Shadow AI is Coming: Build the Foundations before it Fragments

Across this series, we’ve looked at fragmented AI investment, the rush to launch AI projects, the AI dependence on OSS and BSS, and the need for combined planning as more autonomous systems begin to interact.

We’ve discussed coherent planning a lot throughout the series, which raises two obvious questions:

  1. If coherence matters this much, does everything need to be centrally controlled?
  2. How could – and should – it actually be done?

Let’s take a deeper look.

.

What if your AI transformation looked like an all-star recording session?

Imagine assembling an incredible group of musicians.

Eric Clapton on guitar. Paul McCartney on bass. Dave Grohl on drums. Herbie Hancock on keyboards. Kenny G on saxophone. Adele on vocals.

Then put each of them in a separate soundproof booth.

Don’t give them a song sheet. Don’t tell them the key, tempo or style. Don’t let them hear each other.

Just give them the same instruction:

Create something amazing.

In isolation, you can almost guarantee they will.

All-star musicians recording separately in soundproof booths without a shared song sheet

Each business unit will sign off each track, indicating that their track, their outcomes, are brilliant….

…But when someone eventually combines each track into a single song at some point in the future, it will almost certainly sound awful.

Why? That’s obvious. It sounds terrible because nobody agreed what they were collectively trying to create.

That’s the musical analogy to the Shadow AI problem.

Business units can have smart people, legitimate goals, strong domain knowledge and enough autonomy to create genuinely impressive things. But if each business unit or individual is operating separately, they’re all effectively working in soundproof booths.

.

Business units know things the centre doesn’t

As per the Shadow IT argument, every business unit carries its own tribal knowledge and context of the problems it’s trying to solve.

It understands its customers, systems, operational realities, constraints, objectives, history and opportunities in ways that a central transformation team often can’t.

The business units should retain the freedom to identify their own opportunities, experiment, innovate and decide where to invest their own resources, people and budgets.

You could argue that’s what gave rise to shadow IT in the first place. Teams bypassed central IT because they needed to move faster, solve their specific local problems and move decisions closer to the appropriate decision-makers.

AI is already creating many of the same pressures. In many ways, AI is even more democratised than earlier forms of IT. It’s more accessible to non-IT specialists and is only becoming easier to use.

That’s why trying to suppress local initiative with centralised IT is unlikely to be effective.

.

The answer isn’t to take those decisions away

Conversely, a highly centralised AI model may achieve the aim of reducing duplication, but it can also slow experimentation and separate decisions from the people who understand the business problems best.

This leans towards a hybrid approach working best:

Business units should have the freedom to innovate locally, while the enterprise creates the mechanisms for value to compound company-wide.

In the music analogy, the answer isn’t to take the instruments away from the band or for the sound recordist to play all the instruments for them.

The director’s role is to let the musicians remain brilliant, but give them the same song sheet, key, tempo, cues and listening points for coordination. The director and recordist then blend the tracks to become something bigger together.

.

That’s the real transformation challenge

AI / AN / AO transformation isn’t simply a technology programme.

It’s about making investment, architecture, governance, operating models and implementation decisions connect across the organisation, without forcing every decision to be made centrally.

So how do we achieve that coherence?

Our approach starts by resisting the temptation to jump straight to a list of AI projects.

Instead, we plan the transformation from both directions – understanding where the organisation is today, and what it will need to become tomorrow.

PAOSS OSS Transformation Roadmap and Project Plan

The diagram above is consistent with the TM Forum Transformation Project Framework (TPF) (GB 1011).

1.1. Start with the vision

First, we establish the guidelines and business outcomes we’re trying to achieve. Where do AI, Autonomous Networks and Autonomous Operations fit? What principles should guide investment and autonomy? What should remain local, and what needs to become common? What constraints (eg budget, resources, time, etc) do we need to work within?

This is the equivalent of agreeing the song we’re trying to play.

Without that, every team may still produce something impressive, but it won’t necessarily add up to a coherent enterprise result.

.

1.2. Understand the current state

Next, we assess what already exists.

What AI / AN / AO initiatives are already underway? What platforms, data, integrations, governance, skills and operating capabilities already exist? Where are teams duplicating work? What useful assets already exist that other business units don’t know about? What foundational building blocks do we already have to work with?

This is where you start discovering the equivalent of our $1.6 million chatbot example.

