That employees, in violation of the IT department's instructions, install or use software on their own initiative, often called shadow it, is an old problem. In an era when AI development is accelerating, this problem has a new and potentially more dangerous successor, shadow AI or shadow AI. When employees themselves use or subscribe to various AI agents, the risks increase manifold. Control over how potentially sensitive information is shared and which capabilities are allowed into their own systems breaks down.

To address the problem, we need to think about why an employee violates the company's written policy and starts using their own AI tools. We can start by stating that (except in extreme exceptional cases) it is not based on malice. Nor is it usually an effect of arrogance, nonchalance, or even ignorance. 

The vast majority of people want to do a good job. The drive to successfully complete their tasks is generally much stronger than laziness. The reward of feeling good at their job is what usually offers the strongest satisfaction with paid work. It is therefore reasonable to assume that in most cases an employee who violates the company's policy on AI use does so to complete their tasks, to be better at their job.

So how do we deal with this? As I have already stated, it causes shadow AI serious risks to the organization. We can't just let it happen.

It is easy to imagine that a stricter policy or stricter reprimand is the way forward. That may be justified by all means, but I believe that it does not solve what is often the real problem. The policy is often in fact an obstacle, something that obscures the connection between the ambitions of management and the IT department on the one hand and the reality of employees on the other.

A policy is not the same purpose, vision and rationality, it is what obscures them. The policy also obscures the management's view of benefit and need. 

Policies are generally written in what I call ”legalese” – a complex language that aims to enable crystal-clear interpretation when a policy violation turns into an employee case. In this way, the policy can be likened to the dense foliage of a tree. On one side of the tree is the sun consisting of management’s goals, rationalities and vision. On the other side, in the shadow, the shadow AI grows like little mushrooms. To address the problem, we need to find a way for the sunlight to both reach the shadow and be reflected back, like dewdrops glistening in the sunshine. 

The solution is not, even though my thought process might suggest it, to cut down the tree (or defoliate it for that matter). The policy is needed and fulfills an important function after all. So we need to find another way to, so to speak, make it transparent. Here I want to strike a blow for the line managers. Let them function as a channel for communication and, if you like, for the distribution of light.

Group and other line managers are close to employees and know their needs. At the same time, they have a dialogue upwards in the organization and should have a good picture of the purposes and considerations behind different policies. If employees have a need for an AI tool to solve their tasks effectively, the line manager must capture the need and ensure that management is aware of it so that they, together with the IT department, can decide whether there is reason to initiate a pilot to evaluate how the tool can be used safely. If management's answer is no, the reasons for the decision must also be communicated back to employees, with a clear justification. This gives management a chance to clarify the purpose and rational behind the decision. 

This also requires that management has a clear and well-communicated idea about the basis on which it selects and prioritizes pilot tests of AI models in its own environment. This allows employees to offer clear arguments for why management should consider a pilot, and it makes it easier for employees to understand why other pilots are prioritized higher. 

To summarize: 

• Formulated policies and tools for monitoring systems are hygiene factors, but the presence of shadow AIultimately reflects a real need among employees. 
• To address what is fundamentally a cultural problem, management needs to be able to capture these needs and clearly justify its decisions about pilots based on rational arguments linked to purposes and visions. 
• Use line managers as a channel to both capture employee needs and to clarify how and why management makes the decisions they do.

In short, let the light flow. In both directions.