Who Is in Command of the AI Systems Nobody Knows About?

A company may believe that it has approved and controlled a small number of AI systems. Meanwhile, employees may be using personal AI accounts, departments may be funding their own experiments and software suppliers may be adding AI agents to products that the company already uses.

The result is a simple but serious problem: the organisation may have more AI operating inside it than its leaders know about.

Forrester has forecast that, during 2027, one in three large Asia-Pacific enterprises will discover at least ten employee-built shadow AI agents for every officially sanctioned agent. Forrester describes agents being built by employees, embedded by software suppliers, funded by business units or selected by local teams faster than the organisation can identify, govern or retire them. This is a forecast, not a measured account of every organisation today, but the direction of travel is credible and the management problem already exists.

You cannot command what you cannot identify

An ordinary AI assistant may produce text, analyse information or suggest an answer. An AI agent may go further. It may open records, send emails, change files, contact customers or undertake transactions. That makes unofficial use more than an information-security problem. It becomes a question of authority and command.

Who approved the agent? What information can it access? What actions may it take? Who checks its work? Who can stop it? If nobody can answer those questions, the company is carrying responsibility for activity it does not properly control.

You cannot manage what you do not know exists, orchestrate what you cannot identify, or command what you cannot control.

Start with approved AI products

The practical answer is not to prohibit AI altogether. Companies already approve the software that employees may use for work. AI can be handled in a similar way through a clear list of approved AI products, alongside the organisation's separate list of approved general software.

Product approval should not, however, become a blank cheque. A product may be suitable for one purpose but unsafe for another. The company should approve three things:

• The product: which AI service or system may be used?

• The purpose: for which work and types of information may it be used?

• The permissions: what may it see, change, send or purchase?

A company might approve an AI product for general research and drafting but prohibit the entry of confidential customer records. It might approve the same product as an assistant while requiring separate testing before any agent function is allowed to send messages, alter files or make purchases.

The same care is needed when AI is added to software that is already approved. Approval of the original software should not automatically approve every new AI feature subsequently embedded within it.

Prohibited for work does not mean prohibited in private life

The boundary must be clear and reasonable. A company policy should control AI used for company work, not attempt to govern an employee's private use of AI outside work.

The organisation has a legitimate interest when AI is used:

• to perform company business;

• with company, customer or supplier information;

• through company accounts, devices or systems;

• to communicate on the company's behalf; or

• to make or influence company decisions.

At that point, the company needs reasonable assurance of safety, security, confidentiality, reliability, legal compliance and alignment with its purposes, policies and values. The test is the purpose for which the AI is being used—not merely who owns the account or device. A personal AI account used on a personal phone to process company information is still being used for work.

The device still matters

Hybrid working extends the company's security boundary into homes, journeys and shared workplaces. An approved AI product can still expose confidential information if a laptop is left on a train, a personal device stores company files or an active account gives access to cloud systems and AI agents.

Company work should therefore use properly secured devices and accounts wherever possible. Encryption, automatic locking, security updates, multifactor authentication, restricted local storage and the ability to cancel access or wipe a lost device should support a simple rule: report any loss immediately. The company must provide suitable equipment and clear arrangements rather than merely telling employees to be careful.

Further information: UK National Cyber Security Centre device-security guidance

Make the approved route the easy route

Most employees are not trying to undermine their employer. They are trying to complete their work. If approved AI products are useful, accessible and supported, staff are likely to become accustomed to using them for appropriate purposes, just as they use approved company software now.

Problems arise when the approved route is slow, inadequate or surrounded by unnecessary obstacles. Employees may then turn to personal accounts and unofficial tools simply to get the job done. A prohibition without a workable alternative encourages concealment rather than control.

The company should therefore explain its rules in plain language:

• These are the AI products you may use for work.

• These are the purposes for which you may use them.

• Do not enter confidential information unless permission is explicit.

• Do not allow AI to take important actions without the required approval.

• Ask this named person if you are unsure.

Staff should also have a safe way to disclose AI tools and practices already in use. The first objective should be to discover and correct risks, not to punish people for revealing them. Otherwise, the systems the company most needs to find may remain hidden.

A simple register and a named owner

Every approved AI product or agent should appear in a simple organisational register. The record need not be complicated, but it should identify:

• the product or agent and its supplier;

• the work it is approved to perform;

• the information and systems it may access;

• the actions and spending it is permitted to undertake;

• the person responsible for its use;

• how its important work is checked and recorded; and

• who can restrict, pause or stop it.

That register connects management, orchestration and command. Management decides what is permitted. Orchestration brings the people, processes and systems together. Command ensures that somebody has the competence and authority to intervene.

Control without preventing useful work

Shadow AI should not be used as an excuse to treat every employee as a potential offender. Nor should enthusiasm for AI be allowed to create an uncontrolled collection of products, accounts and agents. The practical objective lies between those extremes.

In time, approved AI should become as ordinary as approved company software. The aim is not to prevent employees using AI, but to give them useful tools they can employ confidently for appropriate purposes.

The important rule is straightforward: approve the product, the purpose and the permissions—not merely the brand name.

This issue is examined in Succession: AI, Human Capability and the Future of Human Command, including shadow AI, unapproved agents and the need to discover, classify and control existing use. A simpler starting point is provided in A Simple Guide to Implementing AI in a Company.

For more information visit: ai-humancapability.com