Your Employees Aren’t Just Using AI. They’re Quietly Redesigning Your Organisation

For the last couple of years, businesses have worried about employees using AI. Are they putting confidential information into public models? Are they using tools that haven’t been approved? Can they trust the answers? Where is the data going (or coming from)?

These are all reasonable questions. But I’m beginning to wonder whether we’re concentrating on the wrong risk. Because AI isn’t simply allowing employees to do their jobs faster. Increasingly, it is allowing them to do parts of other people’s jobs too.

Someone in Sales can create their own customer campaign without involving Marketing or Communications. A manager can ask AI how to deal with an employee issue before HR even knows there is one. Someone negotiating with a customer can ask an AI to interpret a contractual clause and make a decision based on the answer without talking to Legal.

All of this is astonishingly useful. And that may be precisely the problem. We’ve become familiar with the idea of Shadow IT. More recently we’ve started talking about Shadow AI. Employees find technology that helps them get something done and use it regardless of whether IT knows about or approves of it.

But AI can introduce something rather different. It doesn’t simply give people access to technology outside the control of IT. It gives them access to capabilities that previously belonged elsewhere in the organisation.

Perhaps we should call it Shadow Expertise.

Consider something as ordinary as a sales presentation. A company may have invested hundreds of thousands, perhaps millions, over the years building its brand. Marketing and Communications will have spent enormous amounts of time defining how the organisation presents itself: its language, positioning, tone of voice, visual identity, approved claims and the promises it makes to customers.There may be agencies involved, brand consultants, designers, writers and communications specialists. There will be templates, approval processes and brand guidelines.

Then someone needs a presentation for a prospective customer tomorrow morning. So they ask AI to create it. Twenty minutes later they have something that looks professional. Perhaps exceptionally professional. And nobody from Marketing or Communications has seen it.

Does it use the company’s language? Are the product claims accurate? Has it promised functionality that doesn’t exist? Does it describe the company’s position in the market in the way the company wants to be described? Has it invented a statistic or turned an aspiration into a customer promise?

The employee hasn’t deliberately ignored the brand. But they have bypassed the people responsible for protecting it.

Move from Marketing to Legal and the implications become rather more uncomfortable.

Imagine somebody negotiating a customer or supplier agreement who encounters a clause they don’t understand.

Historically, they’d send it to Legal. But Legal takes time. They might ask awkward questions. They may want to understand the wider context. They might ask to see the entire contract rather than the paragraph the employee is interested in.

AI doesn’t create that friction. Paste in the clause and ask: “What does this mean?” Seconds later there’s a clear explanation. So you ask another question. “What risks would we be accepting if we agreed to this?”

Then another. “Is this clause reasonable?” And perhaps: “Suggest some alternative wording that would reduce our exposure.” At what point did getting help understanding a document turn into taking legal advice? More importantly, at what point did the employee decide they had sufficient information to act on it?

The AI might not know what contractual commitments the organisation has made elsewhere. It may know nothing about previous disputes, existing company policy, regulatory requirements or the organisation’s insurance arrangements.

That latter point is particularly interesting. Businesses frequently have formal processes around contractual liabilities, notifications, employment matters and other risks. Acting outside them can have consequences that go far beyond whether an AI’s interpretation happened to be technically correct.

The potential problem isn’t simply that the employee received bad advice. It’s that someone without the appropriate authority may have made a decision the organisation deliberately expected to pass through Legal.

We spend a great deal of time worrying about hallucinations and incorrect answers. Quite rightly.

But perhaps one of the most dangerous AI answers isn’t the obviously wrong one. It’s the convincing one.

An obviously ridiculous answer is relatively easy to dismiss. A beautifully written, plausible and mostly correct answer is much more likely to be acted upon.

AI doesn’t need to turn someone into a lawyer, an HR professional, a marketer or a strategist. It merely needs to make them feel sufficiently confident that they no longer need one. And once that starts happening at scale, we aren’t just talking about productivity anymore. We’re changing how the organisation works.

Some of it was undoubtedly inefficiency. Organisations create silos, bureaucracy and processes that slow perfectly capable people down. AI can and should dismantle some of that.

But some of those boundaries aren’t bureaucracy. They’re controls.

Marketing doesn’t control the brand simply because it wants to make everyone’s life difficult. Legal isn’t involved in contracts merely because lawyers like reading contracts. HR shouldn’t become involved in sensitive employee issues simply to add another person to the conversation. Finance doesn’t establish spending authorities for administrative convenience.

These structures create accountability. They establish who has the authority to make particular decisions and, just as importantly, who carries responsibility when those decisions go wrong.

AI disrupts that distinction because it democratises capability.

But democratising capability is not the same thing as democratising authority.

I might be perfectly entitled to ask AI to explain a contractual clause to me. That doesn’t necessarily mean I’m entitled to accept the risk associated with it.

Which suggests that perhaps we’ve been asking the wrong governance question.

Most enterprise AI policies understandably concentrate on which AI employees are allowed to use. Which models are approved? What data can go into them? Where is that data processed? What tools can connect to corporate systems? All important.

But imagine an employee using an entirely approved enterprise AI platform. The corporate data is secure. The identity controls are working. Nothing confidential leaves the environment. And they use it to make a decision they weren’t authorised to make. Technically, the AI governance worked. Organisationally, it failed.

The question enterprises increasingly need to answer may therefore be less about which AI can I use? and more about what am I authorised to use AI to do?

There is a significant difference between allowing AI to help someone understand something, allowing it to advise them, allowing it to create something, allowing it to recommend a decision, and allowing it to make or act upon that decision.

Making expertise more accessible could prove to be one of AI’s most valuable contributions to the enterprise. Legal doesn’t need to answer every basic legal question. Communications doesn’t need to rewrite every paragraph. HR shouldn’t become a bottleneck for everyday management. Data teams shouldn’t have to perform every piece of analysis an employee might reasonably conduct themselves.

There is enormous value to be unlocked by removing that friction. But removing friction and removing controls are not the same thing.

And that’s why I suspect the organisational impact of AI may turn out to be much less orderly than many transformation programmes anticipate.

We imagine the board agrees an AI strategy, the CIO builds the technology, individual functions redesign their processes and the organisation gradually adopts a new operating model.

But the operating model may already be changing from the bottom up.