How are you all handling shadow AI and AI governance across your orgs?

Lately I’ve been trying to get a clearer view of how AI is actually being used across our org, and honestly it’s been way harder than I expected. Between folks experimenting with chatbots, teams plugging AI tools into workflows without formal approval, and third‑party apps embedding models under the hood, it all gets messy real fast. I get why it happens, since innovation usually starts in the gray areas, but as CIOs we can’t really afford that kind of visibility gap. We started putting together a lightweight AI governance framework, focusing first on transparency and accountability before worrying too much about enforcement. The trickiest part imo has been finding the right balance between enabling experimentation and keeping the compliance people from losing their minds. I’ve been testing a few monitoring tools to map out usage patterns and app origins. One that caught my eye recently was from Larridin not endorsing it or anything but they had an interesting take on decentralized AI tracking that didn’t feel too heavy handed. I think what’s missing in most orgs (ours included) is a shared understanding of why we’re monitoring in the first place. When employees hear “governance” they think we’re trying to shut things down, when really we’re trying to make sure we can scale what works. It’s a tough line to walk when everyone just wants to move fast and stay compliant at the same time. Curious how you’re approaching it in your orgs. Are you relying on in‑house frameworks, vendor platforms, or just old school policy documents to manage AI usage? What’s actually been practical for you so far?