Shadow AI Arrives as Email Forwards First

Shadow AI is not a SKU. It is behavior: employees paste prompts, forward screenshots, and shop vendor claims through mail long before IT opens a ticket. Gartner’s March 2025 CFO guidance is a useful cold shower: productivity gains from AI are uneven until workflows change (Gartner CFO AI productivity). OECD’s updated AI principles emphasize responsible conduct for deployers and suppliers (OECD AI Principles update). NIST’s AI RMF remains the vocabulary for vendor reviews (NIST AI RMF).

Why the inbox is the honest signal

People do not experiment in the governance portal. They experiment in threads. Effective programs give a fast review path that starts where the artifact already is.

Governance answers you can email

via.email routes specialist work to unique addresses; you forward context, you get structured outputs in-thread. No access to your inbox or external accounts; no sending mail for you.

• Assess AI Risk Exposure — assess.ai.risk.exposure@via.email
• Screen Vendor Security — screen.vendor.security@via.email
• Audit SaaS Contract — audit.saas.contract@via.email
• Rate Vendor — rate.vendor@via.email

Read next

Tie this to Shadow AI Arrives by Forward. Governance Answers in Mail., EU AI Rules Show Up in Decks and Inbox Threads, and The Copy-Paste Tax: Why Your AI Workflow Is the Real Bottleneck.

The takeaway

Blocking tools without a fast review lane does not reduce risk; it pushes risk into screenshots. Meet employees in the same forward they already use, and keep humans on the line for consequential sends.