About Your Approved Vendor List…

That deck that’s due in 2 hours? The one you knew about 3 months ago? Yeah, let's start it now. Dopamine time. 

Clippy 2026 Enterprise Edition (Copilot) is fine at summarising notes, but struggles with building presentations. Claude isn’t on our approved software list but that’s a running joke now. Everyone just uses their personal account to get things done, so let's paste a few months of notes, a couple of budget spreadsheets, and a product roadmap in. “Build deck pls. Make no mistakes.” 

Congrats on hitting the deadline, but that sensitive data now sits in a personal account you'll never think about again.

You aren’t our deck creator though, are you? You’re the head of IT, CIO, or CISO, and you know I’ve just described good ol’ shadow IT. The thing that’s plagued IT teams since the dawn of SaaS, now amplified by magic-feeling tools that induce FOMO, too tempting to resist; and your staff already have accounts to ask for recipes or vibecode TikTok for dogs.

Your sharpest, most ambitious people are miles ahead on what these tools can do, and the approved option can't hold them, because you —  stretched or sceptical — reached for whatever was easiest. You gave them Copilot because it’s cheaper than OpenAI, you don’t need to worry about SSO, and already flies under your Microsoft DPA.

What about Shadow AI? AI is turning up inside tools you already approved. Your CRM, notes app and helpdesk each sprout an AI button, and pipe whatever you type straight to a major model provider. People use that instead of the official tool you bought them, and you may not even know the feature is there, let alone where the data lives.

There's no settled answer here. Keep your approved tool list, but it's not the whole answer. A new crop of products can help, sniffing out where AI is hiding in your stack and where data is going. Useful, but they won’t catch it all. 

The only thing I’m sure of is if you haven’t already implemented an AI policy that is permissive, sets guardrails rather than roadblocks, and supports people in exploring new tools, you are behind your smaller competitors and unaware that implementation is going on under your nose — probably by your boss.