Case Study: Mapping Shadow AI Without Driving It Underground

Every organisation has two AI adoption numbers: the official one, and the real one¹. The distance between them is where your risk lives — and, less obviously, where your best working practices live too.1A composite case, anonymised and simplified from several Fellow engagements. Numbers are representative of the pattern, not one client's audited figures.

The situation

A Thai conglomerate's transformation office reported 12% AI adoption, based on licence activations. Their readiness answers told a different story: heavy weekly usage alongside almost no visibility into which tools were involved. When we ran structured conversations across three business units, actual usage — counting personal ChatGPT accounts, free-tier tools, and browser extensions — was closer to 60%^◦.By the numbers12% → ~60%official adoption versus what a three-week mapping actually found

Nobody had lied. The official number counted what the organisation had bought; people were using what worked, on their own accounts, including for material work: contract summaries, customer correspondence, financial commentary.

Why people hide usage

Shadow usage is not rebellion — it is a rational response to incentives^◦. The approved tools were worse than the free ones. Asking for permission took weeks. And admitting AI use invited two fears at once: being told to stop, and quietly suggesting your job could be automated. Given those incentives, hiding is what a sensible person does.DefinitionShadow AI AI use running through personal accounts and unapproved tools, invisible to the organisation that carries its risk

That framing matters, because the standard corporate response — a usage survey, a stern reminder of policy — reads as a threat and drives the practice deeper underground. You cannot audit your way to visibility here.

The amnesty

We ran the mapping as a show-and-tell, with three explicit rules announced by the business-unit heads themselves: nothing disclosed would be punished; anything disclosed that worked would get proper tooling; and the goal was to find practices worth keeping, not people to correct.

The sessions surfaced 40+ distinct workflows in three weeks. The best of them — a contract-clause summariser built by a junior legal analyst — became the template for the unit's first officially supported AI workflow^◦.FigureThe most valuable workflow in the company was invisible until it was safe to show

What changed

The roadmap inverted. Instead of rolling out training for hypothetical use cases, the programme promoted proven underground workflows into supported, governed ones — tooling, data rules, and an owner per workflow. Within a quarter, the official and real adoption numbers converged, which meant risk was finally being carried where it could be seen^◦.By the numbers40+real workflows surfaced by three weeks of amnesty mapping — each one a governance blind spot the day before

What to steal

1. Assume the real number is a multiple of the official one. Budget your governance effort for the real one.
2. Run the mapping as an amnesty, announced by line leaders — not by compliance. The messenger is the message.
3. Reward disclosure visibly and fast: the first disclosed workflow that gets upgraded to proper tooling does more for visibility than any policy email.
4. Promote, don't punish: the shadow practices are your adoption roadmap, pre-validated by the fact that people use them without being told.

If your readiness report flagged low tool visibility against real usage, this is the playbook — and the first mapping conversation is one we can help you run^◦.RelatedWhat to do once usage is visible: closing the governance gap