In the music analogy, this is where we realise the guitarist, bassist and singer have all been developing their own skills independently, each doing good work, but none of it specifically designed to fit together yet.

.

1.3. Define the future-state foundations

We then define the foundations the organisation will eventually need if local innovation is to scale coherently.

That usually includes things such as:

  • common security, privacy and identity controls
  • trusted data access and knowledge patterns
  • reusable AI and OSS/BSS integration building blocks
  • governance and decision rights
  • assurance, observability, rollback and recovery
  • intent and policy management
  • coordination mechanisms for interacting autonomous systems
  • an operating model that defines who owns, funds, contributes to and consumes shared capability

This is where standards become useful. Not as a separate compliance exercise, but as inputs into what “good” should look like.

ISO/IEC 42001 helps frame the organisational management system for responsible AI, including policy, accountability and continual improvement. The NIST AI Risk Management Framework provides a helpful lens through its Govern, Map, Measure and Manage functions. And TM Forum brings the telco-specific context through its AI governance, AI-Native ODA, Autonomous Networks and intent-related work.

These standards don’t give every telco the same answer. They can’t. But they do provide useful guardrails, patterns and questions as we design the future state.

.

1.4. Identify the gaps

Once we understand the current and desired states, the gaps start to become visible.

We then brainstorm a list of possible initiatives with the client. Some of those gaps will be technical. Often they’re more than that. We already have 3 different starter templates that we use to prompt (no pun intended) the client and create a long list of initiatives.

They might include, but certainly not be limited to, the following:

  • Shared data capability
  • An architectural building block that multiple initiatives require
  • Clarifying OpsModels and decision rights
  • Establishing governance mechanisms for assuring AI behaviour
  • Resolving competing autonomous objectives
  • Consolidating funding
  • Training and up-skilling
  • Partnerships
  • Vendor selection processes
  • Architectural patterns
  • Collaboration forums to avoid several teams unknowingly solving the same problem
  • etc, etc

This is the moment where we stop talking about “AI strategy” in the abstract and start seeing the practical work required to achieve coherence.

But this long list of initiatives can’t all be worked on at once. They help form a backlog for assessment and prioritisation by our RIAT (Rapid Impact Assessment Tool).

.

1.5. Prioritise initiatives to form a connected portfolio

From there, we turn the gaps into a portfolio of high-value initiatives, initiative clusters or projects.

Some will be business or operational improvements that deliver immediate value. Others will be foundational investments that make ten future use cases easier to deliver.

Rather than every business unit ranking projects independently, we can look across the portfolio and ask:

  • What business value does this create?
  • Which other initiatives depend on it?
  • What reusable assets will it leave behind?
  • Does it reduce the cost or risk of future initiatives?
  • Is another team already solving part of the same problem?
  • Does it create a multi-thermostat problem?
  • Should this capability be funded locally or centrally?

Finally, we translate the portfolio into an implementation plan.

For each prioritised initiative, we identify the required solution design, projects, resources, sequencing and business case.

But we also do something more important.

We deliberately sequence the transformation so that early projects create foundations that later projects can reuse.

One business unit might still sponsor the first implementation. But the architecture, security controls, data interfaces, assurance mechanisms or operating patterns it creates can become enterprise assets rather than remaining trapped in one project.

That’s how local investment begins to compound globally.

.

How this gets the band playing the same song

If the first four articles in this series described different facets of the problem.

We’re not trying to replace the band with one centrally controlled performer or stopping brilliant musicians from playing. In fact, we want to establish the studios where collaboration and experimentation is simplified.

We’re trying to make sure everyone is playing from the same song sheet.

That’s what our coherent AI / AN / AO transformation planning is really about.

It brings together:

  • business outcomes
  • investment priorities
  • architecture and reusable building blocks
  • governance and risk controls
  • operating models and decision rights
  • implementation planning and sequencing

I can almost guarantee that Shadow AI is inevitable in any large organisation. The hope is that when we combine your tracks, we’ve created a beautiful song rather than incoherent noise.

Download our AI / AN / AO flyer for an overview of the transformation challenges explored in this series. On Monday we’ll summarise and provide access our broader AI / AN / AO planning material to see how we turn these ideas into an executable roadmap.

If this article was helpful, subscribe to the Passionate About OSS Blog to get each new post sent directly to your inbox. 100% free of charge and free of spam.

Our Solutions

Share:

Most Recent Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.