The governance conversation about AI usually starts with a policy question — should staff be allowed to use these tools — long after the practical answer has been settled by staff who are already using them. Starting from a prohibition that is not enforced produces the worst available outcome: the usage continues, and now it is also hidden.
Start With an Inventory, Not a Position
Before deciding what is permitted, it is worth establishing what is happening: which tools are in use, who is using them, what data reaches them, whether they sit inside a contract with terms anyone has read, and whether any of them are embedded in a supplier's product rather than adopted directly. The last category is the one most often missed, because nobody chose it.
An inventory converts an argument about principles into a set of specific decisions, most of which turn out to be uncontroversial once the facts are on the table.
The Governance Questions That Matter
What data may reach a model, and under whose authority: the answer usually differs by data class, and needs to be expressed in terms staff can apply without asking.
Where it is processed, and under which terms: residency, retention and whether inputs are used for training are contractual questions with regulatory consequences.
What the output is allowed to decide: the distinction between a tool that drafts and a tool that decides is the distinction that determines how much oversight is required.
Who is accountable for an error: an answer produced by a model is still the organization's answer when it reaches a customer or a regulator.
How usage is reviewed: a one-off approval is not governance; adoption changes faster than most review cycles.
“Shadow AI is not a new category of risk. It is the ordinary risk of unmanaged data flows, moving faster than the process built to review them.”
Proportionality
It is possible to over-govern this to the point of irrelevance — a review board that meets monthly for decisions that are taken daily. The workable position is usually a small set of clear rules about data classes, a light route for the ordinary case, a real assessment for anything that decides rather than drafts, and a standing inventory that someone owns. That is the same governance pattern applied to any new capability. AI is not a special case, but it does move faster, which makes the absence of the pattern more expensive.
