Enterprise AI Has Already Escaped the IT Department. What Happens Next?

For most of enterprise technology’s history, IT has been able to exercise a reasonable degree of control over how new technology enters the organisation.

A requirement emerges, products are evaluated, security gets involved, procurement negotiates the contract and eventually users are given access to an approved solution.

Generative AI has followed almost exactly the opposite path.

Employees adopted it first.

They created accounts, experimented with tools and found ways of incorporating AI into their working lives while many organisations were still discussing policies, acceptable use and which enterprise platform to buy.

It leaves CIOs facing an uncomfortable question. What if enterprise AI adoption is already too distributed to manage in the traditional way?

That was one of the questions behind our latest CIO WaterCooler Digital Boardroom with Oliver Simonnet, Lead Cyber Security Researcher at CultureAI.

The evidence Oliver Simonnet presented suggests there is a substantial difference between the AI estate organisations believe they have and what employees are actually using.

CultureAI analysed 1,668,999 prompts and 161,599 file uploads over six months across 40 organisations. It discovered 1,064 different AI applications. In the average organisation, employees explored 113 AI applications.

But the figure that should probably concern CIOs most was 81%.

Only 19% of the AI interactions observed were through enterprise accounts. The other 81% involved personal paid accounts, free or unauthenticated services, or accounts where an enterprise licence could not be identified.

That changes the nature of the AI governance problem.

Buying Copilot or ChatGPT Enterprise doesn’t solve shadow AI

There is an understandable assumption that once an organisation provides an approved enterprise AI service, employees will migrate towards it.

The research suggests behaviour is considerably messier.

Employees may have established preferences before the corporate platform arrived. An alternative tool may appear better at a particular task. There may be friction in accessing the approved service. Or people may simply continue using the personal AI account they have been using for months.

This makes shadow AI different from much of the shadow IT CIOs have dealt with previously.

Installing an enterprise application once required some effort. Generative AI generally requires little more than opening a browser.

It also means organisations need to rethink what they mean by an “approved” AI application.

A company can approve ChatGPT, Claude, Gemini or Copilot, but approval of the application doesn’t necessarily mean approval of every account being used to access it. Nor does approval of the platform mean approval of every activity somebody might perform with it.

Shadow AI can therefore exist inside an approved platform.

That distinction becomes important when we look at the information employees are sharing.

We may be looking for the wrong data leakage

Security teams naturally worry about credentials finding their way into public AI tools.

That risk is real, but the CultureAI research indicates it is only a small part of the problem.

Around one in seven prompts contained sensitive data. Across the dataset there were 252,480 sensitive-data detections, approximately 20% of which were classified as high or critical severity. Yet credentials represented less than 1% of sensitive detections.

Employees were sharing company strategy, source code and configuration information, HR records, financial information, legal case details, health information, CVs, meeting transcripts and security documentation.

And this exposes one of the limitations of applying traditional data-loss thinking to generative AI.

A password, National Insurance number or bank account has characteristics a security product can look for. A candidate comparison, workplace grievance or board forecast does not necessarily have a recognisable pattern.

Its sensitivity comes from context.

For CIOs and CISOs, that means the question is becoming less about whether a particular piece of data has crossed the corporate boundary and more about understanding what the information means, who it relates to and what the employee is asking an AI system to do with it.

AI governance isn’t just a cybersecurity problem

This was where the Digital Boardroom discussion became particularly interesting.

Once you start examining what employees are doing with AI, the issue quickly extends beyond information security.

Consider recruitment.

An organisation could give HR access to a fully approved enterprise AI platform with appropriate contractual and data protections. That may address some concerns about where information is stored or whether the provider trains models using it.

It doesn’t necessarily answer whether an employee should feed dozens of CVs into that system and ask AI to decide which candidates progress.

Oliver Simonnet used recruitment to illustrate how the activity itself may represent a governance or regulatory issue regardless of whether the underlying AI platform has been approved.

The same principle applies elsewhere.

Generative AI makes it extraordinarily easy to carry out activities that once required specialist expertise. Someone can produce marketing material, interrogate financial information, write code or create an apparently authoritative analysis within minutes.

Our Digital Boardroom discussion highlighted how that convenience is beginning to blur organisational boundaries. The issue isn’t necessarily malicious behaviour. Often it is the opposite: people are trying to get something done.

But“AI allows me to do this” and “I am authorised or qualified to do this” are not the same thing.

That moves AI governance beyond IT.

HR, Legal, Risk, Marketing, Finance and other business functions increasingly need to decide where AI can augment human work, where specialist oversight remains necessary and where decisions must remain firmly accountable to a person.

Why blocking your way out probably won’t work

There is an obvious response to all this: tighten the controls.

If an application isn’t approved, block it.

That still has a role, but Oliver Simonnet argued that organisations need to understand the behavioural consequences.

Unlike most enterprise technology adoption, generative AI has largely been bottom-up. Employees already understand its value and many have developed their own ways of working with it. Removing access doesn’t necessarily remove demand.

It can simply displace it.

Block an application on the managed laptop and an employee potentially has a personal phone sitting next to it. Prevent a protected document being uploaded and someone can potentially take a screenshot.

Indeed, Oliver Simonnet said the research identified sensitive information being submitted through images, including screenshots of spreadsheets containing information such as company finances and credentials.

The governance challenge therefore isn’t simply stopping undesirable activity. It is doing so without driving that activity outside the organisation’s field of vision.

There is a big difference between preventing risk and making risk invisible.

The CIO’s challenge is moving from control to influence

None of this means enterprise AI cannot be governed.

It does suggest the operating model needs to change.

Organisations first need visibility into what is actually happening rather than relying on what policies say should be happening. They then need enough contextual understanding to distinguish mundane use from activity that introduces meaningful business, security or regulatory risk.

Intervention can then become proportionate.

Sometimes blocking will be appropriate. At other times, redacting sensitive information, warning an employee, suggesting an approved alternative or introducing additional human review may achieve a better result. CultureAI characterises the model as discover, understand, control and prove.

The final element could become increasingly important.

The research estimates that around 130 data subjects enter AI applications every month for every 100 employees. For an organisation with 10,000 employees, that would equate to approximately 13,000 data subjects each month.

Imagine receiving a subject access request and trying to establish whether someone’s information had appeared inside an AI prompt.

Which application was used? Which account? Who submitted the information? Where is it now? Can the organisation retrieve it? Can it delete it?

If those questions are difficult to answer today, adding another policy to the intranet probably isn’t going to fix the problem.

Enterprise AI is now a behaviour problem

Perhaps that is the bigger message for CIOs.

We have spent much of the past few years discussing AI as a technology acquisition problem: which model, which platform, which vendor, which licences?

The next phase is about behaviour.

The opportunity isn’t to prevent employees experimenting with AI. That battle has effectively already been decided. It is to make the organisation’s safe path faster, clearer and more useful than the alternatives.

That means reducing friction around approved tools. It means explaining not simply which applications can be used, but what they can be used for. And it means building controls that can respond to what somebody is doing rather than relying solely on annual training and policies.

Oliver Simonnet summed up the research with a useful distinction: “The challenge isn’t knowing if employees use AI. It’s knowing when that use creates risk, and being able to act in the moment.”

For CIOs, that feels like the important shift.

Enterprise AI adoption isn’t coming.

It has already happened. The job now is learning how to govern the reality rather than the policy.