Compiler

AI Is Not the Next Software Rollout

The real risk isn’t what employees are doing with AI. It’s what you can’t see because you tried to stop them.

A vintage office door with frosted glass, slightly ajar despite a chain lock — with modern screen light bleeding through the gap. The tension between analog security and digital inevitability. [Conceptualized by Dave Hallmon, AI-generated image]. Made by Google Gemini 3.1 Pro, 2026.

I teach my students to treat AI like a power tool, but as something you disclose, validate, and never let do your thinking for you. I say it every semester. I believe it.

And then I shipped a status update to a client sponsor with an LLM’s reasoning still inside the document.

It was a Word Doc. A routine project update. I’d used AI to draft sections, edited quickly, and then sent. What I didn’t catch was a line the model had left behind, something like “Would you like me to expand on this section?” buried in a paragraph I thought I’d rewritten. The client highlighted it, dropped a comment in the margin, and wrote: “Who is this addressing?”

This was before AI was table stakes. There was no casual way to explain it. No “oh, everyone uses Copilot now.” Just silence, a correction, and a quiet lesson I haven’t forgotten.

I’m the guy who teaches this for a living. Twenty years in the classroom, telling students to verify every output, own every word, never let the tool’s confidence substitute for their own judgment. And I still made the mistake. Not because I was careless, but because the output looked close enough to trust.

That’s the problem this piece is about. Not the tool. The trust.

Because that moment (polished output, missed error, someone else catching what I should have caught) is happening inside every organization right now. Someone in marketing has a deliverable due in an hour. The copy is flat. Her manager rewrote her last three attempts. She opens a chat window, pastes the paragraph, and types: “Rewrite for executive audience.”

No ticket. No procurement. No steering committee.

Just a capability that’s suddenly everywhere.

Here’s what leadership needs to understand about her: she’s not being reckless. She’s being resourceful. She has a deliverable, a deadline, and a tool. The organization put pressure on her. The internet gave her the workaround. Nobody gave her guidance.

There’s a name for this, “shadow AI,” and it isn’t inherently bad. It’s invisible. And invisible is where risk compounds.

This is why many corporate AI strategies are already off track. IT is trying to make AI behave like enterprise software. That instinct is understandable.

It’s also a mistake.

The goal isn’t to get ahead of AI. It’s to stop pretending we already have.

Ethan Mollick put it plainly in ***The Economist.*** A system built to predict the next word in a sentence can also write code, offer strategic advice, and respond with genuine empathy. And yet the dominant corporate instinct is to slot it into existing processes, assign it KPIs, and hand it to IT for management.

“This is a profound strategic mistake.”

He’s right.

Not because IT is failing. Because the mandate is wrong.

IT departments are built for deterministic tools. Procure a platform, control the access, manage the integration, define the terms of use, and expect the same output tomorrow that you got yesterday. Input A produces Output B. You can test it. You can scope it. You can own it. That’s the model, and for decades, it’s worked.

AI breaks that model.

AI is probabilistic. Its failure modes aren’t only bugs in the system. They’re behaviors from the system.

Outputs shift as models shift, as workflows shift, as prompts shift, and that person in marketing will discover new uses faster than any policy can keep up.

You can’t write a test case for chaos.

By the Time You Notice, It’s Already Everywhere

That’s why treating AI like the next CRM rollout or the next office suite deployment creates a false sense of control. The dashboard may look tidy. The policy memo may look serious. The steering committee may even feel responsible.

Meanwhile, the real adoption curve is already happening quietly somewhere else.

We’ve seen this before.

COVID taught institutions what exponential, partially invisible disruption feels like from the inside. It taught leaders what it means to make decisions while the environment itself is changing.

The analogy has limits, and they matter. COVID spread through biological transmission with no user agency. Our staff didn’t choose to catch it.

AI adoption is a series of individual choices made by you and me, solving real problems. That distinction is important because it changes what leadership should do about it.

You’re not containing a pathogen. You’re shaping behavior. But the structural dynamics, that is, the invisible spread, exponential compounding, and institutional lag, are the same.

And the timing matters.

OpenAI released ChatGPT publicly on November 30, 2022, in the long tail of the pandemic, when we were already conditioned to absorb sudden change before fully understanding it.

