From invisible shadow AI to a governed, measurable AI organisation.

The brief

Two hundred engineers and a genuine standing start: no sanctioned tools, no policy, no budget, no mandate. Just scattered personal AI use, invisible to leadership, the textbook shadow-AI risk. The organisation couldn’t afford to let its AI adoption stay accidental and ungoverned.

The build

We built the whole stack from zero, bottom-up, making the case to leadership and securing the strategy, budget and governance mandate to back it.

• An LLM proxy that routes and observes every request: real telemetry on tool calls, token spend and adoption per developer.
• An AI handbook: sanctioned tools, data rules with PII and GDPR out by default and secrets gated, and allowed practices.
• A rollout: 50 engineers licensed first, moved onto Claude, with a weekly training cadence in parallel.
• The controls around it: data policy, a tool-approval process and DORA and git metrics to measure outcomes.

The result

• Full visibility: real telemetry across every developer, not a self-reported guess.
• A complete governance stack built from zero in about five months.
• Measurable throughput gains, a real increase in PRs shipped.
• Happier developers, learning spec-driven and agentic workflows as the tools land.

Debrief

We led with visibility, not restriction. A proxy that surfaces what’s actually happening turns shadow AI from a blind spot into a managed, measurable capability, and gives leadership the evidence to invest further.

And we made it a change-management programme, not a tooling drop. Training, demos and pairing ran alongside the rollout, so adoption was about people, not just licences.