When people write about shadow AI, they tend to reach for the dramatic ending: the leak, the breach, the regulator. Those are real, and they are also rare enough that most business owners quietly file the warning under things that happen to other companies.
The everyday cost is smaller, duller and far more common. It is worth more attention precisely because it is already happening.
Shadow AI Means Everyone Is Solving the Same Problem Separately
Four people in a company of thirty each work out their own way to get a chatbot to summarise a client report. Four different prompts, four different formats, four different quality levels. None of them knows the other three exist.
That is not a disaster. It is just four times the work, producing inconsistent output, with nothing that carries over when one of them leaves.
The same dynamic is why organisations document anything. Not because documentation is virtuous, but because the alternative is paying for the same discovery repeatedly.
Nobody Can Tell Where the Answer Came From
A number appears in a proposal. Someone asks where it came from. The honest answer is that it came out of a chatbot three weeks ago and nobody wrote down which one, what it was asked, or what it was given to work with.
Usually the number is fine. Occasionally it is not, and the cost of checking is higher than the cost of having recorded it. In regulated work, or anywhere a client can ask you to show your reasoning, this gets expensive quickly.
The Tools Don’t Know Your Business
A public AI tool is very good at general knowledge and knows nothing about your environment. Ask it why a laptop will not connect to the network and it gives you the advice that works most of the time, for most people, on most networks. Which may be exactly right, or may be twenty minutes spent on something that does not apply to how your systems are set up.
The difference is context. An AI operating inside a managed technology environment can, depending on the request, draw on documentation, standards, procedures and information about the specific device with the problem. That does not make it smarter. It makes it less likely to start from scratch.
This is the practical argument for giving people a sanctioned route for work-technology questions, rather than the compliance one. It is faster.
What Good Looks Like
Not a ban, and not a policy binder nobody opens. Three things:
- A short list of approved tools, and one person who owns it
- A clear line about what information may go into them
- An obvious route to ask for something new, so people ask instead of going around
That is most of the value, and it fits on a page.
The Foundation Question
Underneath all of it sits a less comfortable question: how much of your organisation’s knowledge exists somewhere other than in people’s heads?
If the answer is not much, AI will not help you very much either. Not because the tools are weak, but because they have nothing of yours to work with. The businesses getting real value from AI right now are mostly the ones that had their documentation, identity management and systems in reasonable order first.
That is the unglamorous part of AI readiness, and it is the part worth starting on.
[Watch the recording from 23 October], Amelia walks through the policy template and what sits underneath it.
Wondering where your own foundation stands? An AI Readiness Assessment is a straightforward look at what is in place and what is not.
