Why bans drive AI underground

In module 1 you made four promises, and the first was that telling the truth about AI is safe. This module puts that promise to work. Before you can find a bottleneck, you need to know what AI is already running in your organisation, and the only people who know are the people using it.

This lesson is about the response most organisations reach for first, why it makes that job harder, and what to do instead. If you haven't read the four promises, start there.

Most of the AI at work arrived without asking

When Microsoft and LinkedIn surveyed 31,000 knowledge workers in early 2024, 75% said they used generative AI at work. Of those, 78% were bringing their own tools rather than waiting for the company to provide one, and in small and mid-sized companies the figure was 80%. MIT's 2025 study, which you met in module 1, found the same thing from the other side: people use personal AI tools for work in 90% of companies, while only 40% of companies pay for an official one.

Faced with numbers like that, more than one organisation in four had banned generative AI outright by the start of 2024. It's an understandable reflex. Data is going somewhere nobody approved, and a ban looks like the quickest way to stop it.

What a ban can reach, and what it can't

The best-documented ban is Samsung's. In April 2023, engineers pasted internal source code into a public chatbot. A few weeks later the company told staff in one of its biggest divisions that generative AI was off limits on company computers, phones, tablets and internal networks, and warned that breaking the rule could lead to disciplinary action up to dismissal. In an internal survey, 65% of the staff who answered had said these tools were a security risk. The memo called the restriction temporary, while the company built tools of its own (Bloomberg, May 2023).

Look at what that ban could reach: the company's own devices and networks. On personal phones the rule still applied, with no company information allowed, but nothing enforced it except people's goodwill. A company can block a network. It can't block a habit that saves someone an hour a day.

People say plainly what they'd do. In Software AG's 2024 survey of 6,000 knowledge workers, half were already using AI tools their employer hadn't provided, and 46% said they would refuse to give them up even if their organisation banned them.

Two losses, not one

A ban changes what leaders can see, not what people do. That costs you twice.

The first loss is the one the ban was meant to prevent. The data still goes out; you just stop knowing where. In IBM's 2025 study of 600 organisations that had suffered a breach, one in five said shadow AI was behind it, and organisations with high levels of shadow AI paid an average of $670,000 more per breach. A tool you can see, you can move onto a business plan, keep your data out of its training, and close when someone leaves. A tool you can't see, you can do none of that with.

The second loss is quieter, and for this course it matters more. The people who use AI most are the people furthest ahead. They've found which tasks it helps with and which it doesn't, and the things they've built show where your work gets stuck. MIT found that many of the strongest deployments in large companies began with exactly these people. Ban their tools and they don't stop. They stop telling you. The organisation keeps the risk and loses the learning.

How big is the blind spot?

Try it with your own numbers. The estimate uses published survey rates, so it's rough, but the direction doesn't depend on the exact figures. Compare saying nothing with a ban, and look at what happens to the part leaders can see.

Notice the third column. No survey can tell you how many of your people will speak up once the promises are in place. That's what the amnesty in the next lesson measures, and the pilot kit checks the answer against your own records.

What to do instead

None of this means anything goes. Some uses need stopping, and quickly: client data going into a tool with no agreement behind it, or an automation with access it shouldn't have. The difference is how you stop them.

• Stop the specific risk, not the whole category. Block the data flow or the tool that's doing harm, through stop, tell, fix, learn.
• Give people somewhere to go. Publish the approved tools from module 2 before you ask anyone to move.
• Make it safe to tell you. The promises, a custodian outside the management chain, and leaders who only ever see totals.
• Then ask everyone. That's the amnesty, and it's the next lesson.

Samsung's own memo pointed the same way: it called the ban temporary and promised a secure way to use these tools. A ban can be a reasonable emergency stop. What lasts is what you put in its place.

Before you announce anything, check what your current policy is already telling people.