Most conversations about AI in manufacturing start with the technology. What model, what platform, what use case. I think that misses a crucial component to success.
After years building and running the systems that run our plant floors, I've watched the same pattern repeat: a promising pilot works, leadership gets excited, and then the organization can't absorb it. Not because the technology failed — because the organizational design wasn't ready. The AI didn't break. The org chart did.
This isn't a new problem. It's the digital transformation problem wearing a new hat. We spent a decade learning that throwing technology at a process gap doesn't close it. Yet here we are, doing the same thing with AI — only now the stakes include regulatory exposure, validation obligations, and the kind of failure modes that keep quality leaders up at night.
I recently completed MIT CSAIL's professional education program on AI in business strategy, and it sharpened something I'd been circling for a while: the barriers to AI adoption in regulated manufacturing aren't technical. They're structural. And they have names. Over the coming weeks, I'm going to share three practical patterns — starting with the one hiding in plain sight.
The most dangerous AI deployment in your organization is the one you don't know about.
Somewhere in your facility right now, a quality analyst is pasting deviation language into a personal ChatGPT account to draft an investigation summary. A process engineer is feeding alarm data into a free-tier AI tool to look for patterns no one has time to analyze manually. A batch record reviewer is using a personal subscription to summarize a 40-page protocol before a deadline. They're doing it because it works. They're doing it quietly because they know it's not sanctioned. And you can't see any of it.
The Third Tier
Most organizations think about AI access in two tiers: tools we've approved and tools we've restricted. But there's a third tier — call it the shadow tier — where employees use AI tools on personal devices, through personal accounts, completely outside organizational visibility.
Ethan Mollick calls these employees "secret cyborgs": people who are already boosting their productivity with AI but hiding it because they don't want to deal with the consequences of being visible. They're not rogue actors. They're rational people responding to an environment that gives them no legitimate path to the tools they need.
This Isn't Hypothetical
The data on shadow AI use is striking, and it's getting worse.
BCG's 2025 survey of more than 10,000 employees across 11 countries found that 54% would use AI tools even without their employer's approval. More than half your workforce is telling you, directly, that your policy won't stop them.
TELUS Digital's 2025 research paints an even sharper picture: 68% of employees using generative AI at work are accessing it through personal accounts. And 57% have entered sensitive company information into public AI tools. Even among employees who have company-provided AI access, 22% still use personal accounts — suggesting the issue isn't just availability, but usability and trust.
Harmonic Security's analysis of over 22 million enterprise AI prompts found that employees at more than 90% of organizations were using AI tools, but only 40% of those companies had official AI subscriptions. The gap between actual use and sanctioned use is enormous, and most organizations aren't even measuring it.
The Real Failure
Here's where most governance conversations go wrong: they frame the shadow tier as a compliance problem. Employees aren't following the rules. The solution, in this framing, is more rules — stricter policies, tighter controls, better training on acceptable use.
But the shadow tier isn't an employee compliance failure. It's a structural failure by the organization.
When you restrict access to AI tools without providing legitimate alternatives, you don't eliminate demand. You displace it. The work still needs to get done. The tools still exist. The only thing that changes is visibility. And when the work goes underground, the organizational learning loop breaks completely. There's no documentation of what was tried. No peer review of the output. No escalation path when something goes wrong. No knowledge capture for the next person who faces the same problem. The organization bears all the risk but captures none of the value.
This is exactly what Eric von Hippel's decades of research on user innovation predicts. The practitioners closest to the problem — the ones who understand the process, the equipment, the failure modes — are consistently the highest-value source of innovation. When you suppress their access to tools, you don't get safety. You get suppressed innovation. The shadow tier is what happens when user innovation goes underground.
Why This Hits Different in Regulated Manufacturing
In a GxP environment, shadow AI isn't just an IT governance problem. It's a regulatory integrity problem.
When someone uses an undocumented AI tool to influence a deviation investigation, inform a CAPA assessment, or draft language for a batch record review, they're creating an invisible influence pathway into regulated decisions. The tool isn't validated. The prompt isn't documented. The reasoning isn't traceable. The data governance is nonexistent. And the organization doesn't even know it's happening — which means there's no corrective action possible until something goes visibly wrong.
Consider: a quality analyst at a large biopharma manufacturer uses a personal AI account to help interpret a trend in environmental monitoring data. The AI's summary influences her investigation narrative, which shapes the CAPA, which drives a process change. At no point does the AI tool appear in the investigation record. The entire reasoning chain has an invisible dependency, and the quality system has no mechanism to detect it.
This isn't a far-fetched scenario. Given the survey data, it's almost certainly happening right now, in facilities that believe they have AI under control.
The Design Problem
If you've read this far and your instinct is "we need better training" or "we need stricter policies," I'd push back. Training people on rules they've already decided to work around doesn't change behavior — it just makes the workaround less visible. And stricter controls in an environment where 54% of employees are willing to go around you anyway means you're building a wall that most of your workforce already knows how to climb.
This is an organizational design problem. The question isn't how to stop people from using AI. It's how to create conditions where practitioners can experiment safely, visibly, and with governance that enables rather than restricts. Conditions where the quality analyst in that scenario has a legitimate, documented, governed path to the same productivity gain she's currently getting in the shadows.
That's what the next two articles in this series will explore: why the most common organizational response — training programs — fails without practice infrastructure, and what a governance model built around domain expertise rather than centralized control might actually look like.
But I'm curious: how is your organization handling the gap between what's officially sanctioned and what's actually being used? I'd genuinely like to hear — especially from those of you in regulated environments where the stakes are highest.