Let’s talk about the AI your company is already running that nobody approved.
Picture the person who fixed a problem on a Tuesday afternoon.
They had a report due, three meetings they were already late for, and a system that made them move numbers between two spreadsheets by hand. So they opened a browser, pasted the messy part into a chatbot, dropped the result into a tool that drafted the email, and got home on time. Nobody asked them to. Nobody approved it. It worked.
That is how AI actually enters most companies. Not through the IT roadmap. Through one person deciding the shortcut was worth the risk.
And it is a risk. The moment that report went into a consumer tool, the numbers, the customer names, the pricing, the strategy — all of it left the building on a personal account with no contract behind it. No data-processing agreement. No retention limit. No log. Nobody in the company who could answer “where does this live and who can read it,” because nobody in the company knew the tool existed.
That is the first half of the pattern, and most people have heard it. Shadow AI. Employees outrunning governance. The part they miss is what happens next.
Because the shadow never stays in the shadows.
Eventually someone in leadership finds out, and the reaction is always the same. Ban the free tools. Ban the personal accounts. Standardize on one approved platform, negotiate a deal, roll out seats, and call it governance. Sensible. Also the exact moment the capture completes.
Think about what just happened in that room. The company did not solve a governance problem. It bought one. To get visibility into what its people were already doing, it signed a contract that routes all of it through a single vendor — the prompts, the documents, the drafts, the questions. The company gets a dashboard. The vendor gets the whole org, at once, permanently, in a format that is easy to keep and hard to leave.
Follow the money on the vendor’s side and it is cleaner still. The free tier that landed on your employee’s laptop was never a loss leader out of charity. It was distribution. Give the tool away until ten thousand people cannot imagine working without it, then sell the company the version it can control, invoice for the seats, and charge for the grounding that makes the answers worth anything. Two bites, one customer. And the customer pays twice — once in the data that leaked on the way in, once in the contract that keeps it.
That is the game. It is not evil. It is the oldest motion in software, running on a much deeper layer than it used to.
And the person who solved Tuesday with a shortcut? Their tooling gets banned or absorbed. Their workaround becomes a policy violation. The thing that made them effective becomes the thing they have to stop doing, and the replacement is the version the company bought, on terms the company negotiated, over data the company now has rights to.
What is different this time is what actually moves.
When a company standardized on a CRM fifteen years ago, it was consolidating records. When it standardizes on an AI assistant now, it is consolidating the questions. Your company’s questions are the truest picture of its strategy that exists. What it is worried about. What it is building. What it has not announced. What it does not understand. A CRM holds your customers. The assistant holds how you think about them.
Be honest about the other end too. The buyer’s incentive is real and boring: a dashboard looks like control in a board meeting, and control is what gets approved. Nobody in that room is trying to hand the company over. They are trying to be defensible. That is how these deals get signed every time.
So here is the part worth saying plainly: you are not going to ban your way out of this.
The person who found the shortcut was not being reckless. They were being competent inside a system that made the right way slow. Take the tool away and leave the slow way in place, and they will find another one — and stop telling you. Now you have the same exposure, less visibility, and a culture where people hide how they actually work.
The move is not prohibition. The move is control over what leaves.
Two questions, in this order. First: where does the work actually happen — not where the policy says it happens, but where the file gets opened and the decision gets drafted. Second: what, specifically, walks out of the building when it does. Data, names, numbers, credentials, source code. If you can answer the first, you can stop guessing. If you can answer the second, you can govern the exposure without fighting the person who just wanted to go home on time.
And there is an operator layer here that founders feel faster than anyone.
If your product is the reason a customer’s people route their work through somebody else’s model, that is not a compliance problem. That is a product problem. Your product let them need a second tool to finish the job. The safest path and the easiest path have to be the same path, or the shadow stack grows underneath you and you never see it. You find out when their security team does.
Same logic, one step out. If you are the buyer, do not just inventory the tools. Inventory what the tools learned. And ask the question nobody asks in the procurement meeting: when we leave, what comes with us? If the answer is “a description of what it used to do,” you did not buy a system. You rented the part of your business that thinks.
There is a version of this that ends fine, and it is not complicated. You accept that people will always find the fastest way to do their job. You make the fast way a safe one. You keep the record of your own process in a form a human can read, in a place you control, in a shape that survives a vendor changing its mind. You treat the export as a first-class feature instead of a support ticket.
And the principle underneath all of it: seeing your own stack is not paranoia. It is the difference between adopting AI and being adopted by it. You cannot be sovereign over something you cannot see, and you cannot leave something you have already handed your whole business to.
The people who get this right over the next two years will not be the ones with the strictest policy. They will be the ones who actually know where the work happens, what it costs, and what walks out the door with it.
Everybody else finds out when the audit does.