Ask a leadership team whether their staff use AI, and you will usually get one of two answers. Either "we have not rolled anything out yet", or "we use Copilot".
Both answers are usually wrong in the same way.
The tool nobody approved
In almost every workshop I run, the same thing surfaces within the first hour. Somebody in the room is using a personal ChatGPT account to draft client emails. Somebody else is pasting financial data into a free summariser. Nobody approved it, and in most cases nobody knows about it.
This is shadow AI, and it is the single most common finding in an AI-readiness review.
Why it happens
It is not defiance. It is usually efficiency. A person has a task, the approved tool is not available or not useful for it, and a consumer tool solves the problem in ninety seconds. The organisation finds out later, if at all.
The risk is not that your team is using AI. It is that you do not know where.
What actually reduces it
- Give people a legitimate path. Shadow AI thrives where the approved option is slower than the personal one.
- Be specific about data. "Do not paste sensitive data" fails. "Client names, pricing and personal health information never go into a public model" works.
- Check the score honestly. Teams consistently over-rate themselves on tools and under-rate themselves on governance.
The part that is easy to miss
Closing the gap is not a technology project. It is a capability one. People need to know what a safe prompt looks like, what a plausible-sounding wrong answer looks like, and when to stop and ask.
That is a training problem, and it is solvable in an afternoon.