Our corporate immune systems were exhausted.

Our appetite for “we’ll figure it out” was too close to home.

We know what happens when institutions move slower than the thing they’re managing. We’re doing it again.

[embed]Who’s Really Teaching AI? Not Who You Think In 1947, Grace Hopper proved machines need humans. Today, we pretend they don’t.medium.com

Your Pilot Is Still in Procurement While Usage Is Compounding

COVID spread before symptoms were obvious. Inside companies, Shadow AI does too.

During the pandemic, people transmitted the virus before they felt sick. In organizations, employees adopt ChatGPT, Copilot, Claude, Gemini, and dozens of niche tools long before anyone in governance sees the “symptoms.” Many of these tools arrived while people were still working from home, building workflows on personal devices, on home networks, with no IT visibility. By the time employees returned to the office, the habits were already formed.

The symptom might be a lawyer citing cases that don’t exist. A media outlet retracting AI-generated copy. A data-handling incident. A strange artifact was buried in a workflow that nobody reviewed closely enough.

By the time leadership sees the first clear problem, the technology is already embedded in everyday work. That’s the first thing leaders get wrong: they assume visibility comes before spread.

It doesn’t.

The second thing leaders get wrong is underestimating speed. COVID cases doubled, then doubled again, overwhelming institutions before many leaders understood what was happening. AI behaves similarly inside organizations. The official pilot is still in procurement, while unofficial usage is already compounding.

Someone in content is drafting copy. Sales is summarizing calls. Support is writing macros. Engineers are “just trying” code generation. Analysts are feeding meeting notes into whatever tool gets the job done fastest.

None of them thinks they’re doing anything risky. Most of them are right. But leadership doesn’t know which ones aren’t.

Nobody asked.

Nobody told.

None of it looks like “enterprise transformation” when viewed one employee at a time. Then suddenly it’s everywhere.

And then come the new model cycles.

You just finished writing policy for GPT-4, and now there’s a reasoning model that can browse the internet, analyze data in seconds, and book your next meeting.

One-Time Training Doesn’t Work

Training employees once on “responsible AI use” doesn’t stick because the underlying reality doesn’t stay still. Today, you’re using the worst version of AI you’ll ever use. New features, plugins, model behaviors, and use cases show up too quickly for any one-time training to hold.

This isn’t a one-and-done problem. It’s a continuous one. Guardrails reduce harm, but they don’t eliminate it. The tools will keep changing, and the training has to keep pace.

And there’s a deeper problem most organizations don’t talk about enough: what gets left behind.

Auto-generated code becomes orphaned, adding to the technical debt IT is already managing. Hallucinated claims slip into knowledge bases. Biased patterns get embedded in decision systems. Weak assumptions get copied forward because the output sounded polished enough to trust.

I learned this one the hard way, too.

Last year, I prepared a presentation for department leadership. I’ll admit, nearly the entire deck was built with AI. The slides were clean. The structure was logical. The talking points were sharp. And when I stood in front of the room, I fumbled through it. I couldn’t riff on the data because I hadn’t wrestled with it. I couldn’t answer follow-up questions with confidence because the confidence had belonged to the model, not to me. The deck looked like mine. The thinking wasn’t.

That’s the failure mode researchers at the ***Harvard Law School Forum on Corporate Governance*** have labeled “workslop,” and employees using AI to produce work that’s polished but inaccurate or lacking substance. The damage isn’t just lost productivity. It increases risk exposure by failing to apply critical thought to AI outputs. When the surface looks professional, the instinct to verify weakens. The risk isn’t theoretical; an analysis of Fortune 100 10-K filings found that 22% of those companies now flag AI hallucinations, inaccuracies, or bias as material risks.

And there’s another version of it that’s harder to measure: when an executive expects a one-pager and gets five, that’s not added value. That’s noise dressed up as thoroughness.

Even after you “manage” access, the output remains, quietly shaping work, quietly creating downstream error, quietly compounding.

The footprint isn’t only in the tool. It’s in the output.

