Out of the Shadows: Why Employees Are Using Unsanctioned AI at Work, and How Leaders Can Turn Hidden Experimentation Into Governed Capability

[00:00:00] Welcome to the Deep Dive. Have you ever been like staring at a massive dense PDF that you absolutely did not have time to read and you just you quietly opened up a consumer AI chatbot? Just, you know, trying to get through the afternoon. Exactly. You copied the text, pasted it in, and asked the AI to summarize it all without telling your IT department of course. Oh yeah. Right. Happens all the time.

[00:00:24] Right? So if you're nodding along to this, or if you've done something similar with a tricky email draft, you are participating in a massive silent rebellion. It's happening in millions of browsers and tabs across the world right now. It really is a quiet revolution. It's completely reshaping how work gets done. And honestly, most management teams are entirely in the dark about the sheer scale of it.

[00:00:50] There really are. So our mission today is to pull this phenomenon out into the light. We're exploring a fascinating 2026 article by Dr. Jonathan H. Westover, PhD. It was published in the Human Capital Leadership Review, and it's literally titled, Out of the Shadows. Great title. Very fitting.

[00:01:07] Yeah, it is. So we're going to look at why so many of us are secretly using AI at work, the genuinely terrifying hidden dangers of doing this, and how smart companies are actually turning this secret rule breaking into a massive competitive advantage. Instead of a fireable offense, which is, you know, a nice change. Right. So let's start by defining the actual behavior. IT departments have a very specific name for this covert operation, right? They call it shadow AI.

[00:01:35] They do. Yeah. And we really need to distinguish shadow AI from another term that's floating around corporate circles right now, which is BYOAI or bring your own AI. OK, so how are those different? Well, bring your own AI is simply an employee using an artificial intelligence tool their employer didn't explicitly provide. And depending on company policy, that might actually be perfectly allowed. Oh, gotcha. So BYOAI could be totally above board.

[00:02:03] Exactly. Shadow AI, on the other hand, is specifically the unsanctioned, unmonitored use. It's using these tools without the knowledge, approval or oversight of the organization's IT or security teams. So it's the secrecy that makes it shadow AI. Right. And it even includes quietly using an AI feature that was just like recently baked into an approved application. Think of a project management software that suddenly adds a chat bot.

[00:02:30] If you use it without security vetting that specific new feature, that's shadow AI too. Wow. OK. The scale of this unvetted usage is what really caught my attention in the article. Dr. Westover pulls in this survey data from PagerDuty in June of 2026. The numbers on that are just wild. They really are. They looked at office professionals at large organizations and found that 66 percent, so literally two thirds of the workforce,

[00:02:56] were using AI tools at work while actively believing their company policy strictly forbade it. Yeah. And another study by Ricoh in 2026 backed that right up. They found 45 percent of workers rely on non-approved tools on a monthly basis. The numbers consistently show a workforce that is just, you know, operating outside the official guardrails. I look at a number like 66 percent actively breaking the rules. And my first instinct is to wonder, like, is this just a demographic thing?

[00:03:23] Like maybe this is just tech savvy 20 somethings who don't like authority. Right. The usual suspects. Exactly. But the data just blows that theory out of the water. Microsoft and LinkedIn did a massive global survey like 31,000 workers back in 2024. And they found that 78 percent of AI users brought their own tools to work. And that spanned all age groups, didn't it? It did. In fact, 73 percent of older demographics were doing it too. We even see it in incredibly strict, heavily regulated fields.

[00:03:52] Wolters Kluwer Health Survey from 2025 showed 17 percent of hospital and health system providers admitting to using unauthorized AI. See, that health care statistic is the most telling to me. It proves that severe regulatory environments and strict rules, they aren't actually barriers to adoption. People will always find a way. It totally brings to mind the early 2010s. You know, companies were issuing those clunky secure BlackBerrys or flip phones. And suddenly employees just started bringing their own personal iPhones to the office.

