The Governance Trap

The instinct to lock things down makes sense. Generative AI creates real exposure: confidential data pasted into a public model, compliance violations, hallucinated figures that end up in a client proposal. Risk officers aren’t wrong to be worried.

But overly rigid controls create their own problem. When the official path is slow or opaque, people find another one. They use personal accounts, unapproved tools, and workarounds nobody in IT knows about. This is what’s usually called “shadow AI,” and it produces the exact data risks the policies were designed to prevent. The tighter you squeeze, the more slips through.

The Culture Gap

On the other side, I’ve watched organizations run enthusiastic AI training sessions, lunch-and-learns, demo days, internal champions, and still see adoption stall after a few weeks.

The missing piece is usually psychological safety. Learning any new tool means exposing what you don’t know yet. For a lot of employees, that feels risky. Nobody wants to ask a question that makes them look behind, or submit work that reveals they’re still figuring things out. So they wait. They watch. They don’t really try.

Psychological safety is the belief that mistakes won’t be held against you. It’s what gets people past that hesitation. Research backs this up: it’s the strongest predictor of whether someone takes the first real step with a new system.

But here’s what the research also shows: once people are past that initial hurdle, psychological safety stops mattering much. Sustained, effective use comes down to whether the tool actually fits into how someone works. Culture gets you in the door. Utility keeps you there.

What Actually Works

Treating governance and culture as a single system, not competing priorities, is where most leaders need to shift their thinking.

Clear policies show people where the boundaries are. A safe culture gives them the confidence to work freely inside those boundaries instead of around them. Together, they cut off the conditions that produce shadow AI in the first place.

In practice, start with a structured pilot that has an explicit low-stakes window. Pick a small team, give them a defined timeframe, and tell them directly that the point is to break things and report back. No career consequences for mistakes made during the pilot. The goal is learning, not performance. When people believe that, they actually experiment instead of playing it safe and learning nothing.

Pair that with a visible channel where people can talk about what’s going wrong. A Slack thread, a standing agenda item in a team meeting, a shared doc, whatever fits the culture. The format matters less than the signal it sends: that problems are information, not failures. When someone posts “this tool gave me completely wrong output, and I almost sent it to a client,” that’s a win. It means the safety net is working.

One thing worth being deliberate about is who participates in the pilot. Mixed seniority helps. When a senior person admits they’re still figuring something out, it gives everyone else permission to do the same. That’s not a soft cultural nice-to-have. It’s how you actually move the needle on adoption speed.

The Practical Takeaway

Think in two phases. Phase one is adoption, getting people to genuinely try the tool, make mistakes, and build basic fluency. That’s a culture problem. Psychological safety is your lever.

Phase two is sustained use, making sure the technology actually changes how work gets done. That’s a systems problem. Governance, workflow integration, and real utility are your levers there.

Most leaders focus hard on one and assume the other will follow. It usually doesn’t. If your team has the tools but isn’t using them, look at the culture. If they’re using them but going off-script, look at the governance. Odds are good that whichever one you’ve been treating as secondary is exactly where the problem lives.