Clandestine AI at work first reveals what the organisation lacks

Ten years ago, the “best friend” of anyone looking for an answer was called Google. Today, it might be ChatGPT, Claude, Perplexity or Gemini, free and within reach of a browser. You explain to the assistant how your company works and then, to save time, entrust it with an internal document: “Here, I will even give you the file, so you can see it for yourself.” Vassili Joannides de Lautour describes the scene without indignation. The gesture is so convenient, he says, that this is precisely what makes it an issue.

It is called shadow AI: using artificial intelligence tools for work that the organisation has not provided or approved. A personal or free ChatGPT account, professional data entrusted to Canva for a visual or Prezi for a presentation: the list is endless. The researcher distinguishes it from shadow IT, the use of unapproved equipment, such as a personal Mac preferred to the computer supplied by the employer (he admits to having done this himself). That technical territory belongs to security specialists. His is the territory of behaviour.

A symptom before it is misconduct

The usual instinct is to treat the issue as a security risk: a leak to prevent, a ban to reiterate. Indeed, the management committees he meets often see AI, he says, as a matter for the IT department. He considers it a cross-functional issue and turns the question around. “The question is not: is it right or wrong to use AI clandestinely? For me, the question is: why does an employee need to resort clandestinely to AI tools?” His answer: the employer does not provide the tools the employee believes they need to carry out their duties.

Yet he is careful not to make it simply a matter of poorly designed processes. Clandestine uses also thrive because AI suddenly makes low-value tasks easy: connecting an assistant to a spreadsheet, giving it raw data, retrieving a report ready to send. Sales promises offering hours saved each week sustain this focus on immediate gains. And the risk does not always lie where one expects: a cabinetmaker friend, he says, does not expose his woodcutting methods, but his customers’ data.

The manager looks upwards first

Asked about a finance department manager in a higher education group, tempted to turn a blind eye to these practices to relieve a team overwhelmed by tools that are too slow, he does not start with the team. A middle manager’s first role, in his view, is to escalate the need and the risk to the executive committee. Without saying whether they have observed such uses, they flag that these are likely if tools are lacking and pass responsibility for the risk to the level that can decide. “If middle managers only concern themselves with what comes down to their teams, the problem will never be tackled head-on.”

While waiting for management to decide, he advocates transparency within the team, since the manager is accountable for these uses to their superiors. Employees explain how they work, even outside the rules, and ask how far they can go; the manager identifies the data and uses for which they refuse to take responsibility. He speaks of “mutual adjustment”, a classic concept in organisational theory: coordination through direct exchange rather than written rules. This dialogue seems to him “really crucial when there is no framework”: it “provides a certain form of informal framework within the team”.

The obstacle lies in what he calls “AI shame”. Employees keep quiet about their use, less because it is clandestine than for fear of having cheated. Sometimes for more mundane reasons: they prefer ChatGPT while everyone praises Claude, and fear being mocked. Hence a proposal he knows is paradoxical: make these uses commonplace. He invokes the Institutional Revolutionary Party, which ruled Mexico from 1929 to 2000 under different names, whose very name is an oxymoron. “Institutionalising a clandestine practice would seem to me something healthy, almost a public health measure.”

When performance throws the team off balance

Beyond data, AI disrupts working rhythms. One employee may use it to deliver the same work in less time, another to produce much more. Vassili Joannides de Lautour dislikes the word “productivity”, but has observed what happens to the latter. In a team, he believes, the group sets the pace: the overperformer risks being brought back into line because others cannot keep up, or because they demonstrate that everyone could do as much. He has seen the highest performer end up ostracised, to the point where their own manager saw them as a problem; less the person than the situation created by their output. AI, he warns, will only amplify what we already know.

To spot these differences, managers have weak signals, provided they know their team well. The researcher gives two examples: someone who already worked fifty hours a week and suddenly delivers the equivalent of eighty; someone whose coffee break grows from half an hour to an hour and a half without any change in results. A discrepancy does not prove AI use; it invites questions.

There remains the choice of the manager, who sets the cadence. He contrasts the manager who pursues maximum performance to enhance their own standing, even if that means pressuring those less skilled with the tools, with the one who seeks balance, encourages AI as long as it serves the required results and reins in the overzealous. He openly prefers the second, without seeing himself as a free rider. “There is no point in being overzealous just on principle, knowing there is even a strong chance that at some point overzealousness will become the new norm.”

From doping to tools

To think about how long the phenomenon will last, he prefers the comparison with cycling in the late 1990s to that with the internet. People then wondered, not without cynicism, whether the public would still watch the Tour de France if riders took days to climb the Galibier. AI, in his view, raises a similar question: where does sensible enhancement of one’s capabilities end, and where does enhancement begin that makes one highly effective on subjects one does not understand, to the point of doubting the result’s reliability?

The metaphor extends to the peloton. AI skills are increasingly required when hiring, and delays in training are becoming a source of tension for human resources; in the United States, he says, they are already grounds for dismissal. Shadow AI will therefore last until the less experienced catch up with the peloton, or are disqualified. Christophe Hollenet [TO BE VERIFIED], a former managing director of Microsoft with whom he discussed it, believes the practice will persist and the challenge will be to integrate it rather than ban it.

Hence his practical response: give employees the means to stop looking elsewhere, while complying with the General Data Protection Regulation (GDPR), the European AI regulation, trade secrecy and the European NIS 2 Directive on information systems security. He sketches three paths: a full Copilot licence for everyone who works on a computer in organisations equipped with Microsoft, acknowledging its cost; partnerships with Mistral for AI tailored to occupations; local AI tools configured for the organisation’s uses. All preceded by a “philosophy”: what one accepts, or refuses, to entrust to AI.

When it is put to him that an imposed tool risks standardising practices and stifling what makes each person’s contribution unique, he clarifies that he means bespoke solutions specific to each organisation. Then he admits to “cognitive dissonance”: he himself would find it hard to give up tools he knows well, even if that meant breaking the rule without taking pleasure in it. But internal standardisation seems to him the very principle of the company, what, for economist Oliver Williamson, Nobel laureate in 2009, distinguishes hierarchy from the market: shared reference points for working together. He does not claim to resolve the tension. At most, he expresses a hope: “I dare to hope that creativity and individuality are expressed in ways other than through how we use AI.”

Background

Vassili Joannides de Lautour spent twenty years in higher education, in France and internationally, notably in leadership roles. Accredited to supervise research, he devoted his work to the traceability, defensibility and auditability of decisions and the sources on which they rely. For around two years, he has been designing AI solutions intended to restore trust between stakeholders, for example to prevent challenges to academic decisions. He works with management committees and mid-sized companies through his organisations SAFEOS in the United States and Grades Education in Europe.

This article is drawn from the interview with Vassili Joannides de Lautour in the podcast Human value in the age of AI (ISSEO)