Are practices for managing shadow IT applicable to GenAI tools? If not, how are you changing your approach in order to manage shadow AI at your organization?

Shadow IT usually happens because IT isnt keeping up with the needs of the business or user.  So if you create a forward leaning approach to any new capabilities with early adopters and engagement with users/the business you will have less shadow IT in my view

We've developed a policy for utilizing Freeware and public General AI tools. We recommend that business units submit a detailed use case to guide them towards our private, secure, and pre-approved instances for enhanced security and efficiency.

Whilst they are similar, I think the big difference is that knowledge of how to use new GenAI tools is much easier to come by, so the risk of there being a key person dependency (usually very high with shadow IT) isn’t as prevalent. 
We have put in place guidelines for use to support adoption of AI, and some guardrails there to prevent exfiltration of data, but are actively encouraging adoption rather than discouraging it as we would shadow IT

We are treating employee use of AI/GenAI by adding a new section to our Acceptable Use policy, with simple but clear guidance about what is allowed and what is prohibited and what requires senior exec approval.

Yes, it should be treated the same. As usual, an understanding of the risk should be socialized enterprise wide. Employees hear about positives in the media before hearing about negatives, if the media mentions negatives at all. xAAS, BYOD and now AI all present risks from shadow IT.

An additional factor is the fact that Covid blurred the line between Shadow IT and regular IT for some, because steps were taken to ensure employees remained productive. Even now, some employees seek to continue their near autonomy with technology. 

 A clear policy on AI use would be helpful in ensuring all users know about the issue and are held accountable, in much the same way as preventing sending corporate email to personal accounts or blocking uploading corporate files to unauthorized locations.  Making the issue known takes it out of the shadows.