Shadow AI is not primarily a technology problem. It is a behaviour problem, and the behaviour it reflects is rational.
When employees adopt AI tools outside the official governance process, they are not usually acting carelessly. They have assessed the situation and reached a conclusion: engaging with the governance process carries costs; time, uncertainty, the risk of a flat refusal, that outweigh the costs of quietly using the tool. Avoidance is the logical response to a system that has made caution feel expensive.
This is the part of the ai governance conversation that rarely gets named. Governance programmes focus on what employees should do. They pay less attention to what the governance system is telling employees by how it works, and what behaviour it produces as a result.
The Calculation Employees Are Making
An employee who wants to use an AI tool for a legitimate work task faces a choice. They can engage with the official governance process; submit a request, wait for IT review, risk being told no, explain to their manager why the tool is delayed. Or they can sign up quietly, use the tool, and keep the exposure low.
The second path is faster, less uncertain, and carries no immediate visible consequence. The governance risk is abstract and future. The productivity benefit is concrete and present. Every time the official process is slow, opaque, or ends in a refusal without clear reasoning, it tips the calculation further toward avoidance.
A Fishbowl survey of over 11,700 professionals found that 70% of those using generative AI at work had not disclosed that usage to their employer. That figure is not primarily a measure of dishonesty. It is a measure of how many people concluded that non-disclosure was the lower-friction path. The governance process was available to them. They chose not to use it.
The implication for CISOs and IT Directors is uncomfortable: shadow AI is not evidence that employees do not care about governance. In many cases, it is evidence that the governance system they encountered taught them that avoidance was the smarter choice.
How Caution Becomes the Team's Default
The avoidance pattern does not stay individual. Once a few team members have found that the official AI governance process is slow or opaque, the informal knowledge spreads. New team members are shown the official process and then shown how things actually get done. The workaround is not documented, but it is transmitted, through onboarding conversations, Slack messages, and the quiet observation that nobody who took the unofficial route faced consequences.
Over time, the team's default shifts. The governance process is still there. It is just not the path anyone uses unless they are specifically asked to demonstrate compliance. Decisions about AI tool adoption get made informally, in channels where the governance system cannot see them, at a speed the official process cannot match.
This is where the enterprise risk management exposure becomes structural. The AI governance programme exists on paper, but the actual AI adoption decisions are happening outside it, in channels where the governance system cannot see them, at a speed the official process cannot match. What the register shows and what teams are actually using have diverged, and that gap is the unpriced risk. It widens every week without any obvious signal that something is wrong.
What the Governance System Is Communicating
Every governance programme communicates something beyond its written rules. It communicates, through how it works, what the organisation values and what it tolerates. A governance system that is slow communicates that speed matters less than process. A governance system that regularly refuses AI tools without explanation communicates that the default answer is no. A governance system that is hard to find or navigate communicates that the organisation does not expect employees to use it.
Employees read these signals accurately. When the official process communicates that caution and avoidance are the rational defaults, that is exactly what they produce. The shadow AI that results is not a failure of employee judgement. It is the system producing the behaviour it designed for, even if that was not the intention.
This is the hardest observation for security governance teams to sit with: an ai governance programme that produces widespread avoidance is not a programme that is being ignored. It is a programme that is working exactly as its design implies, just not in the direction anyone intended.
The AI Compliance Cost of Avoidance
When employees route around AI governance, the immediate consequence is a shadow AI estate that grows outside the visibility of the security and compliance team. But the downstream cost is more specific than that.
GDPR Article 30 requires a record of every processing activity involving personal data. The AI tools employees are using informally, the ChatGPT sessions where customer queries get drafted, the AI writing tools where internal documents are processed, the productivity platforms where personal data is input, are processing activities that belong in that record. They are not there because they were never declared. The RoPA is incomplete not because the DPO failed to maintain it, but because the governance process that feeds it was never engaged.
EU AI Act Article 26 requires deployer oversight of AI systems in use - human oversight, logging, and use in accordance with the intended purpose. None of these requirements can be satisfied for tools the organisation does not know it is running. If the avoidance pattern is widespread, the deployer obligations that apply from August 2026 are unmet not because the organisation chose to ignore them, but because the governance process that would have surfaced the tools was too costly for employees to engage with.
The regulatory exposure created by avoidance is not different in character from the exposure created by deliberate non-compliance. A supervisory authority reviewing an incomplete Article 30 record does not distinguish between tools that were deliberately concealed and tools that were never declared because the governance process discouraged declaration. The gap in the record is the same either way.
