SemantiqWall
PT EN
Sign in I'm a vendor

← Blog

Banning AI doesn't stop its use

Employees are already using unsanctioned AI tools at work. The answer isn't simply banning AI. It's building governance that makes safe use easier than shadow use.

· 4 min read · By Murilo Martins, founder of SemantiqWall

Cover: approved AI use flowing through a governance shield versus shadow AI flowing to public tools, with the 66% and 88% survey figures.

Your company may already have an AI policy. Your employees may already be ignoring it.

That sounds provocative. The numbers suggest it isn't unusual.

PagerDuty's Shadow AI Workplace Survey 2026, summarized by StartSe, heard 1,250 office professionals at companies with revenue above US$500 million in the United States, the United Kingdom, Australia and Japan. According to the report, 66% said they had used an unauthorized AI tool at work, and 88% had shared some kind of work information with a public AI service.

This has a name: Shadow AI.

And banning AI doesn't make it disappear. It makes it harder to see.

Shadow AI is the new shadow IT

Security teams have dealt with shadow IT for decades. People adopt tools because the approved option is too slow, too restrictive or just not useful enough.

AI follows the same pattern, only faster.

  • A worker has a report to summarize. They paste it into a public chatbot.
  • A salesperson wants help replying to a customer. They paste the email into an AI tool.
  • A manager wants a meeting summarized. They upload the notes.

Each of these takes seconds. And each may move company information outside approved boundaries.

According to the same survey, 43% had shared emails or correspondence with public AI tools, 40% had shared meeting notes or summaries, and 34% had entered customer information.

The problem isn't adoption. It's invisible adoption.

Companies won't realistically stop people from discovering that AI makes some tasks faster.

Trying to eliminate the technology altogether can backfire: people keep using it, and stop telling the company.

Now security loses visibility. Compliance loses visibility. Management loses visibility. Audit loses visibility.

The organization gains neither safety nor control. It just gains hidden risk.

A ban is not a governance architecture

A policy that says "do not use public AI tools" is easy to write.

Real AI governance has to answer much harder questions:

  • Which models are approved?
  • Who may use them?
  • Which categories of data can be submitted?
  • Which actions are allowed?
  • Which tools can agents access?
  • Where are conversations stored, and for how long?
  • Can sensitive data leave the organization?
  • Are actions auditable?
  • What happens when a policy is violated?

Without technical enforcement, governance depends entirely on people's behavior. That rarely scales.

Make the safe path the easiest path

The best AI security program isn't necessarily the one with the most restrictions. It's the one where secure behavior is easier than insecure behavior.

If the approved assistant is much worse than the public alternatives, people will find a way around it. So security has to come with usability.

Give people strong AI tools, and wrap them in identity controls, data classification, policy enforcement, logging, approved models, safe connectors, role-based permissions, DLP controls and auditable workflows.

Then people get the benefit of AI without sending sensitive information into systems the company can't govern.

Shadow AI is also a data-flow problem

Traditional security often thinks in applications: is this application approved?

Agentic AI needs another angle: where is the information going?

An approved AI application can still become dangerous if it sends sensitive information through an unsafe plugin. An unapproved tool might never receive anything confidential.

So risk depends on context: user, data, tool, destination, action and purpose.

That's why security can't rely only on blocking domains. It has to understand the nature of the attempted action.

Governance should follow the data

Imagine someone asks an AI: "Summarize this document."

If the document is public marketing material, that's probably harmless. If it holds customer records, intellectual property or legal strategy, the same request becomes a different security event.

The instruction is identical. The meaning of the action isn't.

That's the limit of purely syntactic controls. AI governance will increasingly need policy engines that evaluate context before sensitive information or actions cross the organization's boundaries.

Companies that govern AI well will probably use more AI, not less

Security is sometimes framed as the opposite of innovation. That's the wrong relationship.

Strong security can enable more autonomy. If every agent action is authenticated, authorized, monitored and auditable, a company can safely give AI more responsibility. If none of those controls exist, it's forced to restrict AI simply because it can't trust the environment around it.

So the goal shouldn't be less AI. It should be more controlled AI.

Shadow AI shows that people have already voted with their behavior. They want these tools. Now organizations have to decide whether AI use stays invisible, or becomes governed infrastructure.

Don't hide AI use. Govern it.

Sources

Read also