A parks department discovers staff have been using an unapproved GenAI tool for public communications. What mitigation approach should the department direct for this shadow AI use?
Select an answer to reveal the explanation.
Short Explanation
Slam the door shut with a blanket ban, and staff who found a tool genuinely useful just go quieter about using it. A classification process that evaluates and either approves, restricts, or blocks the tool gives people a legitimate path instead of pushing them further underground. Bring shadow AI into the light instead of chasing it into the shadows.
Full Explanation
Shadow AI, unapproved tool use happening outside governance visibility, tends to persist or even worsen under an outright ban, because staff who found real value in a tool often continue using it quietly rather than giving it up, just without any oversight at all. A tool-classification and approval process addresses the underlying need by evaluating the specific tool against governance criteria and sorting it into an approved, restricted, or blocked category, giving staff a legitimate path forward instead of an incentive to hide. An immediate blanket ban with no approval path ignores that staff turned to the tool because it solved a real problem, and offering no legitimate alternative typically just pushes the behavior further out of sight. Taking no action because visible problems have not yet occurred ignores that shadow AI use is a risk precisely because it operates without oversight; the absence of a visible incident so far is not evidence of safety. Directing staff to keep using the tool while documenting usage in personal notes formalizes nothing meaningful, since personal notes are not a governance record and do nothing to bring the tool's data handling or output quality under organizational review. A scope caveat: classification decisions should be documented and communicated back to the staff who raised the original need, or the process will feel just as opaque as the shadow use it replaces. A concrete operational check is to maintain a living registry of evaluated tools with their approved, restricted, or blocked status, visible to staff considering new tools.