A client recently showed me their AI tool inventory. It was a shock.

Different teams were using 23 different AI tools—many doing similar things. Some had been approved through proper channels. Many hadn’t. Several contained unreviewed security terms. A few were storing sensitive data with unknown third parties.

This wasn’t a failure of governance. The organisation actually had governance processes. But the processes couldn’t keep up with the pace of AI tool emergence and employee experimentation.

This is the AI tool proliferation challenge, and almost every organisation is facing it.

The Proliferation Problem

AI tool proliferation creates several challenges:

Security and Compliance Risk

Unapproved tools may:

• Store data in unsecure or non-compliant ways
• Have terms that grant broad usage rights
• Lack appropriate access controls
• Operate in jurisdictions with different requirements

Every unapproved tool is a potential risk vector.

Support Complexity

When everyone uses different tools:

• IT can’t support what they don’t know about
• Training can’t cover every variation
• Troubleshooting becomes individual rather than scalable
• Best practices fragment rather than consolidate

Complexity makes support unsustainable.

Cost Inefficiency

Proliferation drives redundant spending:

• Multiple subscriptions for similar functionality
• Volume discounts impossible to achieve
• Budget scattered across many cost centres
• No negotiating leverage with vendors

The same capability purchased twenty ways costs more than once.

Integration Challenges

Different tools don’t integrate well:

• Outputs in inconsistent formats
• No shared workflow connections
• Data silos across tools
• No unified view of AI usage

Proliferation creates fragmentation.

Quality Inconsistency

Different tools produce different quality:

• Varied accuracy across platforms
• Inconsistent outputs for similar tasks
• No shared quality standards
• Hard to compare results

Quality becomes unpredictable.

Why Proliferation Happens

Understanding why proliferation occurs helps address it:

Legitimate Need

People experiment because they’re trying to solve real problems. They can’t wait for centralised evaluation when work demands are immediate.

Inadequate Approved Options

If official tools don’t meet needs, people find alternatives. Proliferation often signals gaps in approved offerings.

Slow Approval Processes

Traditional procurement takes months. AI tools emerge weekly. The mismatch drives shadow IT.

Lack of Awareness

People don’t know what’s approved, what’s available, or where to go for guidance. They default to what they can find.

Innovation Culture

Organisations that encourage experimentation shouldn’t be surprised when people experiment—even with unapproved tools.

Proliferation isn’t malicious. It’s often well-intentioned people trying to do good work.

A Balanced Governance Approach

The goal isn’t to eliminate experimentation. It’s to channel it productively while managing risk.

Tiered Risk Framework

Not all AI tools carry equal risk. Create tiers:

Tier 1 - Low Risk:

• No sensitive data involved
• Consumer-grade security acceptable
• Limited organisational impact if issues arise
• Minimal approval required

Tier 2 - Medium Risk:

• Some organisational data involved
• Business-grade security required
• Moderate impact if issues arise
• Standard review process

Tier 3 - High Risk:

• Sensitive or regulated data involved
• Enterprise-grade security required
• Significant impact if issues arise
• Comprehensive approval process

Apply appropriate rigor at each tier rather than one-size-fits-all processes.

Streamlined Evaluation

Traditional procurement doesn’t work for fast-moving AI tools. Streamline:

Pre-approved list: Maintain a curated list of evaluated and approved tools. Employees can use these without additional approval.

Rapid evaluation track: For tools not on the list, offer evaluation that takes days or weeks, not months.

Self-service assessment: For low-risk tools, enable self-service risk assessment that guides appropriate use.

Speed matters. If official channels are too slow, people go around them.

Clear Guidance

People need to know:

• What tools are approved for what uses
• How to request evaluation of new tools
• What uses are prohibited
• What support is available

Make guidance findable and understandable. Hidden policies don’t work.

Rational Consolidation

Where proliferation has occurred, consolidate rationally:

• Identify overlapping tools serving similar needs
• Evaluate which best meets requirements
• Migrate to preferred tools
• Sunset redundant ones

Don’t demand immediate consolidation—manage transition thoughtfully.