The Compliance Trap

This is why governance theater is so dangerous. I know what Legal is going to say. They’ll say the mandatory 15-minute compliance video protects them from liability. And in regulated industries. In finance, healthcare, and defense, the compliance-first controls aren’t optional rituals. They’re legal obligations. That same analysis makes this case clear: organizations need robust testing to catch unintended behaviors, explicit accountability for AI work quality, and board-level governance processes that extend well beyond IT.

That’s not theater. That’s infrastructure.

But a mandatory AI training module that employees click through while eating lunch is the enterprise equivalent of an empty syllabus statement. It checks a legal box. It changes zero behavior. A syllabus statement about AI isn’t a box to check. It’s a map. Without it, you’re not leaving space for exploration. You’re leaving space for fear. The same is true for corporate policy.

The trap is when infrastructure becomes the entire strategy.

And the gap is wider than most boards realize. An ***ISS Governance Analysis*** found that only 9% of companies have adopted formal AI policies, even as 16% of boards now include directors with AI expertise. The directors are arriving. The frameworks aren’t.

A policy that asks staff to add “do not share PII” to their system prompt isn’t a strategy. A policy PDF nobody reads isn’t a strategy. A checkbox isn’t a strategy. These are hygiene measures that can make leaders feel in control without meaningfully changing the risk surface. We learned that lesson during COVID, too. Some behaviors reduce harm. Others mostly reduced anxiety.

The hard question is knowing which is which, and being honest when you aren’t sure.

[embed]The AI We Can Actually Trust New research shows we can build AI systems that explain their reasoning — but only if we’re willing to sacrifice raw…ai.plainenglish.io

Containment Is a Fantasy in a World That Ships at Internet Speed

False confidence is always more dangerous than honest uncertainty.

We don’t need a thousand careless users to create a crisis anymore. We just need one.

In late March 2026, a source map file bundled into a release ***reportedly exposed a large volume of internal TypeScript code on the npm registry tied to Anthropic’s Claude Code tool. The package was public for roughly three hours. In that window,[ a post on X sharing a download link](https://x.com/Fried_rice/status/2038894956459290963) reportedly reached 16 million people.[ Rewrites began appearing on GitHub almost immediately](https://techcrunch.com/2026/04/01/anthropic-took-down-thousands-of-github-repos-trying-to-yank-its-leaked-source-code-a-move-the-company-says-was-an-accident/)***, with one repository hitting 50,000 stars within hours. Anthropic issued approximately 8,000 DMCA takedown requests. The code is still in the wild.

[embed]

The organizational consequences were immediate: competitive exposure, legal response costs, internal forensics, and a public narrative that no communications team would have chosen. All from a single packaging error in a routine release from a flagship AI provider.

That’s the AI version of a superspreader event. One mistake. Massive distribution. Consequences that compound long after the initial window closes.

The leadership lesson is uncomfortable precisely because it’s ordinary. The greatest threat isn’t always malicious intent. Sometimes it’s a modern system operating at modern speed with more confidence than visibility.

This is also why the “just lock it down” instinct eventually fails. During COVID, hard lockdowns bought time, but they came with real economic costs, and the organizations that found ways to adapt outperformed the ones that stayed locked down. The same logic applies here. Companies that ban AI don’t eliminate the risk. They eliminate their ability to compete with companies that didn’t.

AI bans inside companies work the same way. You can block one site. You can’t block a capability that runs in a browser, on a phone, through an API, inside a productivity suite, or through an open-source model running locally.

You can’t firewall your way out of a technology that runs on a phone and costs zero dollars.

When you block visible channels, you often don’t reduce use. You reduce visibility. And once you lose visibility, the data stops telling a complete story. And without a complete story, you don’t have a strategy. You have guesses.

So What Should Leaders Do Instead?

I’ve heard the question out loud in more than one meeting: “Can we just turn it off?”

No. You can’t. And the longer that question drives strategy, the further behind you fall. Your external clients are already using AI more than you are. Your interns and potential hires expect it. If your organization isn’t using it, top talent will find one that is.

The question isn’t “Can we turn it off?” The question is “What are we not seeing because we tried to?”

Stop aiming for “AI under control.” That goal implies a steady state that isn’t coming. The model surface will keep changing. Workflows will keep changing. User behavior will keep changing. The goal isn’t control. The goal is resilience.

