The rush to adopt artificial intelligence (AI) has reached a critical level across organizations. According to McKinsey’s 2025 State of AI report, nearly 8 in 10 organizations have now adopted at least one AI tool, with 78% using AI across their operations. This is according to the latest Cybernews survey.
The report finds a leadership problem behind shadow AI: 93% of executives use unauthorized AI tools, while 57% of managers actively approve of their teams doing the same. This is perhaps reflective of only 21% of organizations redesigning workflows for AI, with just 28% have CEO-level governance oversight, leaving managers to improvise.
In terms of the implications, IBM data shows that breaches involving shadow AI average $4.63 million, with one in five companies already affected.
Žilvinas Girėnas, head of product at nexos.ai, an all-in-one AI platform for enterprises, has explained the reality at the management level to Digital Journal.
Girėnas observes: “Managers approve shadow AI because they are caught between two impossible demands — deliver results with tools that don’t work, or break policies that were never designed for how teams actually operate. When executives themselves bypass official channels at a 93% rate, they’ve already established the real rules of engagement”.
He adds: “This pattern is consistent across industries. Managers are not choosing productivity over security out of carelessness. Instead, they are making calculated decisions in environments where sanctioned tools can’t keep up with consumer-targeted AI in speed, capability, or user experience. The risk feels theoretical, while the productivity gains are immediate and measurable”.
Why managers feel forced to approve shadow AI
Shadow AI is growing in popularity because organizations view it as a technical issue rather than a leadership problem. As many as 21% of organizations have changed their workflows for AI, and only 28% of those have CEO-level oversight. Without strong direction from the top, companies rely on IT solutions, which McKinsey calls “a recipe for failure.” This leaves managers to handle challenges on their own, without clear guidance or the right tools.
When companies lack a proper AI infrastructure, managers often find themselves in a chaotic environment. They are under constant pressure to boost productivity. Yet only one-third of organizations implement fundamental AI scaling practices, such as establishing clear roadmaps, defining key performance indicators (KPIs), and securing buy-in from senior leadership. Managers are evaluated based on innovation metrics rather than security compliance, which leads to predictable problems, including unrecognized AI usage, incompatible tools, and pilot projects that never scale effectively.
Rule violations
“Managers aren’t violating the rules out of a need to rebel,” says Girėnas. “They are reacting to a flawed system, where only 1% of executives believe that their organizations’ generative AI deployments are mature, and most of these lack fundamental governance. Managers make the choice to prioritize team productivity over policies that were never properly established. The unfortunate reality is that companies have contributed to this problem by treating AI as just a simple technology purchase rather than an organizational transformation.”
The result is a growing gap between strategy and execution, according to Girėnas. This becomes more pronounced with each decision made. This gap is most evident at the management level. While some organizations review all AI output, a similar share reviews 20% or less. Managers often operate without clear standards, watching as teams independently explore AI. This encourages innovation but also leads to challenges with compliance and budget control. The dilemma becomes clear — should they slow the potential to innovate, or should they accept the associated risks?
“Companies often wonder why managers allow the use of shadow AI to persist, but that’s not the right question,” notes Girėnas. “Instead, we should ask why we expect different results when we provide generic tools and when teams lack training and have no clear strategy. Managers will stop using shadow AI when companies address the reasons it exists — by offering secure and effective tools that truly work, along with the governance infrastructure to support them.”
Practical steps forward
Organizations cannot ignore risks that come from leadership. To address this issue, according to Girėnas, they need to move from simply saying no to empowering their teams.
- Stop banning and start competing. Shadow AI wins on user experience. Provide secure access to the models teams actually want (GPT-4, Claude, Gemini) with built-in protections. If your approved option is slower or more frustrating than the consumer version, teams will find a way to avoid it.
- Map workflows before buying tools. Stop top-down procurement. Analyze how teams actually work. Find friction points where shadow AI thrives. Select tools that solve specific problems, ensuring sanctioned alternatives are both secure and superior.
- Make policies adaptive, not static. Static policies fail. Create clear guidelines with feedback channels for managers to report tool gaps. Track KPIs and adjust based on real usage data.
- Educate on consequences, not just compliance. Explain to your employees that data pasted into free tools can be used for model training, stored indefinitely, and potentially exposed in breaches. Specificity changes behaviour where vague warnings don’t.
- Drive change from the C-suite. The McKinsey data is clear: delegating AI governance to IT is “a recipe for failure.” CEOs must own the transformation. Without executive leadership, managers will continue choosing productivity over policy.
