The best AI policy starts with a question, not a rule.
Ask your staff to show you the AI tools they’re already using. Promise no one will get disciplined for answering honestly. Their answers will show you where work is painful, where your current software fails, and where AI saves them time today.
Most companies pay consultants to guess at that list. Yours exists today, running quietly on your employees’ laptops.
Many companies face a growing gap between the software approved by IT and the AI tools employees quietly use to get through the day. Those unauthorized tools are what people call shadow AI. Every company has it, and almost none can see it because the same policies meant to control it teach employees to hide it.
A logistics company I recently worked with closed that gap with a facilitated two-day session called ‘Shadow AI Amnesty.’
On day one, the workshop’s design had three rules.
- Every demonstration happened live on screen. Telling the group about a tool didn’t count; you had to show it running.
- Legal, IT, and frontline leaders watched together in one room.
- Nothing shown in the room could result in discipline.
The CEO opened the session by making that third rule a personal promise. It had to come from the top, because frontline staff had spent years seeing IT policies enforced on those least able to push back.
One screen share sparked the fight the company needed.
A dispatcher shared his screen. Pricing a complex shipment took 45 minutes of copying data between three old systems, so he installed a free AI browser extension that completed the task in minutes. He had been using it for months.
Counsel responded first. Client rate cards, shipper identities, and customs documents were uploaded to a public tool, even though every client contract guaranteed that the data would remain confidential. She wanted the extension turned off that afternoon.
The VP of Operations disagreed. Quote requests had increased by 30% that year with no additional staff. That extension was the only reason his team still met its service commitments. Shut that service off, he told her, and the company will start missing deadlines by Friday.
Both of them were arguing on the basis of facts, and both sets of facts were genuine. Since legal and operations watched the same demo at the same time, they argued it out in the room with a facilitator, rather than through an escalation chain six months later.
The facilitator’s job was to keep the argument focused on the workflow rather than the dispatcher. Neither counsel nor the VP could play referee, because each was a party to the fight. A neutral third person turned “who violated policy” into “what does a safe version of this need,” and wrote the answers down as requirements IT could build against.
A survey wouldn’t have detected either the risk or the value. A ban would have given legal a win on paper and created a crisis for operations by Friday.
The workshop turned confessions into a plan.
Day 2 produced the deliverable: a mapped inventory of all 22 workflows, each one documented with the prompts staff had written, the data they provided, and a ranking by value and risk. The dispatcher’s workflow was at the top of both lists. Most of the rest were small, safe tasks like drafting routine emails and summarizing meeting notes, which the company approved immediately. Three others involved client data and were placed in the same secure queue as the dispatcher’s. The roadmap sorted everything into three categories in one afternoon: approve, rebuild, and retire.
IT worked from that map immediately. They rebuilt the top workflow inside the company’s secure environment within three weeks, reusing the prompts the dispatcher had refined on his own time. Client data stayed private. The turnaround time for quotes decreased 47% across the entire division. The company then made the process permanent with a standing rule: bring a new tool to the group, test it in the secure environment, and keep what works.
Your team will hand you the same list.
Each unauthorized tool highlights where your official software failed someone. This company found 22 of those areas in two days, at the cost of a meeting room, a facilitator, and a promise of amnesty.
You only have to make it safe for your team to give you the answers.
#ShadowAI #AIGovernance #AIStrategy #ChangeManagement #EnterpriseAI