Put it on the CEO’s desk. AI can’t live as an IT implementation detail. Boards should oversee governance processes enterprise-wide, making AI part of the conversation where actual decisions get made. While not treating it as a standing agenda item for the technology committee alone.

Learn faster than the tools change. Build the ability to learn from what’s happening inside your organization in real time. ***Researchers at MIT Sloan*** call these “emergent practices” where governance evolves as conditions shift, rather than being designed upfront and handed down. Another MIT researcher frames the shift more bluntly: stop experimenting and start finding solutions that create real value at scale.

This is where honesty about cost matters. A real institutional learning capability requires staffing, executive sponsorship, and someone with the power to say no to a VP.

Someone has to own it.

Someone has to fund it.

And it will compete for budget against teams that ship product. Most organizations that say they want this haven’t answered the resource question, and the ones that have often discover that the political difficulty is harder than the technical difficulty. That’s not a reason to skip it. It’s a reason to start with a scope you can actually sustain.

Let IT do what IT does best: identity, access, logging, integration, classification, and conduct vendor reviews without pretending that rail-building is the same thing as ownership. IT should be essential here. It just shouldn’t stand alone.

Make visibility safe. This is the one that matters most. Go back to that person in marketing. She used AI because it solved a real problem. If she thinks disclosing that will get her punished, judged, or quietly used against her, she’ll hide it. That’s rational behavior.

Hidden Shadow AI is catastrophic for governance.

Leaders should want people to disclose what they’re using, what data they touched, where it worked, and where it failed. Not to punish. To learn. Start small: make AI use a standing question in team standups. Run a monthly “what we tried and what broke” review where disclosure is expected, not punished. Build the muscle before you build the policy.

The Operating Condition

You can’t manage something unpredictable with tools built for predictability. COVID taught us that. AI is teaching us again.

It isn’t the next software rollout. It’s the next operating condition. And like COVID, its effects on workflows, decision-making, and organizational trust are here to stay.

Some COVID behaviors reduced harm. Others reduced anxiety. AI governance has the same trap: it’s easy to build rituals that feel like control.

The companies that navigate this well won’t be the ones with the tidiest policy deck. They’ll be the ones willing to see what’s actually happening, name what they don’t yet understand, and build trust fast enough that people stop hiding.

Picture that person in marketing again. She’s been using AI for months. She’s good at it. She’s also terrified someone will find out. Now imagine she walks into her director’s office and says, “I used AI to rewrite this campaign. Here’s what I kept, what I rejected, and why.”

That’s not a compliance problem. That’s a culture shift.

And right now, most organizations aren’t built for it. Not because the technology is too complex. Because the conversation hasn’t started.

Visibility. Honesty. Trust.

Without those three, the best policy in the world is just a PDF nobody reads.

Join the Conversation

What are you seeing inside your organization? Where is AI already changing the work before leadership has caught up? And if you’ve built a team or a process that’s actually working. One where people feel safe enough to say, “I used AI for this,” I want to hear how you did it. Especially when your experience contradicts mine.

[embed]List: Compiler | Curated by Dave Hallmon | Medium Compiler · Before it runs, something rewrites it. Every line you wrote. Then it erases itself. No log. No trace. · 4…medium.com

References

• Mollick, E. (2026, April 1). ***The IT Department Where AI Goes to Die**. The Economist*.
• Fernholz, T. (2026, April 1). ***Anthropic Took Down Thousands of GitHub Repos Trying to Yank Its Leaked Source Code**. TechCrunch*.
• Capoot, A. (2026, March 31). ***Anthropic Leak: Claude Code Internal Source**. CNBC*.
• ISS Governance. (2026, March 3). ***Mind the Governance Gap: The State of Board Oversight and AI Policy in U.S. Companies**. ISS Governance*.
• Henderson, L. & Smith, J. (2026, February 19). ***How Boards Can Lead in a World Remade by AI**. Harvard Law School Forum on Corporate Governance*.
• Brown, S. (2026, January 21). ***Looking Ahead at AI and Work in 2026**. MIT Sloan Management Review*.

The opinions expressed here are my own and do not reflect the views or positions of my employer.

I’m just a dad who blogs about the intersections of life, faith, family, and technology. These are the threads that weave through my personal and spiritual walk.

© Dave Hallmon, April 8, 2026.