Your operators are not waiting for IT’s permission. Here is the 90-day sequence that catches up without slowing anyone down.
Fabric Lab · Issue 04 · By Dave Goyal
A CIO told me his shop absorbed a ransomware attack last quarter. His first question was not about the ransom. It was: do we know what they saw. He did not know. Nobody did. His OT sensors, his ERP tables, his Power BI reports, and his SharePoint files were all logged separately, none joined.
Shadow AI is the same blind spot with a friendlier face. Your people already found a faster way to work. You just cannot see what they are feeding it.
The Numbers Nobody Wants On A Slide
73% of employees report using AI tools their employer has not approved, per 2025 research from Awareways. 27% of enterprise employees have pasted confidential company data into a public AI tool, per Airia’s 2026 shadow AI report. For manufacturers, that data includes quality inspection results, vendor contract terms, customer complaints, and router files.
None of this is a future risk. It already happened, this year, at a scale big enough to survey.
Why Blocking And Policy Alone Do Not Work
The instinct is to block the tools and publish a policy. Neither survives contact with a shift that needs an answer in the next ten minutes.
Blocking does not work because there is always another free tool one browser tab away. Policy alone does not work because a memo does not change behavior under deadline pressure. Training alone does not work for the same reason.
The only thing that works is giving people a safe alternative that is faster than the unsafe one. For a mid-market manufacturer, that alternative is Copilot Studio behind Microsoft Purview, running inside your own tenant. You do not need a Fortune 500 budget to stand it up. You do need to stop pretending the problem is not already inside your building.
The 90-Day Sequence
Days 1-15: Discover. Find what your team is already using. Survey. Watch network traffic. Interview managers. Do not judge yet. Just map the real footprint.
Days 16-30: Contain. Stand up Copilot Studio inside your own tenant. Enable Microsoft Purview with sensitivity labels. Block the top three public LLMs at the firewall, now that you know which three actually matter.
Days 31-60: Enable. Build two or three internal agents your operators will actually use: routing questions, drafting emails, looking up SOPs. The goal is making the safe path faster than the unsafe one, not just safer.
Days 61-90: Govern. Train your people on what changed. Publish a plain-English AI policy on a single page. Report progress monthly to leadership.
Most mid-market shops can run this sequence for well under $150K. The problem was never the tools. It was that nobody had sequenced them for a company this size.
What This Means For You
If you have not mapped shadow AI usage yet, start there before you buy anything. You cannot contain what you have not measured.
If you already have a policy but no sanctioned alternative, you have the second half of a plan with none of the first half. People will keep routing around it.
If your board is asking about AI governance this quarter, this sequence is a defensible answer: a dated plan with a start and an end, not an open-ended framework.
The One Ask
If you want this mapped against your own environment, I am opening a few slots this month for a Safe AI in 90 Days assessment: two weeks, fixed scope, a real usage map plus a sequenced 90-day plan on your numbers.
No pitch at the end. You keep the map whether or not we ever talk again.
Reply here or DM. What does your shop floor look like on this right now? Tell me in the comments.
I read every reply.
Next issue: The Made-in-America Data Stack. Every BOM just became a compliance object. Here is the data model that keeps a tariff audit from turning into a three-week fire drill.
New here? I write Data and AI Demystified, the hidden costs and reality checks on Microsoft Fabric most partners won’t publish. Subscribe here.
#ShadowAI #MicrosoftPurview #Manufacturing #CIO #DataStrategy
Click here to read this article on Dave’s Demystify Data and AI LinkedIn newsletter.