Shadow AI

How Organizations Lost Control of Artificial Intelligence — Without Noticing

By: Eduardo Valencia

Narrated by: Virtual Voice

How Organizations Lost Control of Artificial Intelligence — Without Noticing Your organization is using AI right now. Someone on your team is drafting with it, coding with it, summarizing with it. You probably know this. What you probably don't know is how many people, for which tasks, with whose data, and under what review. That gap — between what you assume and what you can describe — is shadow AI. A 2024 McKinsey Global Survey found that 72% of organizations use AI in at least one business function. Fewer than half have governance policies for generative AI. A Salesforce survey of over fourteen thousand workers found that more than half of generative AI users at work had received no training, no guidelines, and no formal approval. Eduardo Valencia draws on his experience as an AI engineer at Reddit and as a governance consultant to European technology firms navigating the EU AI Act. At one consultancy he assessed — roughly 300 people — he found 53 distinct uses of generative AI across 11 teams. None had been formally approved. None had been measured. None had been disclosed to clients. The most dangerous thing about shadow AI is that it works. Nothing breaks. That is precisely the problem. Shadow AI provides a practical governance framework: a register of uses (not tools), a risk classification, and a named person with authority to stop. It replaces the organizational shrug — "that's just how things are" — with a decision: "this is how we've decided to do it." Book 2 of the Thinking AI series. Book 1: AI Requires More Human Intelligence — why humans override systems that outperform them. Book 3: I Don't Want to Believe — how predictions become beliefs before anyone notices.