The Tortoise arrived at the review with a list, which she put on the table without saying anything, and then waited.

Tortoises are the most underestimated animal in any organization. They are slow, they are armored, and they outlive absolutely everyone in the room, which means that over a long enough period they are usually the only creature who remembers what was decided and why. This one had been compiling her list for two seasons without mentioning it, because she had wanted it to be complete before anyone had the chance to argue with it.

It ran to four pages.

The Fox read it with an expression that changed twice. The first change was surprise at the length. The second was the recognition, about halfway down the second page, that three of the entries had been started by his own team, one of them by a person who reported directly to him.

“How long have you had this?” he asked.

“A while.”

“Why didn’t you bring it earlier?”

“Because,” said the Tortoise, “the last time somebody brought a list like this to a room like this, everything on it got banned within a fortnight, and eighteen months later there was a longer list that nobody had.”

Why this is not shadow IT

Every enterprise has had shadow IT and every enterprise thinks it knows how to handle this. It does not, because the two problems only look alike from a distance.

Shadow IT had friction. Somebody had to find a tool, pay for it, get it working, and usually get it past a network. There was a procurement event, an invoice, a login, an integration. There were artifacts, and artifacts are catchable.

Shadow AI has almost none of that. The entry cost is close to zero. There is frequently no infrastructure footprint at all. And in the largest category, which I will come to, there is no procurement event whatsoever, because the capability arrived inside software your organization already licensed and somebody simply switched it on.

There is, quite often, nothing to catch. Which means the entire enforcement instinct that your organization built over fifteen years is pointed at a problem with a different shape.

The three tiers

What the Tortoise’s list actually contained, once it was sorted, fell into three tiers.

Tier one: personal subscriptions. Individuals expensing tools, or in a fair number of cases not expensing them and paying out of pocket because it was easier than asking. Visible in expense data if anyone looks. Usually small in cost and disproportionately large in the anxiety it generates, because it is the tier everyone can see and therefore the tier everyone talks about.

Tier two: features inside software you already own. The assistant embedded in the document tool. The summarization inside the service platform. The drafting feature in the communications suite. Nobody procured these. Nobody decided to adopt them. A vendor shipped an update and several hundred animals started using something new on a Tuesday.

Tier three: departmental builds. A team with some technical capability builds something real on the sanctioned platform, and it never registers as a project because nobody filled in a form. Often genuinely good. Almost always without an owner named anywhere, a runbook, or a line in any budget.

The tier nobody sees

Tier two is the biggest and the least visible, and I think it is the most under-discussed problem in the whole field.

Your organization is already paying for it. The cost sits inside a bundled licence line that was negotiated for something else entirely, which means it does not appear in any AI cost report, is not attributed to any capability, and shows up in no conversation about adoption. From a financial reporting perspective it is not AI spend at all. It is last year’s software renewal.

Meanwhile several hundred people are putting real work into it daily. The Tortoise’s list had more entries in tier two than in the other two combined, and every one of them had been discovered by her opening an administrative console and reading, which took her an afternoon.

This is worth sitting with. The largest category of AI use in most organizations is one that costs nothing extra, appears in no report, and was never decided on by anybody.

What the exposure actually is

The reflex is to worry about cost. In my experience cost is rarely the real exposure here, and treating it as such gets you a program that solves the cheap problem.

The real exposure is threefold. Data leaving where it was supposed to stay. Retention you did not choose and cannot describe. And, most seriously, a business process that now depends on something with no owner, no runbook, no monitoring and no budget.

That third one is what should keep people awake. Somewhere in your organization right now there is a month end process, or a customer response path, or a regulatory submission, that has quietly come to depend on something a single person set up in an afternoon. That person may have since moved teams. When it breaks, nobody will know what it was, what it did, or how to restore it, and the discovery will happen at the worst possible moment because that is when dependencies reveal themselves.

The reframe

Here is the part that takes most leadership teams a while to accept.

Every entry on that list is somebody solving a real problem, on their own initiative, without being asked, and usually without being resourced. Not one of those animals woke up wanting to circumvent anything. They had work to do and something in front of them made it easier.

Which means the Tortoise’s four page list is the single best product roadmap in the building. It is demand, validated by the fact that people were willing to work around the organization to get it. No survey will ever produce information that good. No workshop will surface it. Your people have already told you what they need, in the most credible way available, which is by doing it.

The Fox, to his credit, worked this out about ten minutes into the meeting and stopped being defensive about the three entries belonging to his own team. “So this is the backlog,” he said. The Tortoise, who had been waiting two seasons for someone to say precisely that, allowed herself to look mildly pleased, which on a tortoise is a very small movement.

Amnesty, and what makes it work

The practical mechanism is an amnesty. A defined window during which declaring what you built gets you support, migration help and a proper budget line, rather than a conversation with someone about policy.

Three things make an amnesty work, and all three are required.

• Credible non-punishment. If one person gets disciplined during the window, the window is over regardless of what the announcement said. This has to be stated at a level senior enough that people believe it.
• A genuinely better sanctioned alternative. Amnesty with nothing to migrate to is just a census. People declare, nothing improves, and they carry on exactly as before with more paperwork and less trust.
• A real deadline. Open-ended amnesties never close and therefore never create the moment of decision that makes them work.

Discovery, meanwhile, does not require surveillance and should not use it. Expense line analysis finds tier one. Reading your own administrative consoles finds tier two, and finds most of it in a single afternoon. Tier three is found by asking, which works considerably better than people expect once the amnesty is credible.

Three ways this goes wrong

The crackdown. A blanket ban, announced firmly. Usage does not stop. It moves to personal devices, personal accounts and personal networks, where you have no visibility at all. Your exposure has increased and your ability to see it has gone to zero, which is the exact opposite of what the ban was for.

Amnesty with nowhere to go. Everyone declares, the sanctioned platform is worse than what they were using, and within a quarter the list is growing again. You have spent your credibility and bought a snapshot.

Counting the wrong risk. A program obsessed with subscription costs, producing careful reports on a small number, while an unowned workflow sits inside a month end close and nobody has noticed.

The Field Kit

Concrete things to do this week.

If you sit in the Crow’s chair, run an expense line analysis for AI subscriptions this month, then go and look at what AI features are bundled into your three largest software renewals. The second exercise will find more than the first and cost you nothing.

If you sit in the Crocodile’s chair, inventory what is already licensed and switched on. Most of tier two is sitting in administrative consoles you already have access to. This is an afternoon of work and it is the highest return afternoon available to you this quarter.

If you sit in the Mandrill’s chair, treat your territory’s list as a demand backlog rather than a compliance finding, and fund the top three properly. You will get better outcomes and considerably more goodwill than any enforcement action would have produced.

For everyone: for every instance you discover, record the problem it was solving in a column next to the cost. That column is worth more than the cost column, and almost nobody creates it.

Jungle Lesson 4

Shadow AI is not an act of defiance, it is an unfunded requirement with a credit card. Kill the tool and the requirement is still there, only now it is invisible to you and expensive to somebody else.

Next time: the jungle counts its pilots for the first time and the number is genuinely absurd. Every one of them was individually cheap and individually defensible. Together they consumed most of a year, and not one of them made the next one any easier to start. Lesson 5 closes the first act with the pilot trap.

If you have someone in your organization who has quietly been keeping a list like the Tortoise’s, find out. They are usually in risk or compliance, they have usually been waiting to be asked, and they are usually the best informed person in the building.