Ask a leadership team how much AI their employees use, and you will probably get a confident answer.
“We’ve approved a few tools.”
“We have a pilot underway.”
“Only certain teams have access.”
“IT is monitoring usage.”
All of those statements may be true.
They may also have very little to do with reality.
Because while the organization is discussing its AI strategy, employees are already experimenting.
Someone is using an AI assistant to rewrite emails.
Someone else is summarizing meeting notes.
A product manager is using it to analyze customer feedback.
A developer is generating code.
A finance analyst is building a spreadsheet formula.
A salesperson is preparing a proposal.
A recruiter is drafting interview questions.
None of this necessarily appears on the official AI roadmap.
And that is the point.
“The AI strategy you approved is only part of the AI your organization is already running.”
The shadow AI problem is different now
Organizations have dealt with “shadow IT” for decades.
Employees find tools that help them get work done.
Sometimes those tools are approved.
Sometimes they are not.
AI makes the behavior easier because the barrier to entry is exceptionally low.
An employee doesn’t need a six-month software implementation to start using an AI capability.
They can open a browser, type a question and get an answer.
That creates an unusual situation for leadership.
The technology adoption curve can move much faster than the governance curve.
By the time an organization publishes its AI policy, employees may already have developed their own ways of working with AI.
Some of those practices may be highly productive.
Some may create risk.
Most leaders simply don’t know which is which.
Your approved tools are not your actual AI footprint
This is where many organizations underestimate the problem.
They measure what IT has purchased.
That is useful information.
It is not the same as measuring what employees actually use.
An organization might officially support one enterprise AI assistant.
Employees might also be using publicly available models, browser extensions, transcription tools, coding assistants, specialized industry applications and AI capabilities embedded inside software they already use.
The AI may not even look like AI from an employee’s perspective.
It may simply appear as a new button inside an existing application.
That makes traditional software inventories increasingly incomplete.
The relevant question is no longer:
“What AI tools do we provide?”
It is:
“Where is AI entering our work?”
The first problem is visibility
Before leadership can govern AI effectively, it needs a reasonable picture of current behavior.
That does not mean monitoring every prompt an employee submits.
It means understanding the patterns.
Which functions are using AI?
For what kinds of work?
How frequently?
With what data?
For what business outcomes?
Which tools are appearing repeatedly?
Where are employees finding the most value?
Where are they encountering problems?
Where are they creating workarounds because official tools are not meeting their needs?
These questions can reveal something important:
Employees are often showing you where the organization has unmet demand for better ways of working.
The answer should not automatically be to shut that behavior down.
It may be to learn from it.
Shadow AI isn’t automatically bad
There is a tendency to treat unapproved AI use as a compliance problem.
Sometimes it is.
But that is only part of the story.
An employee who finds a way to summarize a 60-page document in five minutes may have discovered a legitimate productivity opportunity.
A sales team experimenting with AI proposal drafting may be demonstrating a use case worth scaling.
A customer-service team using AI to organize case notes may have found a workflow improvement that the formal technology roadmap never considered.
The organizational mistake is to treat all experimentation as either acceptable or unacceptable.
There is a third option:
Learn from it.
Find out what people are doing.
Understand the value.
Assess the risk.
Then decide what should be supported, constrained, redesigned or stopped.
“The question isn’t whether employees are experimenting with AI. The question is whether the organization is learning from the experimentation.”
But the risks are real
The fact that an AI use case is productive does not make it safe.
Employees may paste confidential information into external tools.
They may use customer data in ways the organization has not approved.
They may rely on generated content without appropriate review.
They may unknowingly expose intellectual property.
They may use AI for decisions that require human judgment.
They may create automated processes that nobody else knows exist.
And because many of these activities happen outside formal technology channels, traditional controls may not catch them.
This is where leadership needs nuance.
A blanket prohibition may push useful experimentation further underground.
No governance may allow risk to spread unchecked.
The objective is to create a controlled path from experimentation to responsible adoption.
Policy isn’t enough
Many organizations respond by publishing an AI policy.
Employees receive an email.
Everyone acknowledges the policy.
A few months later, the behavior continues.
Why?
Because policy tells people what they should not do.
It does not always tell them what they should do instead.
If an employee wants to use AI to summarize customer feedback, what approved tool should they use?
What information can they provide?
What information must they remove?
What level of human review is required?
