Shadow AI Mitigation & Executive Steering Framework

Context

Rapid adoption of generative AI across business units created workflows that sat outside R&D oversight.

Challenge

40+ employees were building AI workflows with no standard security protocols, budget lines, or data-protection rules.

Actions

• Helped establish an executive AI steering committee with the CIO and senior leadership.
• Designed the approval workflow defining budget ownership and security boundaries.
• Built a phased rollout to move unmonitored workflows into official, compliant tools without hurting productivity.
• Reviewed ~750 license seats against actual usage ahead of renewal.
• Ran a platform cleanup that archived or consolidated 900 project boards, and removed tens of excess admin-level permissions across document sites.

Results

• 100% transition: All 40+ workflows brought under IT/R&D security compliance.
• Zero security incidents under the new data-privacy boundaries.
• 7 redundant tools cut through unified AI tool licensing.
• 900 project boards archived or consolidated.

What I’d do differently

I’d write the intake requirements and the rollout plan together, from the first week. A requirements document is a starting point, not a shipped system; the rollout is where governance actually gets tested.

Artifacts

The request flow before and after the intake path, the scale of the AI use-case mapping alongside the maturity model, and the license picture behind the unified AI tool licensing. A generalized version of the intake system, built on synthetic data, is the AI intake agent demo. Where the idea went next: Citizen AI Governance, three coded projects on governing the tools employees build and use.