Across businesses, employees are using AI tools to draft emails, prepare reports, analyse information, create presentations, and solve problems faster than ever before. In most cases, their intentions are good. They are simply trying to be more productive. The problem is that many of these tools are being used without the knowledge or approval of leadership, IT, risk, or compliance teams.
This growing phenomenon is known as Shadow AI, and it may become one of the most significant governance challenges facing organisations over the next few years.
Unlike traditional technology projects, AI tools do not require lengthy procurement processes or major capital investment. An employee can access a powerful AI platform within minutes. Before management is aware of it, AI may already be influencing decisions, processing sensitive information, and becoming embedded in daily operations.
At first glance, this may not seem like a major concern. After all, organisations want employees to be innovative and embrace new technologies. However, innovation without governance is rarely sustainable.
The real risk begins when confidential information is entered into AI systems that fall outside the organisation’s control. Customer information, financial records, contracts, pricing models, business strategies, intellectual property, and even board documents can find their way into external AI platforms. In many organisations, this is happening without malicious intent and often without the employee appreciating the potential consequences.
For South African organisations, the risks are heightened by the requirements of the Protection of Personal Information Act (POPIA). Employees who upload personal information into unauthorised AI platforms may inadvertently expose customer, supplier, employee, or stakeholder data in ways that are inconsistent with organisational policies and privacy obligations. Even where there is no malicious intent, the consequences can be significant. Regulatory scrutiny, reputational damage, loss of trust, and the costs associated with responding to a data incident can quickly escalate.
The challenge is not the technology itself. The challenge is the absence of oversight.
When AI is used without clear policies and controls, organisations create blind spots. Leadership may not know what information is being shared, which tools are being used, how decisions are being influenced, or what risks are being introduced. In a world where data has become one of an organisation’s most valuable assets, this lack of visibility should concern every executive and board member.
There is also the risk of over-reliance. AI can be remarkably useful, but it can also be confidently wrong. Decisions based on inaccurate or incomplete information can lead to operational mistakes, financial losses, compliance failures, and reputational damage. If employees accept AI-generated outputs without applying professional judgement, organisations may find themselves making poor decisions at scale.
This is where governance becomes critical.
Good AI governance is not about restricting innovation. It is about creating clear boundaries within which innovation can flourish safely. It defines what tools may be used, what information may be shared, who is accountable, how risks are assessed, and what oversight mechanisms are required.
Importantly, AI governance should not be viewed as an IT responsibility alone. It is a leadership responsibility.
The principles contained within King IV, and the evolving governance expectations reflected in King V, reinforce the importance of ethical leadership, responsible technology governance, risk management, accountability, transparency, and long-term value creation. These principles are directly relevant to artificial intelligence. Boards are expected to provide oversight of technology and information governance, ensure that risks are properly managed, and promote an ethical culture throughout the organisation.
This means boards can no longer afford to view artificial intelligence as a technical issue delegated exclusively to IT departments. Directors must understand how AI is being used, what risks are being introduced, how personal information is being protected, and whether adequate controls are in place to support both governance objectives and POPIA compliance.
Equally, employees must understand that using AI without authorisation is not simply a productivity decision. It is a governance, security, risk, and compliance issue. A single employee acting without guidance can unintentionally expose an entire organisation to legal, financial, and reputational consequences.
The organisations that will succeed in the age of AI are unlikely to be those that simply adopt the most technology. They will be the organisations that adopt it responsibly. They will understand that innovation and governance are not competing priorities but complementary ones.
Shadow AI thrives when there is uncertainty, limited oversight, and a lack of accountability. Strong governance creates clarity. It enables organisations to harness the benefits of AI while protecting their information, complying with regulatory obligations, maintaining stakeholder trust, and safeguarding their future.
The question is no longer whether organisations will use AI. That decision has already been made. The real question is whether leaders will establish the governance, accountability, and culture required to ensure that AI remains an asset rather than becoming a risk hiding in plain sight.
Francis Cronje BLC LLM CIPP CIPT