[00:04:21] Oh man, IT departments were pulling their hair out over that. Right. But the employees just wanted a device that didn't feel like a dinosaur. But I want to push back on the corporate narrative here for a second. Are these employees actually acting maliciously? Because when IT leaders talk about shadow AI, it sounds like they view their staff as rogue agents, like actively trying to subvert company security. What's fascinating here is where this behavior actually originates.

[00:04:49] If we look at that pager duty data, 89 percent of these workplace AI users first encountered the technology in their personal lives. So it's starting at home. Exactly. The consumer market is setting the pace. People are at home using these incredible AI tools to, I don't know, plan their vacations or help their kids with homework. And they realize the massive time savings. Right. They see the magic. Yeah.

[00:05:14] And then they log into work at 9 a.m., look at their outdated legacy software, and they just, they simply refuse to go back to the digital dark ages. It's rarely malicious. It aligns perfectly with what organizational theorist Stephen Alter calls the theory of workarounds. The theory of workarounds. I like that. Yeah. It basically means people are just doing whatever they have to do to get their jobs done efficiently. Okay. Let's unpack this.

[00:05:40] Because if these employees aren't malicious hackers, why are they risking disciplinary action or even getting fired just to write a better memo? When you dig into the research, it really comes down to a few core human motivations. The most obvious is performance expectancy. Basically, the tools just work. Right. They make you faster. Exactly. Okay. People believe AI makes them better, faster, and more capable. The immediate payoff is undeniable.

[00:06:06] But the second driver is what the article calls a provision gap. Lenovo surveyed AI users and found that 22% say their employer provides literally zero AI tools for them to use. Zero. Zero. Wow. Imagine showing up to a construction site and your boss refuses to give you a power drill. Like they insist you use a manual screwdriver. Well, the guy next to you secretly brought his own Makita drill from home. That is a perfect analogy.

[00:06:35] And that lack of provision stems from a broader strategy gap. According to Gallup, only about 25% of employees in 2026 report that their company has communicated any clear plan regarding artificial intelligence. Only a quarter of companies have a plan. That they've communicated. Yeah. And when leadership is silent, the workforce doesn't just sit still and wait. They fill that void with their own improvisations. The motivation that really hits hard for me, though, is career self-interest.

[00:07:02] The PagerDue data shows that 77% of people think their company's AI restrictions are actively limiting their professional mobility. They feel held back. Right. And furthermore, 72% believe they understand AI better than their own IT teams. There's this tragic irony playing out in offices everywhere, you know. How so? Well, you have ambitious employees taking the initiative to learn cutting edge skills and become vastly more productive. They are doing exactly what companies always claim they want. Innovating.

[00:07:31] Yet, they feel forced to hide this ambition because they fear being punished by the very organization benefiting from their increased output. And the psychological toll of that concealment is heavy. Over half of these users, 52%, are highly reluctant to admit they use AI for important tasks. Because they're scared of getting in trouble. That, and another 53%, are terrified that demonstrating how well AI does their job will make them look completely replaceable to management. Oh, man.

[00:07:58] So, we have a workforce doing extra homework to master these tools in secret. Living in a constant state of anxiety about getting caught by IT. While simultaneously stressing out about a robot taking their livelihood. That is the perfect storm for severe burnout. It fractures the entire culture of an organization. Elizabeth Morrison's research on employee silence really illustrates why this is so toxic. Employee silence. Yeah.

[00:08:26] When individuals calculate that speaking up or sharing their work methods is personally risky, they withhold valuable information. Trust between the staff and leadership erodes. If a management team only uses a punitive, enforcement-heavy approach to AI, they don't stop the behavior. They just amplify that silence. I hear that, but, I mean, if I put myself in the shoes of a chief information security officer, my job is literally on the line of company data leaks.

[00:08:53] I might say, look, I understand the burnout, but my priority is protecting our intellectual property. Sure. That's their mandate. Right. So, I could just block open AI, Anthropic, and Google Gemini on the company firewall. Doesn't that physically stop the problem? It creates an illusion of security. The reality of modern technology is that a firewall only blocks traffic on the corporate network. Oh, right.

