A hidden AI army is working inside your company right now. Did you know?

Let me ask a question. How many people in your company use AI?

If your answer is “a few people, in a controlled way”, you are probably wrong. The real answer is most likely this: almost everyone, and most of them without your knowledge.

Your finance team has ChatGPT summarize reports. Your legal department has a chatbot read contract drafts. Your sales team copies and pastes customer data to have proposal text written. None of this passed through IT approval. None of it is written in a policy document. The literature has given it a name: Shadow AI.

And it is the biggest, least discussed corporate risk of 2026.

Everyone is accelerating, nobody is looking at the brake

The opening finding of the ITIL AI Governance study newly published by PeopleCert can be summed up in one sentence: organizations are adopting AI faster than they are learning to control it. Existing technology governance is not sufficient for this job.

I am not the one saying this. The new version of ITIL, the world's most widely used IT service management framework, is saying it. For the first time in its history, ITIL 5 was designed as “AI Native”. In other words, AI is no longer a module added to the framework; it is an assumption embedded in the whole of the value chain, the management practices and the four dimensions (people, technology, partners, processes).

What does this mean? It means the global standard has closed the question “should we use AI”. The new question is: who governs it, with what authority and with what assurance?

Six risks that come with a bill

The cost of ungoverned AI is not abstract. ITIL's new risk framework lists six items clearly: reputational and financial damage, harm to business relationships, legal exposure, negative return on investment, loss of intellectual property and shadow AI.

The item on this list that makes me think the most is intellectual property. When an employee, in good faith, pastes the company's pricing model into a chatbot, that data is no longer under your control. You cannot take it back. Not with a contract, not with a disciplinary process, not with a policy written afterwards. The only solution is a governance structure established before the incident happens.

Saying “we have an AI committee” is not enough

Over the past year, AI committees have been set up in many organizations in Türkiye. A good start. But ITIL 5's new AI Capability Model shows that the matter runs much deeper than a committee. The model positions governance on two axes: is authority centralized or distributed, is assurance structured or ad hoc?

Most Turkish organizations currently stand in the riskiest quadrant: authority distributed, assurance ad hoc. In other words, everyone is doing something and nobody vouches for anything.

The cycle consists of four steps: first you stress-test your existing governance structure, then you determine your AI governance requirements, next you design and implement the arrangements, and finally you make sure the structure stays responsive to change. Not a one-off audit, but a living system.

So where to start?

The honest answer: nowhere, without knowing where you stand.

In AI governance the first step is not writing policy, it is measuring the current state. Which team uses what, which data flows where, who holds decision rights, is there an assurance mechanism? Every policy written without the answers to these questions is destined to stay on the shelf.

At ITGT we developed a free tool for exactly this first step: the AI Governance Diagnostic. A 20-question self-assessment measures your organization's AI governance maturity and produces an executive summary you can present to the board. It takes ten minutes; incomparably cheaper than the cost of continuing to manage in the dark.

Shadow AI has already started working in your company. The question is: will you govern it, or will it govern you?

Measure your maturity level now with the AI Governance Diagnostic All insights