Feedback Mechanisms

Create channels for people to:

• Request tools they need that aren’t available
• Report gaps in approved offerings
• Share experiences with tools they’ve tried
• Suggest improvements to governance processes

Feedback helps governance stay relevant.

Implementation Approach

Moving from proliferated chaos to balanced governance:

Phase 1: Inventory and Assess

Understand current state:

• What tools are being used?
• By whom, for what purposes?
• What data flows through them?
• What risks exist?

This inventory often reveals surprises.

Phase 2: Establish Framework

Create governance structures:

• Risk tiering criteria
• Evaluation processes by tier
• Roles and responsibilities
• Communication channels

Design processes that are usable, not just comprehensive.

Phase 3: Approve Core Tools

Evaluate and approve tools for common needs:

• General-purpose AI assistants
• Function-specific tools for key use cases
• Integration with existing platforms

Having good approved options reduces pressure for shadow tools.

Phase 4: Communicate and Enable

Launch governance:

• Communicate what’s approved and how to use it
• Train on tool usage and policies
• Provide support channels
• Make guidance accessible

Governance only works if people know about it and can follow it.

Phase 5: Transition and Consolidate

Move from current state to desired state:

• Migration support for moving to approved tools
• Grace periods for transitioning away from unsupported tools
• Data transfer assistance where needed
• Ongoing monitoring

Manage transition, don’t demand instant compliance.

Phase 6: Continuous Management

Maintain governance ongoing:

• Regular tool evaluation and approval
• Policy updates as landscape evolves
• Monitoring for emerging shadow tools
• Periodic framework review

Governance isn’t a one-time project. It’s an ongoing function.

Roles and Responsibilities

Clear accountability matters:

IT/Security

• Tool security evaluation
• Technical integration assessment
• Monitoring and enforcement
• Infrastructure support

Procurement

• Contract and terms review
• Vendor relationship management
• Cost optimisation
• License management

L&D

• Training on approved tools
• Use case development
• Capability building
• Change management support

Business Functions

• Requirements definition
• Use case identification
• Adoption within their areas
• Feedback on tool effectiveness

Governance Body

• Policy decisions
• Cross-functional coordination
• Exception handling
• Framework evolution

Collaboration across functions is essential.

Supporting Innovation Within Governance

Governance shouldn’t kill innovation. Enable experimentation appropriately:

Sandboxes and Pilots

Create spaces for controlled experimentation:

• Sandbox environments for testing tools
• Pilot programs with limited scope
• Clear criteria for pilots becoming production

Experimentation with guardrails beats either uncontrolled experimentation or no experimentation.

Innovation Time

Give people time and permission to explore:

• Dedicated time for tool evaluation
• Access to promising tools for testing
• Forums to share discoveries

Channel exploration energy productively.

Fast-Track for Clear Value

When tools show clear value, move quickly:

• Rapid escalation paths for compelling tools
• Authority to approve quickly when risk is managed
• Resources to support rapid adoption

Don’t slow-roll obvious winners.

Communication Throughout

Ongoing communication maintains governance effectiveness:

Regular Updates

• Newly approved tools
• Policy changes
• Sunsetting announcements
• Upcoming evaluations

Accessible Resources

• Current approved tool list
• Usage guidelines
• Request processes
• Support contacts

Success Stories

• How teams use approved tools effectively
• Benefits realised
• Lessons learned

Open Dialogue

• Forums for questions and discussion
• Feedback collection
• Governance Q&A sessions

Keep people informed and engaged.

The Balance Point

The goal is balance:

Too restrictive, and people work around governance, innovation suffers, and the organisation falls behind.

Too permissive, and risks accumulate, costs escalate, and chaos reigns.

The right balance:

• Enables experimentation with appropriate guardrails
• Provides excellent approved options for common needs
• Uses proportionate process for different risk levels
• Evolves as the landscape changes

Finding this balance is an ongoing calibration, not a one-time decision.

When you get it right, governance becomes enablement—helping the organisation capture AI value while managing inevitable risks.

That’s the point.