Shadow AI on the shop floor: how to find it without a witch hunt
Most AI use in a manufacturing company is already happening, unrecorded, on personal accounts. Here is how to measure it honestly — and why an amnesty gets better data than a policy memo.
Ask a plant manager how many people use AI at work and the answer is usually a shrug and a guess. Ask the floor anonymously and the number is almost always higher than the guess — often much higher, and concentrated in places nobody expected.
The tools are already in the building
A quality engineer drafting a deviation report in a chatbot. A buyer translating a supplier specification. A CNC programmer asking for feed and speed suggestions. None of them filed a request, because none of them thought a request was needed. That is not misconduct; it is what happens when a capable tool is one browser tab away and the rules are silent.
Why the first survey usually fails
The instinct is to send a form asking which AI tools people use. It comes back mostly empty. Employees read the question as an audit, and the honest answer — "I pasted part of a drawing into a free chatbot" — sounds like a confession.
The fix is not a better form. It is an explicit amnesty, in writing, from someone senior: nobody is in trouble, we are trying to learn. Response quality changes immediately, because the cost of answering honestly drops to zero.
Ask about the work, not the tool
The most useful question in an AI survey is not about AI at all. It is: which task eats the most of your week and feels like it should not? People answer that one freely, in detail, and the answers point at automation opportunities a tool-inventory question would never surface.
Pair it with "who or what do you wait on most?" and you have mapped the handoffs — which is where the delay usually lives, rather than inside any single task.
What to do with the answer
Shadow AI is a governance gap, not a discipline problem. The response that works is a short, readable policy that says plainly what may and may not go into a public tool, published alongside an approved alternative. A ban with no alternative simply moves the same activity onto personal phones, where you can neither see it nor protect it.
A note for regulated manufacturers
In an ISO 13485 or MDR environment the stakes are specific: device files, test results, complaint records and anything patient-identifying must never reach a public model. Those rules are easy to state and easy to follow — but only if somebody states them. Until then, every employee is inventing their own.