About

Fifty notes on shadow AI and AI usage monitoring, written for whoever has to decide what the organisation does about it.

The position

Shadow AI is not misconduct but information. Every instance says the task was hard enough that somebody went looking, and the approved route did not cover it.

A ban ends the visibility, not the use. It moves activity to personal devices and accounts where there are no logs, no contracts and no controls.

Rules should be about information, not tools, because categories change on a scale of years and tools on a scale of months.

Who it is for

People running or considering a programme in this area: security, legal, IT and the business, all of whom own part of it.

What is deliberately absent

Product, supplier and model names. The field moves faster than any list, and every comparison online is written by somebody selling one of the options.

Adoption percentages, which come from surveys commissioned by companies selling controls.

And any claim that the risk can be eliminated.

Nothing here is legal advice

Requirements in this area differ substantially by jurisdiction and sector, and are arriving quickly. Take advice on your own position.

About this domain

This address previously carried an unrelated organisation's website, which is no longer here. There is a page about that.