[00:09:16] An employee can simply pick up their personal smartphone, disconnect from the company Wi-Fi, use cellular data to paste a confidential document into a consumer chatbot, get the summary, and type it back into their work computer. Wow. Yeah, you can't block cellular data. Exactly. The data is entirely underground, which removes whatever thin layer of visibility IT had to begin with.

[00:09:44] Here's where it gets really interesting, because the actual tangible costs of this ungoverned AI usage are devastating. The PagerDuty survey found that 88% of shadow AI users shared work-related information with public AI tools. 88%. That's almost everyone doing it. Yeah. And 31% admitted to feeding those public models financial information, confidential documents, or internal company strategies. We really need to explain the mechanics of why that is so dangerous.

[00:10:14] When you paste sensitive corporate data into a free public consumer chatbot, you aren't just using a calculator. Right. It doesn't just disappear. No, it doesn't. Many of those consumer models are designed to ingest user inputs as training data for their future updates. You are essentially taking your company's proprietary secrets and donating them to a public database. Where anyone could find it. Theoretically, yes. A competitor's prompt could eventually surface fragments of your information.

[00:10:41] The financial impact of that is quantified in IBM's 2025 cost of a data breach study. They looked at breaches specifically involving shadow AI and found they cost an organization an average of $670,000 more than a standard data breach. That is a massive penalty. It is. Even more alarming. Personally identifiable information, things like client social security numbers or medical records, was compromised in 65% of these shadow AI incidents. Data security is only half the crisis though.

[00:11:10] The other half is the degradation of the actual work being produced. This brings us to a landmark study by Delacqua and colleagues at Boston Consulting Group. Right. The jagged frontier study. Exactly. They mapped something they call the jagged technological frontier of generative AI. I love this concept. So think about ungoverned AI, like a company handing out powerful sports cars to employees. But they don't give them a driver's manual and they don't give them a map. Just here are the keys. Good luck. Yeah.

[00:11:40] They're effectively letting their staff drive blindfolded along a cliff edge where one wrong turn results into a massive hallucinated error being sent straight to a client. But when you look at the BCG study, for certain tasks, AI is amazing. That is the area inside the jagged frontier. The study found that consultants using AI for tasks inside that frontier work 25% faster and produce quality rated over 40% higher.

[00:12:06] But the frontier is jagged because AI's capabilities are highly uneven and unintuitive. Large language models don't actually think. They don't do math. They just predict the next most likely word based on patterns. So they're just really good guessers. Essentially, yes. So for tasks deliberately chosen to fall outside that frontier, tasks requiring complex logic, novel problem solving, or nuanced factual cross-referencing, the AI still answers with the exact same supreme confidence.

[00:12:36] It doesn't say, hey, I don't know this. Never. It just fabricates a very convincing, completely wrong answer. We call that a hallucination. And because the AI sounds so articulate, the user trusts it. The BCG study proved this. Consultants who used AI for tasks outside the frontier were actually 19% less likely to get the correct answer than those who didn't use AI at all. They blindly trusted the output. Exactly. Because they had no map of where that jagged frontier was. This raises an important question.

[00:13:05] Who was responsible for mapping that frontier? When employees use AI in the shadows, nobody is helping them identify which tasks belong inside the frontier and which belong outside. Nobody is double checking their work. Right. Nobody is peer reviewing their prompts. They are navigating an invisible minefield entirely alone. Beyond the errors, there is a massive opportunity cost to all this secrecy. Dr. Westover's article highlights research by Arik Bernjalsson regarding customer support agents.

[00:13:32] He found that when an entire team was given a sanctioned generative AI assistant, the resolution rates of novice workers jumped by 34%. 34% is huge for new hires. It's massive. The AI essentially observed how the top performing veterans solved problems, captured that tacit knowledge, and made it available to the novices. And shadow AI completely forfeits that shared learning. Imagine an entry level employee discovers a brilliant prompt sequence that saves three hours of data entry.

