Earlier this month, I spoke with a mid-sized fleet that had discovered a key staff member was not only using a personal artificial intelligence tool in their daily work but had also begun training others in the organization to do the same.

The conversation stuck with me — not because this fleet was reckless, but because this is becoming increasingly common across the trucking industry.

Employees are reaching for the fastest tools to complete their work, and those tools are increasingly AI-powered. Yet leadership often believes the answer to the question, "How much AI are we using in our organization?" is "Not much."

That gap between perception and reality presents a multitude of risks.

Shadow AI, or the use of AI tools that the organization did not specifically approve, inventory or set acceptable use policies for, is already present in your operation whether you have a strategy for it or not. The question that we all need to ask is how to increase our visibility of these tools and narrow the gap between perception and reality.

Shadow AI Is Already Here

This is not a theoretical risk.

Verizon's 2026 Data Breach Investigations Report found that 67% of professionals who regularly use AI at work access those tools through personal accounts that their IT and security teams have never authorized.

WatchGuard's 2026 Hygiene Report reached a similar conclusion for midsize organizations: Among companies with 50 to 500 employees, 64% of workers admitted using unauthorized AI tools for work.

This isn't an occasional exception. It's a systemic risk.

Many people assume these users are junior employees or interns experimenting with chatbots. Unfortunately, the data says otherwise. One 2026 workplace study found that senior employees and decision-makers were more than twice as likely to use unsanctioned AI tools as the employees they manage.

These are often the same people responsible for establishing AI policy, yet they may be working outside their own governance practices.

That changes what a solution looks like.

This isn't an issue that can be addressed with a sternly worded memo or a single all-staff meeting to cover acceptable-use policy. In fact, in many organizations, an AI policy doesn't yet exist.

Shadow AI is everyone's problem, including senior leadership. That means the same rules need to be applied at the very top of the organization as for the rank and file.

What Shadow AI Looks Like in a Trucking Fleet

In transportation, Shadow AI can take many forms.

• Shadow AI is a dispatcher pasting customer lane information or rate histories into a free chatbot to draft an email. This means competitive data is leaving the building through an unregulated tool.
• Shadow AI is a safety manager dropping driver information or personnel performance notes into an AI-powered tool to summarize them.
• Shadow AI is someone in operations uploading rate confirmations or bills of lading into a public large language model AI tool for analysis.

Every one of these instances is a person trying to work more efficiently. But every one of them is also part of a pattern: a helpful tool with unclear rules, facilitating the movement of sensitive data outside the systems your organization controls.

Once that data is in a public model, you lose the ability to say where it went and how it was stored or used.

AI Needs the Same Discipline as Other Fleet Systems

No fleet would allow a driver to run miles off the books. We have compliance programs designed to prevent that risk because we understand the importance of authorized, documented activity.

Yet many organizations are allowing teams to use AI tools with no record of what data leaves the company, which tool it passes through, or where it ultimately ends up.

We treat electronic logging devices as a non-negotiable record of activity. We should apply that same discipline to understanding and managing the AI tools that access our data.

Governance Comes Before Technology

The underlying issue is that the fundamentals of AI governance and accountability are not yet widespread across the trucking industry.

Too often, there are not clear policies defining which AI tools are approved and how they may be used. They also often lack a complete inventory of AI tools being used across the organization, creating a significant blind spot in understanding the movement of the company data.

This is not tomorrow's problem. It's a right-now problem.

Frameworks such as NMFTA's Cybersecurity AI Governance Framework, the NIST AI Risk Management Framework, and ISO 42001 were developed specifically to help organizations close these gaps.

ISACA's 2026 research found that one-quarter of organizations have no AI policy at all. More than half of security professionals surveyed also said they don't know how long it would take to shut down AI tools during a security incident — a challenge made even greater when unauthorized tools aren't even part of the company’s inventory.

Where Do I Start in Addressing Shadow AI?

Assuming you know how AI is being used across your organization can be expensive.

Start by inventorying the AI tools already in use. Talk with employees and ask how they are using AI today. You may discover they have identified legitimate business needs but lack approved tools to meet them.

Where there is a clear business case, provide sanctioned AI solutions. Where there isn't, educate employees about the risks of using personal AI tools with company information. Often, Shadow AI indicates a need that is not being met by the tools provided by the organization.

Sit down with your leadership team to determine how you will govern AI usage across the organization. Develop an acceptable-use policy that applies to everyone, communicate it clearly, and listen to the feedback.

Be prepared to update the policy as approved AI tools are added. Make sure you have a team that is responsible for AI policy and governance.

Most importantly, educate employees about the risks that unauthorized AI tools pose and how sensitive information can be unintentionally exposed when well-meaning employees use personal AI tools for work.