Software is being built everywhere these days, and most likely in places you wouldn’t expect: in accounting, in sales, or even in HR. AI has made it possible for people who can’t code to build their own apps and automations. Finance creates a margin report, salespeople connect AI to their email to automate quotes… How should a company approach these innovations?
With AI, you can build a tool in an afternoon. No waiting for IT, no lengthy rounds of specifications, development and revisions. Take that margin report, for example. A savvy colleague builds it, a month later the whole department is using it, and six months later, there's a process depending on it that management might not even know about…
The new technology brings speed and flexibility. But using it alongside your business systems comes with certain risks.
Citizen development, meaning building apps, reports or automations without knowing IT principles, isn’t anything new. With AI, though, it’s reaching a whole new scale. And oddly enough, it has a lot in common with so-called legacy systems:
On top of that, tools connected through employees’ personal accounts or their AI keys open the door to external attacks. So how do you deal with the citizen development phenomenon?
The first and fairly logical solution that comes to mind is to ban the use of AI at the company. Unfortunately, it doesn’t work, as Samsung’s experience from 2023 showed.
Samsung allowed its employees to use ChatGPT. Within three weeks, there were three data leaks, ranging from meeting notes to chip source code. So Samsung banned AI. But instead of greater security, the exact opposite happened: people kept using AI, they just stopped talking about it. And the company lost control.
You might think it would be enough to simply forbid any changes or data sharing in the prompt. That hasn’t proven to work either. At one large corporation, an AI agent ignored the ban and deleted a live database containing a thousand companies, created 4,000 fake records, and claimed that recovery wasn’t possible. Fortunately, it was, but this example shows you can’t rely on AI to follow instructions.
The best solution is to get AI tools at your company under control. And it’s simpler than you might think. It’s important to make clear right from the start that this isn’t about controlling people, but about enabling the company to innovate safely.
Your IT vendor may have advised you to use an AI gateway, a software layer between your business systems and AI applications. It certainly has its place. But it won’t tell you what your people are actually using, or what for.
That’s why we’ve put together a simple framework to help you get AI tools under control quickly.
Our AI governance framework has 5 key steps:
Based on our experience with our own implementation and with client projects, setting up AI governance takes roughly 60 hours, which is a pretty good deal for minimizing the risk.
This simple method, which we’ve put in place at our own company and also work on with our clients, addresses the biggest risks of citizen development and helps management sleep more soundly.
Ready to bring AI under control at your company? Let’s talk. We’ll guide you through the entire process and provide our document templates.