Artificial intelligence (AI) has quickly moved from experimentation to everyday business use. Across organisations of all sizes, employees are using AI to draft content, analyse data and automate routine tasks. The productivity gains are real.
While this adoption is driving innovation, it is also creating new challenges for CIOs. The issue is not whether AI should be embraced; for many organisations, that decision has already been made. The challenge lies in ensuring AI can be used safely, responsibly and in line with security, compliance and business requirements. In many cases, adoption is happening organically, with business units identifying new opportunities long before formal governance frameworks are established.
Country Manager
Barracuda, India
Hidden Risks of Shadow AI and the Governance Gap
Employees are turning to publicly available AI platforms or creating personal accounts to access tools that help them work more efficiently. These activities may appear harmless, but they can introduce significant security and compliance risks when they occur outside approved policies and oversight. This growing trend, commonly referred to as Shadow AI, is becoming one of the most pressing governance challenges facing organisations today.
The concern is not that employees are intentionally bypassing security controls. More often, they are seeking practical ways to improve productivity and deliver better outcomes. However, once data enters an external platform, organisations lose control over how sensitive information is being processed, where it is being stored and who has access to it.
For CIOs, the risks extend beyond data exposure. Unmanaged AI usage can create compliance challenges, particularly when employees unknowingly share regulated, customer or proprietary information with external platforms.
In India, regulations such as Digital Personal Data Protection Actcarry strict requirements on how personal and sensitive data is handled. When AI usage is untracked, it becomes difficult to demonstrate compliance and even harder to respond when something goes wrong. This is particularly relevant in highly regulated sectors, where a single unapproved AI workflow can undermine otherwise robust compliance controls.
Shadow AI also introduces operational blind spots that make it difficult for security teams to understand which tools are being used across the organisation and how those tools interact with business data. Over time, this lack of visibility creates a widening gap between AI adoption and effective governance.
As organisations race to realise the benefits of AI, governance efforts are struggling to keep pace. According to Gartner, more than 40% of enterprises globally will experience a security or compliance incident linked to unauthorised AI usage by 2030. Yet many organisations still lack even a basic generative AI use policy. Last year, IBM reported that nearly 60% of Indian organisations lack AI governance policy.
This is why security must be treated as a foundational element of AI adoption rather than a consideration that is addressed later. Organisations that delay governance efforts until after AI has become deeply embedded in day-to-day workflows could find themselves trying to regain visibility and control after risky behaviours have already become established. Retrofitting policies and controls at that stage is significantly more difficult than building them into the adoption process from the outset.
Pillars of a Security-First AI Strategy
A security-first approach does not mean restricting innovation. In fact, overly restrictive policies can sometimes have the opposite effect, encouraging employees to seek alternative tools outside approved environments. Instead, the goal should be to provide a clear framework that enables innovation while establishing appropriate guardrails around data, access and usage.
The first step is visibility. Organisations cannot effectively govern AI if they do not understand which tools are being used, how frequently they are being accessed or what information is being shared through them. Gaining this visibility requires more than monitoring access to websites. It means developing a comprehensive understanding of AI usage across users, devices and locations, including tools embedded within broader SaaS platforms.
The second priority is establishing policies that employees can easily understand and follow. Governance frameworks should provide practical guidance on approved tools, acceptable use cases and the types of information that should never be shared with AI platforms. Policies that are overly complex or disconnected from everyday workflows are far less likely to be effective.
Organisations must also recognise that AI governance can no longer be confined to the traditional network perimeter. Employees are accessing AI tools from corporate offices, home networks and personal devices, often moving between environments throughout the day.This decentralised operating environment means security policies need to follow users wherever they work rather than relying on controls tied to a corporate network. Cloud-delivered security approaches are becoming increasingly important because they provide consistent visibility and policy enforcement regardless of location, helping organisations maintain governance standards without limiting workforce flexibility.
Equally important is the ability to apply controls based on risk. Not all AI tools present the same level of concern, and not every use case requires the same level of oversight. Organisations should focus on identifying higher-risk scenarios and implementing controls that provide protection without unnecessarily limiting productivity. This allows businesses to continue benefiting from AI while reducing the likelihood of accidental data exposure or non-compliance.
The CIO’s Role in Driving Responsible AI Adoption
The CIO’s role in this environment is not to act as a gatekeeper whose primary responsibility is to say “no”. It is also not realistic to believe AI adoption can be controlled through restrictions alone. Employees will continue to seek out tools that help them work more efficiently and deliver better outcomes.
Instead, CIOs should create the conditions under which AI can be adopted safely and at scale. This requires close collaboration across IT, security, legal, compliance and business leadership teams to ensure governance frameworks reflect operational realities as well as security requirements.
CIOs who view governance as an enabler of innovation rather than a barrier to it are better positioned to support the pace of change the business requires while maintaining the oversight that security and compliance demand. In doing so, they can help bring Shadow AI and other unmanaged AI usage patterns into the light, where risks can be understood, governed and aligned with broader organisational objectives.
Future of AI Governance and Compliance
AI will continue to transform the way organisations operate, the current challenge facing organisations is unlikely to become simpler. New tools are emerging almost daily and regulatory expectations are becoming increasingly sophisticated and nuanced.Governance frameworks that are overly prescriptive or designed around individual applications may struggle to keep pace with this level of change.
Organisations will be better served by adopting principle-based governance frameworks supported by adaptable controls. This approach makes it easier to evaluate and introduce new AI capabilities without redesigning policies every time a new tool enters the market.
For CIOs, the priority should be ensuring that AI innovation and AI governance are treated as parallel workstreams rather than sequential ones. Security cannot be bolted on after adoption has occurred. The organisations that will realise the greatest value from AI over the long term will be those that establish visibility, practical governance, risk-based controls and consistent security from the outset.
The gap between AI adoption and AI governance is real, but it is not inevitable. By treating governance as a strategic priority from day one, organisations can embrace the benefits of AI while maintaining the trust, resilience and control needed to scale innovation with confidence.
-Authored by Parag Khurana, Country Manager for Barracuda, India