What Changes When Governance Stops Making Avoidance the Rational Choice
Governance programmes that produce compliance rather than avoidance make engagement easier than avoidance. That sounds straightforward. It is harder to achieve than it sounds, because most governance programmes were not designed with the employee's friction calculation in mind, they were designed with the compliance requirement in mind, which is a different starting point.
An AI tool request that receives a response within 48 hours, even a conditional approval with specific data handling requirements, is a process that employees will use again. One that takes three weeks and ends in an unexplained refusal will not. The speed and clarity of the response matters as much as the answer itself, because it is what tells employees whether the official path is worth using next time.
Governance boundaries that carry visible reasoning are more likely to be respected than rules without explanation. When an employee understands why a particular AI tool is not approved, it processes customer data without an adequate DPA, it lacks an EU AI Act conformity declaration, it routes data through servers outside the EEA, they can apply that reasoning to the next tool they encounter. Compliance automation that embeds these checks into the adoption workflow removes the friction at the point of decision, rather than placing it before an employee who may decide the effort is not worth it.
IBM's 2024 Cost of a Data Breach Report found that shadow data in unmanaged sources was a factor in 35% of data breaches. Shadow AI sits in that category, not because organisations decided to leave it ungoverned, but because the governance process that would have brought it in was harder to engage with than the workaround. Reducing the cost of engaging with governance is not a soft cultural objective. It is what determines whether the ai governance programme reflects the actual estate or just the portion of it that found the official process navigable.
An AI governance programme that produces avoidance has already decided what the AI estate looks like, it just has not looked at the result. The question is not whether teams are using AI tools outside the process, because they already are. The question is whether the programme is designed to surface that fact or designed in a way that guarantees it stays hidden. - Ankur Arora, Co-Founder, Montro |
Frequently Asked Questions
Why do employees use AI tools outside the governance process?
Because the official process makes avoidance the lower-friction option. When an AI tool request takes weeks, ends in an unexplained refusal, or requires documentation that feels disproportionate to the tool's risk level, employees calculate that the productivity cost of waiting exceeds the perceived risk of using the tool quietly. Shadow AI is not primarily a carelessness problem, it is a friction problem. The governance process is available. Employees are choosing not to use it because the cost of using it is higher than the cost of not using it.
How does shadow AI create AI compliance exposure under GDPR and the EU AI Act?
GDPR Article 30 requires a record of every processing activity involving personal data. AI tools used informally; for drafting customer communications, processing internal documents, summarising meeting notes, are processing activities that belong in that record and are absent from it when the tools were never declared. EU AI Act Article 26 requires deployer oversight of AI systems in use from August 2026. Oversight cannot be applied to tools the organisation does not know it is running. The compliance gap created by avoidance is the same as the gap created by deliberate non-disclosure; a supervisory authority sees an incomplete record in both cases.
What does an AI governance programme that produces compliance rather than avoidance look like?
The most reliable signal is response time. An AI tool request that receives an answer within 48 hours, even a conditional approval with specific data handling requirements, is a process employees will use again. One that takes three weeks and ends without explanation will not be used again. Beyond speed, the programme needs to explain its reasoning when a tool is declined, so that the employee can apply that reasoning the next time rather than defaulting to avoidance. Proportionality matters too, excessive documentation requirements for low-risk tools communicate that the programme is not calibrated to reality, which erodes trust in the process faster than a slow response time does. The practical test: is engaging with the official process genuinely easier than using the tool quietly? If the answer is no, the programme will produce avoidance regardless of how clearly the rules are written.
Can compliance automation help reduce the avoidance pattern?
Yes, by embedding governance decisions into the adoption workflow rather than placing them before the employee as a separate exercise. When an AI tool request automatically routes to a risk classification and receives a response within a defined timeframe, the employee does not need to weigh the cost of engaging with governance against the cost of avoidance. The process handles the assessment. The employee gets a decision. Compliance automation does not eliminate the governance judgement, it removes the friction that makes employees decide the judgement is not worth requesting.
How do we find out how widespread the avoidance pattern is in our organisation?
The avoidance pattern does not surface through employee surveys or self-declaration - those produce the same undercounting as the governance process itself. It surfaces through discovery signals that operate independently of what employees choose to report: SSO logs that show tools connected without IT review, expense data that shows SaaS subscriptions outside the sanctioned list, email metadata that surfaces tools communicating with work accounts regardless of how they were adopted. The gap between what these signals reveal and what the official register contains is a direct measure of how widespread the avoidance pattern is.
