Ai governance goes through human skills
Shadow Ai threatens the sovereignty of data and puts hidden technical and legal errors and debts at risk. But prohibitions do not help
The history of corporate IT is, in general terms, a history of dialectical tensions between the centre and the periphery, in particular, between centralisation and decentralisation. Between those who control the infrastructure and those who must use it to produce value. If in past years we learnt to live with Shadow IT, i.e. the use of software and mobile devices in the shadow of technology managers, and in any case not approved. Today we are faced with a far more insidious and complex mutation: Shadow AI.
What are the causes?
We are facing a phenomenon in which generative artificial intelligence, accessible to anyone with a browser, is employed to perform critical tasks without the organisation's knowledge. The logical deduction is straightforward: if access to computational power has become frictionless, then traditional centralised control is no longer a sufficient curb.
Those who use AI in this way do not do so with malicious intent, but rather follow a principle of individual economic efficiency, as if to say, they are trying to maximise their productivity by bridging the gap between the demand for speed imposed by the market and the often slow response of internal processes. Unfortunately, in doing so, it ignores what it puts at risk with its operations.
What risks does the company run?
When we take these tools into the shadows, i.e. outside the perimeter of corporate governance, we expose the organisation to three existential risks that cannot be ignored.
The first is, of course, the sovereignty of the data. Putting confidential data into a public model prompt is, in many cases, tantamount to handing over that data to the model supplier for future training. It is a silent and ongoing loss of intellectual property, and thus the company's core business is in jeopardy.
