Shadow IT used to mean a SaaS subscription purchased outside the approval process. The fix was a procurement policy and a software catalog. It was an application-layer problem with a governance-layer solution. What is happening now with AI tools is not that problem. It is not a procurement problem at all. The AI control plane is sprawling across organizations because nobody classified it as infrastructure — and no approval workflow stops infrastructure that nobody recognizes as infrastructure.
Most organizations have already deployed AI control planes. They just never classified them as infrastructure.
This is not a model governance problem. It is an infrastructure authority problem. Model governance asks whether the right model is running for the right purpose. Infrastructure authority asks who owns the runtime layer it runs on — who governs the routing, who defines the failure domain, who owns the recovery path when the invisible inference layer breaks at 2am.
Shadow IT Was Always an Operational Authority Problem
The original shadow IT failure was never really about procurement. It was about operational authority. When a team ran their own file server in a closet, the problem was not the purchase order — it was that nobody owned the update cycle, the backup, the access model, or the failure response.
