk rates.
• Value. Look at output quality, total work effort, recipient acceptance and customer consequences. Count local benefits, but show any uncertainty about total effort and customer consequences.

Track governance cost separately: response-team effort, specialist time, implementation cost, and disruption such as temporary capacity loss or deferred work. Use proportionate estimates or ranges with stated assumptions, count effort once, and show uncertain or noncomparable consequences rather than forcing a falsely precise total.

A case closes when the workflow owner confirms a usable authorized route against the agreed checks, or when the business leader has implemented a decision to change or stop the work. An approval still waiting on delivery doesn’t count. Record the decision, owners, permissions, results, remaining uncertainty and review triggers, linking to restricted incident records. Closing the work does not close an incident investigation or its obligations.

The workflow owner then holds ongoing responsibility. Reopen the case if conditions materially change or the arrangement fails, and use recurring cases to improve reusable paths and capacity, so people stop rediscovering the process.

Start with one recurring workflow, an accountable sponsor and funded capacity for its cases. Then judge the response itself by whether its cases end in timely, usable decisions at a proportionate cost.

Sources and lineage

Governing Shadow AI is part of Applied Enterprise AI, a body of work developed by Curtis Hibbs and Joshua Barnes. The response team and the disclosure approach are a proposal, not an empirically validated remedy. This page builds on Betsy Tong’s proposal to invite disclosure of AI tools, tasks and data, which directs attention to what people are trying to accomplish.

• Betsy Tong, LinkedIn post.
• PagerDuty, Shadow AI Is Happening Within Your Organization, June 11, 2026. A vendor-sponsored survey of office professionals in Australia, Japan, the United Kingdom and the United States, conducted by Wakefield Research.
• Reif, Larrick and Soll, experiments on how people are judged for using AI, PNAS, 2025.
• NIST, AI Risk Management Framework 1.0, Core. It supports executive responsibility, assigned roles, resourced inventories and ongoing review.