Your Employees Are Already Using AI. Who Is Accountable?

Artificial intelligence rarely enters an organization through a single, carefully governed programme. It arrives through everyday decisions: an employee summarizes a confidential document, a manager tests an AI assistant, a marketing team generates campaign material, or a finance professional asks a public model to analyse data.

By the time leadership begins discussing an AI policy, employees may already be using several tools across multiple business processes. The question is therefore no longer whether the organization uses AI. The practical question is: who is accountable for how it is being used?

This is the challenge of shadow AI governance: making existing AI use visible, assigning ownership and applying proportionate controls without suppressing useful innovation.

AI Adoption Often Begins Before Governance

Most employees do not intend to create risk. They are trying to work faster, improve quality or solve a problem. Easy access to generative AI means that experimentation can begin without procurement, IT integration or formal approval.

This creates a gap between operational reality and executive visibility. Leadership may believe that AI remains at the pilot stage while employees are already relying on it for research, drafting, translation, customer communication, analysis and decision support.

The gap matters because the organization remains responsible for the consequences. A tool may be used informally, but the data, decisions and outputs can still affect customers, employees, contracts, regulatory obligations and reputation.

A credible governance response starts by accepting this reality. It does not begin with the assumption that all unapproved use is misconduct. It begins by discovering where AI is already creating value, where exposure exists and where management attention is required.

Shadow AI Is a Governance Issue, Not Only a Security Issue

Shadow AI is often treated primarily as an information-security problem. Security is essential, particularly when employees enter personal, confidential or commercially sensitive information into external systems. But the governance challenge is broader.

An AI system can create material business consequences even when no data breach occurs. An inaccurate summary may influence a management decision. Generated content may contain unsupported claims. An automated recommendation may disadvantage a customer or employee. A supplier’s model may change without the organization realizing that its outputs have changed.

Effective oversight must therefore connect several dimensions:

• Data: What information is entered, retained or shared?
• Purpose: What business activity does the use support?
• Decision impact: Does the output inform or determine a consequential decision?
• Human judgement: Who reviews the output and can challenge it?
• Accountability: Who owns the result when something goes wrong?
• Oversight: How are performance, incidents and changing risks monitored?

This is why shadow AI cannot be resolved simply by publishing a list of permitted tools. Tool approval is useful, but governance must also address how an approved tool is used, for what purpose and under whose authority.

Five Questions Leadership Must Be Able to Answer

Boards and executive teams do not need a catalogue of every prompt written by every employee. They do need enough visibility to answer five practical questions.

1. Where is AI already being used?

The first step is an evidence-based inventory. It should cover formal systems, embedded AI features, external platforms and employee-led experimentation. The objective is not surveillance. It is to identify material uses and recurring patterns that may require common guidance.

2. Which uses can materially affect the business?

Not every use deserves the same control. Drafting an internal meeting agenda is different from evaluating a job applicant, preparing financial advice or communicating a binding customer decision. Governance should focus attention according to potential impact.

3. Who owns each important use case?

Technical teams can manage infrastructure and security, but business owners must remain accountable for purpose, process and outcome. Every material use should have an identifiable owner with authority to approve, change, suspend or retire it.

4. What must remain subject to human judgement?

Human oversight should be designed, not assumed. The organization should specify who reviews outputs, what evidence they need, when escalation is required and whether the reviewer has sufficient time, competence and independence to intervene.

5. How will management know that controls still work?

AI governance does not end at deployment. Models, suppliers, data and business conditions change. Leadership needs proportionate monitoring of performance, incidents, complaints, exceptions and emerging obligations.

Visibility Without Banning Useful Tools

A blanket ban may appear decisive, but it can drive experimentation further underground and prevent the organization from learning where AI is already producing value. An unrestricted approach creates the opposite problem: employees make risk decisions individually without a shared framework.

The better objective is controlled visibility. Employees should have a simple way to disclose current uses, ask questions and request approval without facing an unnecessarily slow process. Management should distinguish low-impact productivity assistance from uses that affect rights, obligations or important business outcomes.

A proportionate model may include:

• a short list of prohibited data and activities;
• approved tools for common low-risk tasks;
• a lightweight registration process for new use cases;
• enhanced review for higher-impact applications;
• clear responsibility for third-party AI providers;
• training based on real roles and decisions, not generic awareness alone.

The goal is not to make every AI use bureaucratic. It is to ensure that the level of control reflects the significance of the decision and the potential consequences.

A Practical 30-Day Response

Organizations do not need to wait for a perfect enterprise framework before acting. A focused first month can establish a credible baseline.

Days 1–7: Discover and inventory

Ask business units where generative AI and other AI-enabled systems are already being used. Include tools embedded in software subscriptions, supplier platforms and informal workflows. Record the purpose, data involved, users and expected benefit.

Days 8–14: Classify by impact

Group use cases into practical risk tiers. Consider effects on people, confidential information, financial decisions, contracts, compliance and reputation. Identify uses that require immediate containment as well as low-risk practices that can continue under simple guidance.

Days 15–21: Assign ownership and decision rights

Name a business owner for every material use case. Clarify who approves it, who reviews outputs, who monitors performance and who can stop the process. Document exceptions and escalation routes.

Days 22–30: Implement proportionate controls

Prioritize a small number of controls that can actually be followed: approved tools, data rules, human review, supplier checks, incident reporting and periodic monitoring. Communicate them in plain language and test whether they work in real workflows.

This first cycle will not solve every governance question. It will replace uncertainty with a visible portfolio, accountable owners and a practical basis for continuous improvement.

From Policy to Accountable Use

A policy can state expectations, but it cannot create accountability by itself. Accountability exists when ownership, decision rights, controls and evidence are connected to everyday operations.

Through SP AICO™ — AI Consulting & Oversight, Swisspresence helps boards and leadership teams establish this connection. The approach combines AI strategy, governance, risk management and continuous oversight so that AI use remains aligned with business value and organizational responsibility.

Frequently Asked Questions

What is shadow AI?

Shadow AI is the use of AI tools or features outside the organization’s established visibility, approval or governance processes. It can include public generative AI services, embedded software features and informal experiments.

Should an organization ban all unapproved AI tools?

Immediate restrictions may be necessary for sensitive data or high-impact decisions, but a blanket ban can drive use underground. A proportionate approach combines clear prohibitions with approved tools, disclosure and risk-based review.

Who should own AI governance?

Governance requires coordinated executive leadership. Technology, security, legal and compliance functions provide essential expertise, while business owners remain accountable for purpose, operational use and outcomes.

How can a small or mid-sized organization begin?

Begin with a focused inventory of current use, classify material impact, assign owners and implement a small set of controls that employees can realistically follow. Expand the framework as experience and exposure grow.