The concept of shadow IT gained traction between the late ‘80s and ‘90s, back when personal computing began proliferating among staff who naturally started working on their computers at home.
Shadow IT encompasses the implementation of any apps, hardware devices, services, technologies, tools, or devices within a business that are not monitored, authorized or overseen by a corporate IT team. Over time, it became a menace for enterprise IT leaders.
A new buzzword has now emerged: shadow AI, or the unapproved use of Artificial Intelligence. This could be, for example, the use of generative AI services (like those with ChatGPT, Bard, Gemini and Claude) using your personal, unapproved account to do business.
So what’s the way forward for CIOs to deal with this type of shadow IT?
The Reality Check
First and foremost, a reality check for IT leaders. CIOs simply can’t stop shadow IT in the age of AI. They can try but it is functionally impossible when literally hundreds of AI-powered services exist, when teams are asked to do more with less, and when the business simply moves faster than governance processes. The old strategy of whitelisting approved tools and blocking everything else simply will not work, or is at least extremely difficult.
Zero-trust platforms and firewalls cannot always differentiate between legitimate AI-powered platforms and risky ones. Every day, new AI tools are released, and while there is a clear need for a governance process to limit use or ensure that tools are approved within a specific domain, the process of policing and trying to regulate everything is clearly futile.
Living with it
The smarter play is to accept that a certain amount of shadow IT is not just inevitable, it’s actually healthy. Business and IT have to work closely together, and if you can’t beat them, join them.
If there is a person in the organization who can use AI to make processes better, why stop them? Today, everyone has limited resources. In a typical organization, if IT had to plan and execute every AI project, the team size would need to triple. Those people simply aren’t available in the market.
What matters is that you don’t shut down the experimentation by full force after shadow IT. Instead, find those people, bring them onboard, and make sure that enterprise data security is not eroded. As a CIO, you should encourage them to work with AI but keep the IT department in the loop. This way you can put guardrails around it.
Those guardrails can be simple:
Data classification rules that spell out what can and cannot go into public AI tools.
Entry channel (application, form, email/alias, Slack channel, etc.): Employees notify and disclose the use of the AI tool.
Briefest due diligence: Before your AI tool interacts with your company’s data, you need to ensure there are at least some security checks in place, such as performing vendor evaluation, analyzing data usage and access permissions.
Where Should CIOs Intervene
Beyond a point, shadow IT stops on its own. Sometimes it dies its natural death when the tool doesn’t deliver. Sometimes the business reaches out to IT saying, “We’re not able to find a viable solution, please help.” That’s when you know the experiment has matured enough to warrant enterprise support.
Given the current business and technology scenario, some bit of shadow IT is fine. Technology leaders can’t stop the projects. The business is too dynamic, and the line between IT and business has to blur. IT has to get embedded with business, not the other way around.
It’s important for CIOs, however, to keep a tab on red flags such as leaking of data to tools not allowed or the compliance risk associated with the same or a “hallucination” from a model used in making decisions or vendor locked in, which could become a pain to migrate in the future. A little experimentation is healthy; unmanaged risk is not.
The real job of the CIO in the age of AI is not to build gates, but to build guardrails. If someone has reached out to IT and hasn’t been able to get a response quickly, ask yourself: what’s more important — perfect governance or speed?
Look at the overall objective of the organization. Sometimes you have to move quickly because time and money are of the essence. You can’t be handholding everyone — there simply isn’t bandwidth for that.
Just a couple of simple measures can keep tabs on it – such as the number of disallowed AI tools running, the number of incidents related to AI, or the number of business initiatives that sprouted from shadow tests. Those two indicators will indicate where attention ought to be directed.
The Bottom Line
Shadow IT in the age of AI is not a problem to be solved. It’s a signal to be read. It tells you where the business is moving faster than IT, where innovation is happening despite friction, and where your guardrails need to be stronger than your gates.
The CIOs who win in this era won’t be the ones who block the most tools. They will be the ones who enable the most value safely, quickly, and with the business as a partner, not a petitioner. Just make sure IT is in the loop, the data is secure, and the business knows you are on their side.
