Ferrero

Antonio Carlos Nitrini Junior

AI Governance Advocate

Why Blocking Doesn’t Work—and What Companies Should Do Instead

This happened, and you need to know. In 2023, engineers from different teams at a big tech company started using ChatGPT to boost productivity. To do so, they sent excerpts of proprietary source code to be optimized and recorded confidential internal meetings, using AI to extract minutes. Once this content was sent to external AI services, the company lost governance over where that information was stored and how it could be used — including potential use in model training processes.

So yes, the employees in your company are already using Artificial Intelligence, and the path forward is not to try to block this usage, but rather to guide them with best practices and governance.

This use of unauthorized tools or tools without any guidance inside companies is called “Shadow AI”. Literally, “AI in the Shadows”, it refers precisely to the improper use of personal AI tools, whether free or paid, without proper governance, literacy, or guidance from the company.

The fact is that almost everyone is already using generative AI in companies. According to a 2026 report, 76% of organizations report the use of unapproved AI tools.

 But wouldn’t it be simpler to block access?

The short answer is: no. And the reasons are more practical than they seem.

If the company simply tries to block access, usage will automatically shift to personal mobile devices, which would be even worse, as people would start using corporate information on their personal phones, increasing the risk of an even more invisible Shadow AI with no monitoring at all.

Security reports already point out that a significant portion of AI-related leaks occurs through personal accounts and unmanaged devices.

 Where can companies start?

Literacy is one of the words I have particularly read and heard the most in recent months. And it means the basics: communicate clearly, train, certify, and guide employees on the safe and ethical use of AI tools.

  The path forward is not to block AI usage, but to guide it with best practices and governance.  

Governance is the other pillar, through which companies can structure their use of AI. Here, we are talking about multidisciplinary committees, solution homologation, procurement criteria, and the release of official tool licenses only after users have completed training and certification.

Finally, monitoring and keeping humans in control: being clear that AI should act as support, always under human supervision, with critical decisions reviewed by people.

 What Are the Risks of Not Acting?

When someone shares corporate information in a non-homologated AI tool, the risk lies precisely in those shared files: the company loses traceability of where that information ended up. This does not necessarily mean that the AI will start repeating that information to other users. Depending on the tool, plan, and settings used, however, the content sent may be stored, retained, or even used in model improvement and training processes. The main issue is that the company loses governance over how that information is handled.

In addition, there are risks of data leaks, algorithmic errors, legal issues, and non-compliance with data protection regulations such as Brazil’s LGPD.

Not acting and, at the same time, simply granting a premium license is also a mistake. Without guidance and training, usage tends to be superficial, potentially leading to demotivation or use for non-business purposes. Another important point is that improper use of AI tools can open doors for cyberattacks, fraud, or even generate internal incidents. Recent studies show that a significant portion of AI-related security incidents is directly related to the unauthorized use of tools by employees.

 Do This Now

• Don’t block, guide! Identify who in your company is responsible for defining what AI can and cannot do.

• Conduct an anonymous survey to map which tools are being used and how AI is being applied, so you can take more targeted actions — not punishment.

• Create an AI adoption ambassadors program. People like having official reference points on the topic. Train and keep these ambassadors informed about your company’s AI governance and usage policies.

 AI usage is already a reality in companies, and not acting only increases the risk. Create this discussion agenda, use this article to support the start of these conversations, and keep evolving.