Is shadow AI risking your business?

For young, founder-led businesses, using AI is often as natural as breathing. Most of the businesses we speak with, which have been founded in the last few years, are built around AI and use it within their core set up. 

But head back a few more years, and things get tricker. “Many of the founders and leadership teams we speak to tell us they’re not really using AI yet,” says Mark Sherman. “Sometimes they're running a pilot programme, sometimes they're evaluating models. Often they're waiting until they have a clear strategy before formally introducing AI into the business. The fact is, when the business pre-dates AI, it’s tough to make it part of the company’s DNA.

“However, there's a big problem with this assumption which is that employees are probably already using it - it’s just that the Boardroom doesn’t know it. That’s where things get messy.”

The rise of shadow AI

What we’re seeing now is the emergence of shadow AI - like “shadow IT”, which is where employees adopt technology outside of approved systems.

It can take many forms - a marketing grad using ChatGPT or Claude to write blogs or white papers, a sales exec using a prospecting tool to write emails, a finance analyst uploading spreadsheets to generate summaries… all real-world, probable examples. 

“None of these employees are acting maliciously. In many cases, they're simply trying to work more efficiently,” says Mark. “The reality is that younger employees entering the workforce today use AI-assisted tools naturally. For them, asking an AI platform for help is the same as opening Google or Microsoft Excel. The problem comes when businesses don’t have a framework for AI use: that leaves the company open to risk.”

The leadership blind spot

What all this means is that organisations with no formal AI strategy may already have dozens of employees using AI every day - with no visibility from senior management. 

Historically, technology adoption is a top-down process - leadership team recognises a need for a solution, management team investigates and chooses options, IT team deploys.

AI is different. Unlike a software platform, CRM or ERP, it hasn’t been IT-sourced and board-approved. Most generative AI tools require little or no technical expertise. They are inexpensive, instantly accessible and often available through personal accounts. Employees don't need permission to experiment or special access to use them. 

It’s easy to work around firewalls and bans by using personal devices, which exacerbates the problem by removing any opportunity for organisational oversight. 

As a result, leadership teams can find themselves in an unusual position: believing the company isn't using AI while large parts of it already are.

The productivity benefits are real - but so are the risks

“Employees are turning to AI because it genuinely helps them. It can save significant time when drafting content, summarising information, analysing data or preparing first drafts of reports and presentations,” explains Mark. “In high-growth businesses where resources are stretched and teams are expected to achieve more with less, the appeal is obvious.”

The issue arises when employees are using AI without guidance. For leaders, this poses a real-world problem. 

The most obvious risk is data exposure. Any time sensitive information leaves approved systems and enters an external platform, questions are raised about the security of that data and the company’s legal compliance obligations.

As regulators start to examine AI governance, the challenge for growing businesses is that AI adoption is often happening faster than governance frameworks can be created.

Short term gain, long term pain

There’s a reason why corporate adoption of AI should be board-ratified. “There’s definitely an emerging trend where AI solutions aren’t turning out to deliver what they said on the tin,” says Mark. “Growth presents a major hurdle. When a business starts scaling, its tools need to be able to scale with it in order to deliver operational consistency. What we’re starting to see now is emerging issues where companies are ready to grow but the AI they’re using isn’t ready to scale with them.”

In scenarios like this, the short term gains delivered by AI adoption are undone by the hassle of replacing those solutions with scalable ones. The issue of growth and scalability is one of those which the Board should be taking into consideration when approving its AI applications - but which is rarely considered by more junior team members when they integrate a cool new tool into their workflow.

The question for leaders

“C Suite leaders need to have a realistic view on what’s happening on the ground in their businesses,” said Mark. “This is about acknowledging the reality of today’s working world. The role of leadership isn’t to stop people making productivity gains or exploring new solutions - it’s to provide the guardrails that protect the company’s longevity. 

“That means creating clear policies, educating employees on acceptable use, defining what information can and cannot be shared with AI tools, and establishing governance before problems arise.”

Shadow AI reveals a wider generational shift, says Mark. “Younger employees arrive with expectations about how work should be done. They expect access to modern tools, and automation. They expect to use technology to remove repetitive tasks.”

For founders building ambitious, high-growth businesses, this creates an important leadership challenge: how do you harness the creativity and efficiency these tools offer while protecting the business from unintended consequences?

The answer will come from strong leadership.

‍