AI Governance and Shadow AI: Has Your Operating Model Already Changed?

AI governance is becoming more sophisticated.

That is a good thing.

But please don’t dismiss the term ‘AI Governance’ as something you already understand or that the order of things is as it should be.

Let’s not also be comfortable with the order of AI Governance arrival.  We are behind the curve.  The demand for governance is coming from a realisation that it was missing in the first place. 

It wouldn’t be the first time I’ve worked with a CEO who had implemented AI across the organisation because of apparent, but largely assumed, commercial opportunity and pressure.

I anticipate a costly revisiting of some of those decisions in the not-too-distant future.

So, the question is not simply:

“How do we use AI?”

It is:

“How do we avoid making expensive assumptions about AI before we understand what it has already changed?”

By AI governance, I mean the controls organisations put around AI use: where it is being used, what data is going into it, whether outputs can be trusted, who is accountable, and what happens when something goes wrong.

A market is now forming around that need.

But there is a problem.

Formal AI governance may be arriving after AI adoption, formal or informal, has already changed the organisation.

Harvard Business Review has described this as the hidden demand for AI inside your company: employees quietly using personal AI tools because official systems are too slow, too limited or not yet available.

People are using public AI tools, personal AI tools and open AI tools.

• They are summarising meetings.
• Drafting documents.
• Analysing information.
• Rewriting messages.
• Preparing decisions.
• Testing ideas.
• Solving problems outside approved channels.
• Presenting credible solutions.
• This is often called shadow AI.

In plain terms, it means people are using AI tools that the organisation has not formally approved, governed or even seen, to deliver outputs that may not have been properly tested or challenged.

That is not just a data-security issue.

It means the organisation may no longer fully understand how some of its own work is being produced.

It may already have an AI operating model that nobody formally designed or even requested.

By operating model, I mean the way work actually gets done: who does what, which tools are used, where decisions are made, how information moves, and how accountability works.

Harvard Business Review has also argued that organisations need to match their AI strategy to their organisation’s reality, because AI pilots can fail when the operating model around them cannot support the ambition.

If AI is quietly changing that operating model from the bottom up, leadership may be making decisions based on an outdated picture of the organisation.

That is where the leadership issue begins.

AI governance can help show what the technology is doing.

But it can’t, on its own, tell you whether the humans around the technology are exercising good judgement.

Who is deciding when AI should be used?

Who is challenging the output when it looks convincing?

Who is noticing when a workflow has quietly changed?

Who understands what capability is being created, what capability is being borrowed, and where dependency is forming?

This is where adaptive leadership matters.

By adaptive leadership, I mean the ability to change your approach as the situation changes.

Sometimes leaders need to give direction.

Sometimes they need to slow the decision down.

Sometimes they need to invite challenge.

Sometimes they need to let people experiment.

Sometimes they need to stop activity that is creating risk.

But there is a danger.

"If leaders keep changing direction without explaining why, people don’t experience adaptability. They experience inconsistency."

If leaders keep changing direction without explaining why, people don’t experience adaptability. They experience inconsistency.

And inconsistency creates ambiguity.

When people are unclear, they often create their own workarounds.

They fill the gaps.

They use the tools that help them cope.

They make local decisions because the wider decision has not been made clearly enough.

That is how shadow AI grows.

Not always through rebellion.

Often through usefulness.

Often through pressure.

Often because people are trying to get the work done.

That is why the conversation around AI, governance, cybersecurity, leadership and change is starting to merge.

It is also why events like Belfast Tech Week feel timely.

The organisations that handle this well will not simply be the ones with the most AI governance documentation.

They will be the ones that understand what AI has already changed, where hidden dependencies are forming, and whether their leaders have the judgement capacity to govern what is emerging.

Because the alternative is that AI starts making judgement calls the organisation has not consciously decided to delegate.

Harvard Business Review has also warned that AI can undermine leaders’ judgement, unless organisations deliberately protect structured curiosity and intentional dissent.

That matters because organisational judgement is not just the judgement of one individual leader.

It is the ability of the organisation to make good decisions under pressure.

It includes what people notice, what they are willing to say, how evidence is challenged, who has authority, and whether decisions change when the facts change.

AI governance asks:

What is the system doing?

Organisational judgement asks:

Who understands it?

Who challenges it?

Who decides what happens next?

And who notices when the organisation has already changed before anyone formally agreed that it should?

"How do we preserve judgment?"

Those questions are not unique to AI.

They sit at the centre of how leadership teams operate under pressure.

How clearly is direction set?

How easily can assumptions become accepted as fact?

How early does difficult information surface?

Can senior thinking be challenged before a decision closes?

Is ownership genuinely clear?

And when new evidence appears, can the organisation adapt without creating confusion or losing accountability?

AI is making those questions harder to avoid because it is accelerating the consequences when they are left unresolved.

That is one of the reasons the AMM Leadership Operating Charter was developed.

It is not an AI governance framework.

It is a practical way of making the leadership conditions around important decisions more visible: direction, reality, early exchange, challenge, ownership, commitment and adaptation.

The Charter is designed to help leadership teams see where those conditions are strong, where they are assumed to be strong, and where pressure may be creating gaps between how the organisation believes decisions are being made and what is actually happening.

That distinction matters.

A governance framework can define what should happen.

It still depends on leaders being able to recognise changing reality, challenge credible-looking conclusions, surface concerns early and remain clear about who owns the decision and its consequences.

AI governance therefore cannot sit apart from organisational judgement.

The technology may be new.

The leadership requirement is not.

If you would like a copy of the Leadership Operating Charter, send me a message with “Charter” and I’ll send it across.

It may be worth looking at before AI, or anything else moving faster than the organisation around it, turns an assumed strength into an expensive surprise.