Software development has left the engineering department, and most companies haven't noticed yet. Non-developers are building real applications with AI tools to solve real problems — right now, without asking anyone. The question isn't whether it's happening. It's whether you have a plan for it.
This is already the reality
A production manager at a print shop in Paris used ChatGPT to build an image-processing application that handles thousands of files. No formal developer training. And that's not a novelty — the same pattern is playing out across operations, finance, marketing, and HR. A substantial share of enterprise applications are already being built outside the IT function.
This isn't the old shadow IT
Old-school shadow IT meant someone signed up for an unapproved third-party SaaS tool. The vendor still owned the code, the security posture, the maintenance. This is different. Now your company owns the code — and the vulnerabilities, the maintenance burden, and the liability that comes with them. Research consistently shows AI-generated code carries elevated vulnerability rates, especially when the person building it has no security background. Which, by definition, is most of the people doing this.
And the economics guarantee more of it. When building a tool gets dramatically cheaper, companies don't pocket the savings — they produce more software. Volume goes up, not down.
A framework that fits your size
- Mid-market: Get basic visibility first. A simple intake — a form, a registry — so you at least know what exists.
- Growth-stage: Define lightweight approval standards before the crisis, not during it.
- Enterprise: Update governance to explicitly cover internally-built AI tools, with ownership requirements attached.
Three pillars, not a ban
Prohibition doesn't work — it just drives the building underground. What works is three things:
- Visibility into the tools that already exist.
- Risk-tiered review — a personal productivity script is not the same as something touching customer data, so don't govern them the same way.
- Clear ownership — every internal tool needs a name attached to it.
This isn't a futurist prediction. It's an operational reality that's already in your building. The leaders who get ahead of it will do it calmly and on purpose. The ones who don't will meet it as an incident.