[00:14:02] If they are using an unapproved tool, they keep that discovery entirely to themselves to avoid getting in trouble. The organization gains absolutely zero institutional knowledge. Exactly. Plus, organizations are increasingly legally required to know what's happening. The EU AI Act, specifically Article 4, mandates that companies ensure a sufficient level of AI literacy among their staff. And you can't prove literacy if everything is hidden.

[00:14:26] You literally cannot prove to regulators that your staff is adequately trained to use tools if you have no idea what tools they are smuggling into their daily workflows. So if firewalls and blanket bans are essentially useless, how do leaders actually solve this? It requires a paradigm shift. We have to move away from prohibition and toward governed capability. Dr. Westover outlines a five-step methodology for bringing this behavior into the light. It reminds me of a concept in urban planning.

[00:14:54] Let's say a university builds a beautiful grassy quad with paved sidewalks at strict 90-degree angles. But students, being human, take shortcuts diagonally across the grass to get to class faster. Right, because it's more efficient. Exactly. Over time, they wear down a dirt path in the lawn. Planners call these desire paths. Bad planners try to build taller fences to keep students off the grass, which never works.

[00:15:19] Good planners look at the dirt path, realize it's the most efficient route, and they simply pave it. They embrace the reality of how people operate. Yes. They give the students a sanctioned, safe way to do what they were already doing. That is the perfect analogy for the first step of the solution. Provide secure, sanctioned alternatives. The research on technology acceptance is incredibly clear. Usage follows convenience.

[00:15:44] To stop employees from pasting data into free public chatbots, organizations must purchase enterprise-grade tools that are just as capable but with proper data protections. And we are seeing massive global entities do exactly this. JPMorgan Chase rolled out their own LLM suite to roughly 250,000 employees. PWC signed up 100,000 workers for ChatGPT Enterprise. Walmart built a custom internal tool called My Assistant. Which is exactly what you want to see. Right.

[00:16:13] And for listeners who aren't software engineers, when we say enterprise-grade tool, we mean the company has negotiated a contract where the AI provider legally guarantees that employee prompts are ring-fenced. The data is processed, the answer is generated, and then the data is immediately deleted. It is zero retention. Right. It never trains the public model. Right. So what's the next step? Step two is designing risk-tiered governance.

[00:16:40] A common mistake compliance teams make is drafting a 50-page policy document that treats every single AI interaction as a high-risk event. Yeah, that just slows everything down. Right. Asking an AI to suggest a catchy subject line for the company's softball team email is very different from asking it to analyze a patient's medical history. You need flexibility. For example, Morgan Stanley allows extensive AI use. But they test every single use case before deployment and run daily regression tests.

[00:17:09] For anyone unfamiliar, a regression test means IT feeds the AI a standard set of prompts every single day to ensure the model's performance hasn't drifted or gotten worse over time. Very smart approach. Yeah. Meanwhile, the law firm Allen & Overy rolled out an AI platform called Harvey to 3,500 lawyers but governed it with a strict workflow rule. Every output must be reviewed by a human lawyer before leaving the firm.

[00:17:35] And Kaiser Permanente did something similar with a clinical AI tool, building patient consent and clinician review directly into the software's interface. So they aren't banning it. They're just building guardrails. Exactly. Now, step three is investment in role-based AI literacy. We mentioned the EU AI Act's requirement for training earlier. A generic, hour-long, mandatory training video that people play in the background while answering emails is not going to cut it. We've all done that. Right.

[00:18:04] The training must be highly specific to the employee's actual job. The UK government proved how critical this is during a massive co-pilot trial with 20,000 users. They found that participants saved an average of 26 minutes per day, but that time savings only materialized when users received proper continuous training on how to write effective prompts. If you just hand someone the tool without the map, they hit that jagged frontier and give up.

