I’m working on a piece about how IT leaders can manage shadow AI effectively—balancing governance, security, and innovation as generative AI tools spread beyond formal oversight. I’m looking for your perspective on specific strategies CIOs can use to identify, control, and guide shadow AI activity in their organizations. In particular, I’d love your input around the below areas. Ideally, I’m looking for responses framed as strategies or best practices, i.e., specific steps or recommendations CIOs can take to address each of these areas. Written responses or phone interviews will work. Guardrails What kinds of guardrails should CIOs put in place to manage shadow AI—especially around approved tools, data types, and safe experimentation environments? What’s the most effective way to track and maintain an updated inventory of shadow AI tools or activity across departments? Security What are the most critical security controls (like data upload restrictions, encryption, or access limits) to prevent shadow AI from exposing sensitive data? How should CIOs define and communicate their organization’s risk tolerance for shadow AI use? Transparency and Culture What does transparency look like in an effective shadow AI governance program? What communication strategies help employees see shadow AI governance as a path to safe innovation rather than restriction? Training and Accountability How can CIOs design training programs that make employees aware of approved tools and the risks of shadow AI? How valuable is it to assign departmental AI stewards or champions to help monitor and manage shadow AI use?