“Create clear boundaries”: tackling ‘shadow AI’ in your organisation

Beneath this trend, it seems there’s a mismatch between people’s enthusiasm for AI tools and the guidance they receive about using them. CMI research has found that 70% of staff are bypassing their manager in favour of using generative AI when they need advice. At the same time, 69% haven’t received any training from their organisation in the likes of ChatGPT, Gemini or Copilot.

“We are seeing senior leaders loudly champion the shiny new promise of AI in the boardroom, yet fall short in equipping their teams to actually put these tools to work on the ground,” writes Ann Francke OBE CMgr CCMI, CMI’s chief executive, in the foreword to the new report, Artificial Intelligence; Real Leadership: The management imperative in AI adoption.

While shadow AI is often framed as purely a cybersecurity threat, it is another signal that the workforce has an appetite for innovation and efficiency, but that organisational systems and policies are lagging behind people’s real-world needs. 

“Shadow AI is not a disciplinary crisis; it's symptomatic of a need for better training,” says Pru Shelton, CMI’s head of research. “Burying your head in the sand won’t make your organisation safer. Training your managers will.”

CMI’s new Leadership for AI qualifications include elements of cybersecurity governance and risk mitigation, designed to help managers navigate this very challenge. 

We spoke to several Chartered Managers who have encountered shadow AI to find out how they’ve dealt with it. Here are their top tips.

Close the “guidance gap”

According to Nasser Zaman Chowdhury CMgr MCMI, a CEO working across e-learning and education services, shadow AI isn’t merely a compliance issue. If managers don’t explain what AI can be used for, what information is off limits and where human review is required, people will simply create their own informal rules. 

“The practical response is not to discourage AI use but to create clear boundaries around it: what each tool is for, when it should be used, when expert judgement is required and how quality will be protected,” he says.