[00:18:30] J.P. Morgan approaches this through a program called AI Made Easy, which offers entirely different curriculums for an executive looking to summarize reports versus, say, a data scientist trying to write Python code. Which is brilliant. But step four is crucial. None of this works without addressing the psychological toll we discussed earlier. Organizations must actively create psychological safety and offer amnesty for past disclosure. Amnesty.

[00:18:58] Like, we won't fire you for what you did yesterday. Exactly. If leaders don't intentionally lower the cost of telling the truth, employees will just remain in the shadows. Leadership has to stand up in a town hall and explicitly say, outside of malicious data theft, tell us what AI tools you've been secretly using to get your job done. You will not be punished. We actually want to know so we can buy the secure enterprise versions of those exact tools for you. Moderna executed this brilliantly.

[00:19:27] Instead of auditing laptops and firing people for unauthorized use, they hosted AI prompt contests. A contest. Right? That's fun. Right. They intentionally surfaced the hidden talent, identified 100 of their most prolific power users, named them generative AI champions, and gave them dedicated office hours to teach their colleagues. Which leads right into step five. Harvesting grassroots experimentation.

[00:19:53] Once Moderna brought those users into the light, the innovation scaled incredibly fast. Within two months of adopting a sanctioned AI platform, Moderna employees have built 750 custom GPTs. In just two months. Yeah. And just to clarify, a custom GPT is basically an AI chatbot wrapped in a very specific set of permanent instructions.

[00:20:15] So instead of a generic assistant, an employee builds a bot specifically trained to summarize vendor contracts or answer HR policy questions. And these 750 custom tools weren't built by a back office IT team. They were built by the frontline employees who actually do the work every day. That's the best part. If we connect this to the bigger picture, Dr. Westover is arguing that AI governance cannot be a static rule book. It must be a living, breathing system.

[00:20:45] It requires a fundamental shift in leadership philosophy. Moving away from an enforcement mindset, which is about policing AI, toward a capability mindset, which is about leading AI. It completely flips the dynamic. You stop viewing your workforce as a constant security threat that needs to be monitored, and you start viewing them as an incredibly resourceful, decentralized research and development department. Shadow AI is not the disease. It is a diagnostic symptom.

[00:21:13] It reveals exactly where your approved legacy tools are failing, where your training is non-existent, and where the trust between management and staff has frayed. So, to summarize the core takeaway from this deep dive, Shadow AI is not a compliance failure. It is a massive flashing signal of unmet demand in your organization. Absolutely. I want you to reflect on your own daily routine for a second. Are you a Shadow AI user?

[00:21:41] If you are pasting PDFs into hidden tabs, what is your usage signaling to your boss? What tool are you desperately hoping they will actually buy for your team so you don't have to hide anymore? And if you are a leader listening to this, are you paying attention to that signal, or are you just trying to build a taller fence that everyone is going to climb over anyway? Because the organizations that dominate this next decade will be the ones that invite that hidden experimentation out of the shadows and give it a safe place to grow. Couldn't agree more. So, what does this all mean?

[00:22:10] We've spent this whole time talking about employees secretly smuggling AI chatbots into work to help them write emails or summarize long documents. But technology is moving at a breakneck pace. We are already seeing the transition from conversational chatbots to autonomous AI agents. Software that doesn't just answer questions, but can actually log into different applications, click buttons, and execute complex workflows entirely on your behalf. That is absolutely the next frontier of this technology.

[00:22:40] So, if employees today are secretly using chatbots to shave an hour off their tasks, what happens in two or three years? It's a crazy thought. Will we see the rise of the shadow employee? Picture a worker who secretly delegates their entire end-to-end job to a custom-built autonomous AI agent. They kick their feet up, let the agent do 100% of the work, and just collect a paycheck while the company remains totally oblivious.

[00:23:04] Are we ready for a corporate world where we don't even know if the person on the other end of the screen is actually the one doing the work? Something to think about. Let's go. Let's go. I said it.