Ronnoco Beverage Solutions

George Hicker

Citizen Development Champion

Shadow IT was a security threat long before AI. But in the last year, AI coding tools have made it remarkably easy for employees outside IT to build and deploy their own solutions. The results are often impressive: working functionality in hours, with improvements arriving just as fast.

CIOs can respond in one of two ways: try to shut it down, or channel it. I believe the second path builds a stronger company.

Why Citizen Developers Exist

Most IT departments are understaffed and carry long backlogs. When accounting asks for help and hears the wait is six months to a year, people don’t sit still. They hear about a colleague who built something with AI and think, “If they can do it, why can’t we?” A few hours of vibe coding produce something that works. It isn’t perfect, but it’s good enough to show coworkers, who offer ideas. A few sessions later, the team has a viable tool.

Citizen developers aren’t rebels. They’re motivated people solving real problems IT couldn’t get to.

The Cost of Going It Alone

Left ungoverned, these tools create real risk. What happens when the lone developer leaves and no one can access the source code? What if the application runs on a personal device or an unmanaged cloud account? Many citizen developers lack the experience to build in security controls, and AI often sounds confident even when it’s wrong.

Working in isolation also fragments data. A purchasing tool built by operations may work well for operations, and an accounting tool may work well for accounting, until their numbers don’t match. Which one is right?

The Cultural Trap

IT managers often feel threatened. Security is one concern, but there’s another question: if the business can build its own solutions, why does it need IT? With layoffs already being attributed to AI, that fear isn’t irrational. But when fear drives policy, the culture shifts from teamwork to animosity and barriers, and shadow IT simply goes further underground.

  These aren’t bureaucratic hurdles. They’re how business and IT partner together to build solutions that are secure and supported.  

Reframe Citizen Developers as Capacity

Leadership can approach this differently. Teamwork brings different skills and perspectives together, producing more complete solutions and more resilient organizations. An understaffed IT department has just found willing helpers who may not require new budget.

Many citizen developers love experimenting with technology but don’t want to leave their primary role. Virtual teams, where they join an AI development effort part-time, let them build while keeping their jobs, and give IT the extra hands it needs.

Building the Partnership

Practical steps for CIOs:

• Create a regular AI forum. A weekly or monthly gathering where business and IT share ideas, demo what they’ve built, and trade tips.

• Pair citizen developers with IT mentors. Pairing gives IT visibility into what the business is building and a voice in how it’s built.

• Equip IT to lead with clear standards. Define how identity and access are built into every application. Set data classification rules: what data AI should never touch, and how confidential data must be handled (encrypted in transit and at rest, masked on screen).

Guardrails That Enable, Not Block

Citizen developers often start with a half-formed idea. This is where IT adds value, sharing knowledge of existing systems, data, and security. Before AI writes any code, an architecture diagram and design document should set the boundaries AI works within.

From there, a few non-negotiables keep solutions secure and supportable:

• Build and test in a sandbox before production.

• Document the solution so others can support it.

• Keep test plans for regression testing as changes are made.

• Store all source code in the company repository, never on a personal PC or GitHub account.

• Review all source code with the IT mentor for compliance with company coding standards before it goes to production.

These aren’t bureaucratic hurdles. They’re how business and IT partner together to build solutions that are secure and supported.

The Payoff

Citizen development isn’t going away. CIOs who fight it will lose visibility and goodwill. Those who embrace it, pairing the business’s energy and domain knowledge with IT’s discipline and expertise, gain more capacity, safer solutions, and a culture where IT is seen as a partner rather than a gatekeeper.