Shadow AI: What Every Board Needs to Own Before It Owns Them

Most boards don't have a handle on AI yet. Not because directors aren't capable, but because there's no proven playbook for governing something moving this fast.

The result is a widening gap between how quickly AI is showing up inside organisations and how slowly governance is catching up to meet it.

We asked JJ, Think & Grow's CEO, to unpack what's really happening inside businesses right now, and what boards need to do about it.

The trust gap, in numbers

Three data points frame the problem:

• 29% of employees admit to using AI to do their work without telling their manager
• 44% of US workers say their employer has no clear AI policy, or they're not sure one exists
• 72% of Australian workers are concerned about breaching data or regulatory rules when using AI at work

"Those stats are a proof point for the significant gap between how fast AI is moving inside organisations and how much faster governance needs to move to keep up." - JJ

Boardrooms are flying blind

Boards are working with fragments of information that span security, compliance, spend, modelling, and strategy, often without the expertise to properly evaluate any of it.

At a recent AICD Tech Summit in Brisbane, directors with decades of board experience openly admitted feeling underprepared for this moment. Despite three decades of digital transformation, governance structures inside most organisations are at real risk of being outpaced by the speed and scale of AI.

"A director is committing malpractice if they are not fully and thoroughly evaluating the effect of AI in their business." - Board director, Think & Grow AI Breakout Report

Shining a light on the invisible

Here's what we're finding when we go into businesses through our AI practice: people are already using AI. They're just not talking about it.

During an AI audit inside a banking product business, individuals across every department were experimenting with AI tools in their own time, but nobody was sharing those experiments with the wider team or leadership. The business hadn't given them the tools, space, or education to do so, and most were quietly afraid of losing their jobs over it.

That fear does real damage. It kills the culture and buries the use cases that could have material impact. Once the business created space for open conversation, the wins emerged almost immediately: high-value, low-cost improvements to customer engagement, and hours of manual data entry that could have been in motion months earlier.

This is what the AICD summit called "shadow AI": unauthorised use of AI tools across an organisation, invisible to leadership. It isn't just a staff-level problem. Board directors are doing it too, including transferring confidential board notes into AI systems with no governance in place.

The three things your board needs to own

Research for the Think & Grow AI Breakout Report, based on over 750 board members, founders, and executives globally, found the board's AI mandate comes down to three things:

1. Set direction - decide where AI can give you a real edge, not just convenience
2. Create conditions - make sure the right data, decision rights, and talent are in place
3. Hold to outcomes - measure what matters (cycle time, decision quality, capability lift), not vanity demos

What this is optimised for: faster, safer AI adoption; reduced shadow AI risk; capability lift that compounds instead of stalling.

Critically, AI strategy can't live inside a product roadmap or an IT sprint. It has to be embedded in how people work, lead, and create value. Organisations with a defined AI people strategy outperform those treating AI as a tech-only play by nearly 12%.

How to close the gap

The leaders who invest in board-level education, create conditions for open internal conversations about AI, and build governance that keeps pace will be able to move faster commercially, without carrying the risk blind.

Communication matters as much as strategy here. When leadership gets clear on what AI can and can't do, and shares that openly, the fear lifts and the real potential starts to emerge.

Is your board flying blind on AI?

Think & Grow works with founders, CEOs, and boards to close the gap between AI adoption and AI governance, from capability reviews through to board-level education.

Get in touch to find out more

‍