How to Bring Shadow AI Into the Light Without Breaking Your Culture

by David Armstrong, Chief Information Officer

September 15, 2026

Right now, somebody on your team is pasting a draft into ChatGPT. Somebody else has a tab open to a tool you’ve never heard of. They’re getting work done more efficiently than they did six months ago, they don’t think they’re doing anything wrong, and it hasn’t occurred to any of them to mention it to you.

That’s shadow AI, and it’s the situation most CIOs are wrestling with right now. The instinct, especially in regulated industries, is to clamp down. I understand it. I’ve acted on it myself. But after living through a few of these cycles, I’m convinced that a heavy-handed ban is one of the most expensive changes a CIO can make.

Shadow AI, like shadow IT before it, tells you something useful. It shows you where your people see value, where your sanctioned tools fall short, and where your culture either invites disclosure or punishes it. Read it correctly, and an underground problem becomes a managed advantage.

Why “Ban It” Fails

When AI is used well, it’s a force multiplier. People do more, they do it faster, and they feel more accomplished doing it. Once a worker believes a tool is making them better at their job, that tool becomes part of the fabric of how they work. Once that attachment forms, removing the tool from them can feel like a punishment and not be seen or experienced as originally intended.

I’ve watched this play out firsthand. An organization gets out in front of AI, leans into ChatGPT, schedules training sessions, and runs internal events. Then legal comes back from an AI council meeting with serious concerns about synthetic data and data loss prevention, and the company has to pull the plug. Even when you offer a sanctioned alternative — say, Copilot — people feel the loss. They were loyal to their original choice. They didn’t trust that the replacement was as good, even though the underlying neural networks are doing essentially the same work.

A friend of mine in the CIO community calls this the IKEA furniture effect. The longest-lasting furniture in any American home is IKEA, because people built it themselves. They put time and effort in, and they form an attachment. People form the same kind of attachment to AI tools they’ve adopted on their own. Strip those tools away, and you’re viewed as a blocker or business inhibitor. In one case I’m familiar with, it took close to a year to rebuild trust with the business teams after a well-intentioned ban.

People are also resourceful. If they can’t use the tool on the corporate network, they’ll use a personal device on the guest Wi-Fi. Employees still use the tools. They just get better at hiding it from you.

A Practical Safe-Channel Model

Psychological safety is the precondition for any of this to work. People need to feel they’ve been given license to be human beings: naturally curious, willing to experiment, and willing to speak up when something doesn’t go as planned. We’re building this kind of channel at The Judge Group right now, and the architecture comes down to four pillars:

A plain-language AI policy: We rewrote ours to cut the technical jargon and the legal language. People disengage when documents stop making sense, and you can’t ask someone to adhere to something they don’t understand. The policy frames AI use around three things employees care about: the health of the organization, the health of their co-workers, and the health of their own role.

An approved tool registry: Tell people exactly what they can use today, and make it easy to ask for something else. We hear it constantly: “At my last company, we used X, and it was great.” Previous-company patterns are powerful, and the only way to deal with them is to have a clear, fast process for evaluating new requests.

A rapid review board with a visible queue: We’re building a dashboard so people can see where their request sits, what’s ahead of it, where we are in the evaluation, and how the request is being scored against organizational outcomes. A visible queue takes the mystery out of the wait. People accept a “not yet” if they understand where they are in the priority queue and why.

Shared ownership with the business: The minute it becomes “us and them,” you’ve lost. Business leaders need to participate in shaping the channel and modeling the culture, because they’re the ones whose teams are using the tools.

On the topic of an amnesty window — a defined period where employees can come forward without consequence — my honest view is that culture matters more than the mechanism. In a healthy organization, you don’t need an amnesty window, because there’s no shame attached to surfacing what you’ve been trying. I run a no-blame culture in IT. People will admit they tried something, it didn’t work, and here was the impact. That kind of honesty doesn’t require a special program. If your industry requires a formal window, set one up. Just don’t confuse having the program with doing the work. The work is building a culture where people would have come forward anyway.

Governance is Change Leadership Now

The old governance playbook ran on static control. You’d look at historical data, run some predictive modeling, and forecast future events with reasonable certainty. AI has turned that model on its head. Just pull on one thread — digital workers. There isn’t a mature governance model for them yet, but they’re a reality, and new roles are emerging to govern them. I spoke with a Chief Digital Labor Officer recently. Six months ago, that title would have raised eyebrows.

Governance now has to flex with workflows that evolve weekly. The CIOs I respect treat themselves as an enablement layer, translating risk against the cost of standing still. Sometimes you do need to pause and observe. Most of the time, you need to keep moving and produce outcomes. Either way, governance is no longer about paperwork and policy enforcement. It’s change leadership and enablement, and the talent profile reflects that.

As adoption climbs, cognitive offloading is the trend to watch. Because if people are deferring every decision to a chatbot, you’re trading critical thinking for speed. Productivity and judgment have to move together. Governance should be tracking both.

If You Suspect Shadow AI in Your Environment

My advice for a CIO who senses unsanctioned tools in the environment and hasn’t acted yet comes down to three moves:

Take a breath. Do no harm: A swift, heavy-handed response can absolutely produce a result, but think about what you reap from what you sow. Pulling something valuable away from someone always feels unfair, and unfair quickly becomes untrustworthy, and untrustworthy is very hard to come back from.

Start with the why: Why did this come into existence in your organization? Was there a leader pushing for results that weren’t achievable with the sanctioned toolkit? Was someone simply curious? You can’t separate the behavior from the human context behind it — deadlines, deliverables, the ordinary pressures of the job.

Make the sanctioned path shorter than the workaround: Lead with empathy, then back it up with a process that’s faster and clearer than whatever people are doing on their own.

In a healthy organization, shadow AI shouldn’t really exist. When it does, it’s telling you something about communication, prioritization, or trust. People will buy into a shared vision when it’s clearly articulated and they understand the reasoning behind the priorities. When that’s missing, they’ll find their own way to deliver, and you’ll get fragmentation, dilution of goals, and a workforce rowing in different directions. If everyone’s rowing in different directions, everyone loses.

Bring the tools into the light, and you bring the people with them.

I’ve still got plenty of unanswered questions about how this plays out at scale, and I learn the most from comparing notes with other CIOs going through the same thing. If that’s you, reach out to me on LinkedIn.