Articles
Most organizations can now say they have an AI policy. That is not the same thing as having AI governance. The difference between those two statements is where the real risk lives, and most companies have not yet made the journey between them.
A 2025 KPMG study of nearly 48,000 workers across 47 countries found that 57 percent of employees conceal their AI use from employers. In some markets, that number climbs higher. In Melbourne, for example more than 85 percent of workers reported hiding AI use from their managers. These are not rogue actors. They are people doing their jobs with the tools that seem most useful, in the absence of clear and practical guidance about what is permitted.
The Policy Filing Cabinet
Most organizations with an AI policy arrived at it one of two ways. Legal drafted something after a specific incident or a client pushed for it, or HR sent a memo when the topics got too visible to ignore. Either way, the policy gets filed, the announcement goes out, an everyone goes back to what they were already doing.
Most executives know shadow IT. Employees using personal Dropbox accounts, unauthorized SaaS tools, rogue cloud storage. It’s a real problem, but the risk is largely about data ending up somewhere it shouldn’t be. Shadow AI is different, and the difference matters.
With shadow IT, data gets stored in an unauthorized place. With shadow AI, it’s being actively processed by a model that may retain it, train on it, or surface it somewhere the organization will never see. An employee pasting a client contract into a public AI tool isn’t just moving data. They may be permanently changing what that model knows. The exposure doesn’t end when they close the browser tab.
Most AI policies miss this entirely because they were written by people applying the shadow IT risk model to a problem that doesn’t work that way.
Gartner found that 69% of organizations already have evidence or suspect this is happening inside their walls and predicts more than 40% will experience a shadow AI security or compliance incident by 2030. Those are only the incidents that surface. The ones nobody detects don’t make the count.
A policy nobody follows isn’t a safety net. It’s a liability. It creates a documented standard you can be measured against without stopping any of the behavior it was meant to address.
What Most Policies Get Wrong
The common failure isn’t that organizations lack rules. It’s that the rules don’t map to how work gets done.
A policy that says “do not use unauthorized AI tools” without telling people which tools are authorized, or what to do when they need a capability the approved tools don’t have, is not governance. It’s a wish. A policy that prohibits uploading sensitive data without defining what counts as sensitive in the context of a real Tuesday afternoon workflow is similarly useless.
Three in five employees in the KPMG study reported witnessing inappropriate AI use by colleagues. The behavior isn’t hidden because people are trying to get away with something. It’s hidden because nobody told them what appropriate looks like.
ISACA’s framework for auditing AI use in the enterprise makes a point worth taking seriously: policy development should follow discovery, not precede it. Before you write the rules, find out what your people are already doing. That’s the step most organizations skip.
What a Real Policy Covers
A functional AI governance policy isn’t a list of prohibitions. It’s a working document that answers five questions for the person using AI at their desk on any given day.
Which tools are approved, and what happens when I need one that isn’t on the list? What data can go into a prompt, and what cannot leave the organization through an AI interface? Who is accountable when AI-assisted output causes a problem? When does the organization need to disclose that AI was involved in producing client or regulatory work? And what happens if I get this wrong?
Without clear answers to those questions, you don’t have a policy. You have a document.
The Human Behavior Problem
The KPMG data includes a finding worth sitting with. Half of the employees surveyed said they feel pressure to use AI or risk being left behind. They’re not hiding it because they don’t care about the rules. They’re hiding it because the tools exist, the pressure is real, and the guidance isn’t there.
Part of what drives this is easy to underestimate. People don’t come to work as AI novices. They’ve been using it for years through voice assistants, search engines that anticipate what they’re looking for, navigation apps that reroute in real time, recommendations that seem to know what they want before they ask. AI isn’t a new idea to most employees. It’s just a new name for something that already feels like a basic feature of every tool they use outside of work. When the workplace doesn’t offer the same kind of assistance, it doesn’t feel like a policy. It feels like the company hasn’t caught up. And people don’t wait for institutions to catch up. They find a workaround.
That combination produces exactly what you’d expect: widespread use, minimal transparency, and a growing gap between what the policy says and what happens at the desk.
The organizations getting this right figured out that those employees weren’t the problem. They were the intelligence. The people already using AI in the gaps, building informal workarounds around the tools that work, they know exactly where the governance holes are. Bringing them into the policy development process doesn’t weaken the policy. It makes it real.
Building Something That Keeps Pace
AI tools evolve faster than annual review cycles. A policy written for the tools your teams used eighteen months ago may not touch the agentic AI already embedded in the software they use today. Governance needs a cadence, not a publication date. Scheduled reviews, a named owner, and a cross-functional process that puts legal, IT, HR, and the business in the same room at the same time, not in sequence.
The gap between the document and daily behavior is where organizations get hurt. Not usually in a dramatic breach event, but in the slow accumulation of undetected exposure, undocumented decisions, and undisclosed AI involvement that surfaces at the worst possible moment.
The good news is that gap is closable. It requires treating governance as an operational practice rather than a compliance exercise. Find out what your people are using. Build policy around that reality. Enforce it in a way people can follow without having to choose between doing their job and following the rules.
That’s the version of AI governance that actually works. Not sure where your organization stands? Start with an AI Opportunity Roadmap session.