What happens when the AI produces an uncertain answer?
Who can they ask?
Good governance makes the safe path practical.
If the compliant process takes 45 minutes and the unofficial process takes 45 seconds, behavior will eventually tell you which one employees prefer.
The best use cases may already be hiding in plain sight
There is an upside to all this unofficial experimentation.
Employees are conducting thousands of small experiments on behalf of the organization.
They are testing where AI helps.
They are discovering where it fails.
They are adapting it to real workflows.
They are finding use cases that may never appear in a top-down strategy exercise.
Leadership should pay attention.
Instead of asking only:
“Which AI use cases should we launch?”
ask:
“What are our employees already trying to do with AI?”
That question can produce a surprisingly valuable pipeline.
The sales team may already have a working approach to proposal generation.
The legal team may have developed a document-review workflow.
Operations may be using AI to classify requests.
Finance may be automating parts of analysis.
These experiments can become the starting point for a more deliberate AI portfolio.
But don’t confuse experimentation with production
There is an important boundary.
An employee experimenting with AI to brainstorm ideas is very different from an AI system making decisions that affect customers, employees or financial outcomes.
The higher the consequence, the stronger the governance needs to be.
A useful approach is to think in terms of risk tiers.
Low-risk experimentation might involve drafting, brainstorming or summarization using non-sensitive information.
Moderate-risk use might involve internal business information, operational analysis or workflows that require review.
High-risk use might involve sensitive data, customer decisions, regulated activities, financial commitments or autonomous actions.
The governance model should reflect the consequences.
Not every use case needs a committee.
Not every use case should be treated like a casual experiment.
Measure outcomes, not just tool usage
Once an organization begins understanding its AI footprint, another question becomes important:
What is all this usage actually accomplishing?
Ten thousand AI interactions sound impressive.
They don’t necessarily mean much.
Leadership should look for evidence of:
- time saved
- faster cycle times
- increased throughput
- improved quality
- reduced rework
- better customer experience
- reduced operating costs
- increased revenue
- improved employee experience
This connects AI usage to business value.
It also helps identify experiments worth formalizing.
If a team has been using an AI tool for six months and nobody can explain what improved, that is useful information too.
The governance model needs a front door
Organizations need somewhere employees can go with AI ideas.
Not just a policy page.
A real path.
Employees should be able to ask:
Can I use this tool?
Can I use this data?
Is there an approved alternative?
How should I evaluate this use case?
Can I pilot it?
What controls do I need?
How do I get support?
This creates a bridge between experimentation and enterprise adoption.
Without that bridge, organizations tend to oscillate between two extremes:
“Everyone can do whatever they want.”
and
“Nobody is allowed to use AI without approval.”
Neither is a particularly effective long-term operating model.
Five questions leadership should ask now
If you don’t know how much AI your employees are already using, start with five questions:
1. What AI capabilities are already embedded in the software we use?
The AI footprint is probably larger than the AI tool inventory.
2. What external AI tools are employees using?
Look for patterns rather than trying to catalogue every individual experiment.
3. What types of work are employees using AI to perform?
This reveals both opportunity and risk.
4. Where is sensitive information entering AI workflows?
This should be a priority for governance.
5. Which employee-led experiments are producing measurable value?
Those may be your strongest candidates for formal adoption.
The objective is not perfect visibility.
It is enough visibility to make intelligent decisions.
The Cybaxis perspective
The most important AI activity in your organization may not be happening inside the AI program.
It may be happening quietly, one employee at a time.
That should not automatically trigger panic.
It should trigger curiosity.
Your employees are already telling you where they see opportunities to work differently. They are also revealing where policies, controls and technology have not caught up with the pace of adoption.
The leadership challenge is to turn that activity into something the organization can understand and manage.
Find the experiments.
Understand the value.
Identify the risks.
Provide approved paths.
Scale what works.
Stop what doesn’t.
And make the rules clear enough that employees know where they stand.
Because by the time your AI strategy is finished, your workforce will already have one.
The question is whether the two strategies are going to meet.
Cybaxis helps organizations understand their emerging AI footprint, identify high-value use cases, establish practical governance and build operating models that turn employee experimentation into responsible enterprise adoption.
If you’re only measuring the AI your company has officially approved, you’re probably measuring the smallest part of the story. Let’s find out what is already happening—and what it means for your business.