The CIO of a logistics company is going through the quarterly expense report with her finance controller. Between the travel claims and software renewals she counts 37 subscriptions to AI tools, paid on corporate cards by teams in planning, customer service, HR and procurement. None of them went through IT, and none of them appear in the AI policy she presented to the board last spring. This is what shadow AI usually looks like: dozens of sensible people solving their own problems faster than the organisation can keep up.
Her first reaction is to block the tools. Her second, more useful reaction is to ask why so many teams felt they had to go around IT in the first place. That question is the thread of this piece: why AI adoption outpaces central governance, where the real risk sits according to the MetroMinds Library, and how you can turn shadow AI into a managed portfolio without slowing your teams down.
Shadow AI tells you where the demand is
The scale of bottom-up adoption is no secret. In the 2024 Work Trend Index, Microsoft and LinkedIn found that three in four knowledge workers already use AI at work, and that "78% of AI users are bringing their own AI tools to work" [1]. Most of them simply have work to finish and a tool that helps.
Gartner looked at the same trend from the risk side. In a survey of cybersecurity leaders, "69% of organizations suspect or have evidence that employees are using prohibited public GenAI", and Gartner predicts that by 2030 more than 40 percent of enterprises will experience security or compliance incidents linked to unauthorised shadow AI [2]. Both findings point in the same direction. People already use AI outside official channels, so the useful question for a CIO is how quickly you can see that use and steer it.
That shift in perspective matters. Every unofficial tool is also a signal: a team has found a task where AI saves time, and it was willing to pay for it out of its own budget. If you treat that signal only as a violation, you lose the information. If you treat it as demand, you get a free map of where AI value is waiting in your organisation.
Why central governance falls behind
Most AI governance models were designed like IT project governance. A central board reviews proposals, checks architecture and security, and approves a budget. That works when AI arrives as a handful of large projects. It breaks down when AI arrives as hundreds of small decisions spread across every department.
The MetroMinds Library shows how wide that spread is. Only a small share of its 4,980 AI use cases belongs to IT's own capability. Most belong to operations, supply chain, risk and compliance, customer growth, HR, finance, legal and strategy. In ten of the twelve top-level , you find use cases from all twelve in the Library, from conversational AI to prediction and agentic AI.
So an AI board that waits for proposals from IT will only ever see a small slice of what is happening. The rest arrives through procurement cards, SaaS add-ons that switch on AI features by default, and vendors who sell directly to business teams.
The risk sits where governance is weakest
You might expect the riskiest AI to be the technical kind, deep in IT. The Library suggests the opposite. Each use case carries a risk score from 1 to 5, based on the impact of errors, the degree of ambiguity and the safety requirements of the work. Across the Library, 74 percent of use cases score 4 or 5.
The highest shares are found in strategy and leadership (80 percent), supply chain and sourcing, transformation and product lifecycle (79 percent each). Technology, Data and AI and Legal have the lowest share, at 65 percent each. In other words, the use cases that IT governs most closely are on average the least risky ones, while the riskier ideas come from the parts of the business that are least likely to ask IT for permission.
There is a second pattern worth noticing. In 96 percent of the use cases, the AI prepares, drafts or recommends, and a person takes the actual action. That sounds reassuring, but it moves the governance question. Much of the risk sits in the decision a person makes on the basis of the AI's output, such as approving a payment, answering a regulator or adjusting a safety threshold. A tool inventory alone will not show you those decisions.
Why banning tools rarely works
Blocking popular AI tools gives a feeling of control, and for some data types it is the right call. As a general strategy, though, it pushes usage onto personal devices and private accounts, where you see even less.
Gartner's advice in the same release is more balanced: "CIOs should define clear enterprise-wide policies for AI tool usage" and "conduct regular audits for shadow AI activity" [2]. Clear rules and regular visibility work better than a wall, because they give people a legitimate route. The aim is to make the official path faster than the unofficial one.
From gatekeeper to intake
The structural answer to shadow AI is to replace the gate with an intake. Instead of one board that approves or rejects projects, you give every team a simple way to register an AI idea or tool as a candidate. Each candidate is then assessed on the same criteria and moves through clear statuses, so people can see where their idea stands.
What you can do this quarter
- Ask finance for every AI-related expense line from the last twelve months, and treat the result as a demand map rather than a list of offenders.
- Publish a short AI usage policy that says which data may go into which kind of tool, written for employees rather than lawyers.
- Open a simple intake where any team can register an AI idea or tool as a candidate use case, with an owner and the work it supports.
- Score every candidate on value, feasibility and risk with the same criteria, so that a tool from HR and a model from IT are compared fairly.
Shadow AI rarely disappears. What you can change is whether you see it, and whether the people behind it see a better route than going around you. Once AI is live, a second question follows: who keeps checking it? We cover that in Who checks your AI after it goes live?
How MetroMinds helps you see and steer AI demand
MetroMinds gives you one portfolio for every AI initiative, wherever it starts. Contributors register use cases from their own team, portfolio managers assess them and decide, and customer admins manage who has access. Every use case moves through the same statuses, from candidate to accepted and approved for execution, and on hold or rejected always requires a reason.
Teams that are unsure where to start can filter the MetroMinds Library by industry, function, risk level and time to value. The AI Readiness Scan then shows whether your organisation is ready for the portfolio you are building.
Curious how ready your organisation is to govern the AI it already uses? Take the AI Readiness Snapshot
Sources
- Microsoft and LinkedIn, "Microsoft and LinkedIn release the 2024 Work Trend Index on the state of AI at work", 8 May 2024.
- Gartner, "Gartner Identifies Critical GenAI Blind Spots That CIOs Must Urgently Address", press release, 19 November 2025.
- MetroMinds Library, 4,980 AI use cases with benchmark ranges based on real-world implementations, August 2026.
