Every regulated organisation we speak to has some version of the same memo: do not paste customer data into public AI tools. Every one of them also knows the memo is being ignored. Staff have work to do, the tools are genuinely useful, and the approved alternative is either missing or so restricted that nobody uses it.
This is usually framed as a discipline problem, to be solved with training, monitoring and consequences. We think that framing is why it persists.
People route around friction, not around rules
When the sanctioned path is slower, weaker or harder to reach than the unsanctioned one, usage flows to the unsanctioned one. That is not bad faith; it is how people behave under deadline. The fix is the same one that ended shadow IT file-sharing a decade ago: supply a better sanctioned option, then make it the default.
You do not win against shadow AI by blocking it. You win by making the governed path the easiest one.
What "as good" has to mean
A sanctioned assistant only displaces public tools if it meets the bar people are used to. In practice that means:
- Strong models. Access to capable cloud models where policy allows, and capable local models where it does not, behind one consistent experience.
- Their own knowledge. Answers grounded in the organisation's policies and documents, with citations, which a public chatbot cannot offer at all.
- Real tasks, not just chat. Typed AI Solutions for recurring work such as document reviews, summaries and assessments, so people get a structured result rather than improvising a prompt.
- No extra hoops. The same single sign-on as everything else, available on day one.
Governance people never have to think about
The point of the sanctioned path is that governance happens on it automatically. In AIRA Nexus, every request from AIRA Home passes the same checks before any model sees it: the user's entitlements, the model allow-list for their role, prompt-injection and PII guardrails, DLP rules and budgets. Afterwards, the interaction is written to a tamper-evident audit log.
The employee experiences a good assistant. The CISO gets an inventory of AI use, the data protection officer gets PII controls that run before the call, and finance gets spend attributed per user and team.
Where to start
Pick one population, such as a policy-heavy team, and give them a governed assistant grounded in the documents they already search by hand. Measure adoption, not just risk reduction. When the sanctioned path is visibly the better tool, the memo becomes unnecessary.
