Jack Lodge, EVP of Customer Success at AI soltuions provider NWN, has watched employees embrace AI tools faster than many organizations have been able to offer sanctioned alternatives and establish guardrails around their use.

Employees see meaningful productivity gains and opportunities to do their jobs more effectively and efficiently with AI tools, but when enterprise-approved options are not available, they may turn to unauthorized AI tools on their own. The practice is widespread, according to Thomson Reuters’ recent 2026 Future of Professionals Report, which showed that more than one-third (34%) of professionals across industries report using AI tools not sanctioned by their organizations.

That unauthorized use, known as shadow AI, creates a core risk in which well-intentioned employees may inadvertently expose sensitive company information by using an unsanctioned public AI tool.

Why prohibition doesn't work

Shadow AI isn't an employee discipline problem so much as a guardrail one. Employees "report that they see huge productivity gains, and they see a great opportunity to do their job better," Lodge says. "Many organizations haven't yet made AI tools available in an enterprise-safe, guardrail-compliant environment. And so employees sort of tend to go off on their own."

Unfortunately, banning the behavior doesn't remove the incentive, it just removes the organization's visibility into it as employees shift their behavior further underground. Worse yet, this then removes the very check that protects the larger team.

To fight shadow AI more effectively, Lodge describes a three-phase method he sees being used repeatedly by Chief Information Officers and Chief Information Security Officers, which includes:

1. Discover — Track what traffic is actually going to which large language models to better understand real use cases and where employees may be using unsanctioned tools.
2. Replace — Identify the tools employees need and provide enterprise-grade, guardrail-compliant versions that answer the question of "how do you provide the appropriate tools to replace the usage that they're using on those personal AI tools," Lodge says.
3. Govern — With sanctioned alternatives and a documented AI policy in place, organizations are better positioned to establish and enforce appropriate governance through guardrails. "As you do discover and set up replacement, then you govern, and you can take a little bit harder stance on the individual shadow AI," Lodge adds.

Lodge isn’t merely suggesting this option, his company, NWN, lived it, building the plane while flying. Using the company's roughly 1,300 employees, NWN ran this method on itself by creating a documented AI policy early on. The company then paired that with enterprise tools inside "firewalled environments" so usage could be audited without pushing employees toward public models.

The scale of the gap

Lodge cited a Gartner estimate showing that 49% of companies expect a shadow AI incident within the next 12 months. However, by his account, only 18% have a documented AI usage policy today. "You can't expect to train and hold employees accountable if you don't even have a documented policy," he says.

The larger challenge, of course, is compounded by the speed of AI adoption. As employees discover new tools and use cases, organizations need an ongoing way to understand how their employees are usig AI applications, provide appropriate alternatives, and adapt governance as the technology evolves.

For government agencies, this is especially challengings. Lodge says the most forward-leaning agencies are "adopting AI quickly... to drive better experiences" and cut costs, but the tolerance for error is lower by design.

"They can't afford not to invest in those guardrails because you're dealing with citizen personally identifiable information in many cases," Lodge explains. "And nobody can afford the black eye of a data breach."

You can download a copy of the recent Thomson Reuters 2026 Future of Professionals Report here.‍