Bottom line: Shadow AI grows not because employees rebel, but because governance infrastructure cannot keep pace with the speed of SaaS AI tools.
Employees are massively using unauthorised AI tools – not out of malice, but because governance processes are too slow. For CTOs, this is a loss of control that policies alone cannot solve.
The discourse on “Shadow AI” too often focuses on employee behaviour: Are they using unapproved tools? What data are they uploading? Yet this perspective misses the actual problem. An analysis of the Omnissa report “State of Digital Workspace 2026” documents that AI assistants grew by nearly 1,000 percent in the preceding year – the fastest-growing category in the workplace. This is not about pilot projects or controlled procurement, but organic diffusion driven by everyday applicability.
Thomson Reuters shows that almost half of employees using AI would continue to do so even if their employer prohibited it. Adaptive Security reports that 80 percent of employees are already using unauthorised generative AI applications. This is not a compliance problem of individuals – this is governance failure. Employees do not choose rule-breaking; they choose efficiency: an AI tool can be discovered on a Monday morning, activated by lunch, and integrated into the workflow by end of business. Traditional IT approval processes take weeks or months.
Many organisations respond with restriction policies: access blocks to public AI tools, upload restrictions, additional governance layers. This is understandable – Okta shows that over 50 percent of organisations reported an AI-related security incident or near-miss in 2024. Sensitive data can be exposed, trade secrets disclosed, regulatory obligations violated. The EU AI Act simultaneously tightens requirements for transparency, accountability and risk management.
For CTOs, this means: pure access restrictions lead to an arms race with the workforce. The solution must lie in fundamentally accelerating governance processes and simultaneously combining decentralised approval models with central control – evaluate instead of block, approve instead of prohibit.
Source: www.it-daily.net · Published 13 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.