Are you worried about shadow AI? Do you have a formalized governance process around it?

Yes, it's a real concern. We have an GenAI Governance Council established for a couple of years now trying to streamline the intake process both to ensure there is value as well as control in place. As part of the council, we do have business partners which allows us to minimize the shadow AI, but can't totally eliminate it due to individuals can use any AI capability to incorporate into their part of the work. Part of is to educate the employees the do's and dont's which we continue to emphasize so everyone understands the risks and be compliant.

We don’t call it shadow AI; instead, we invited interested employees to join an AI working group, enabling us to monitor and guide their activities. We give them autonomy with a set budget and encourage them to share their results. This approach helps eliminate negative aspects of shadow AI and generates valuable use cases. However, there are still rogue users, and governance is an ongoing challenge.

Shadow AI is a real concern, especially with free tools and employees purchasing solutions on their own. Our industry is less regulated, which presents both opportunities and risks. We have some controls in place, such as approved large language models, but the risk is lower compared to highly regulated sectors. Governance is part of the technologist’s responsibility, and controlling shadow AI is challenging, especially on personal devices.