The Friction Dilemma
Santa Cruz Software’s recent survey of more than 300 creative professionals presents a statistic that should prompt an immediate review of corporate IT strategy. With 96% of organisations enforcing formal AI restrictions and exactly 96% of employees admitting to bypassing them, the conclusion is unavoidable: attempting to govern an agile creative supply chain through static policy alone is an ongoing and entirely predictable failure.
One immediate, though flawed, reaction is to interpret this as a staff training issue. These directives ignore the root cause: unapproved AI is faster and compliance cannot compete with deadlines.
Prior Art
This is not a new problem. The same problem emerged with cloud storage. Personal Dropbox and Google Drive accounts f solved a logistical problem which the approved tools usually did not. In time, organisations discovered that opening up their architecture (but keeping it within a policy framework) was more effective than just trying to ban products.
AI is following a similar pattern, but this time the stakes are higher. The Santa Cruz Software survey quantifies exactly why this governance failure is happening: 96% of creative professionals report saving more than five hours a week using AI tools, with over half saving in excess of ten hours. When an unsanctioned tool can hand a designer a full working day back every single week, the gap between an approved workflow and a shadow workflow becomes irresistible. This cannot be solved by HR or IT policies; a written document is useless in stopping a user from exporting an embargoed file to their desktop and feeding it into an unapproved web portal.
There is nothing inherently wrong with having an in-house AI policy. Organisations must establish parameters for how employees handle intellectual property and commercially sensitive data. Furthermore, regulatory frameworks like the EU AI Act have made it increasingly difficult for enterprises to simply ignore their unmanaged compliance liabilities.
The problem arises when the existence of a policy is mistaken for evidence that the activity is being governed – rather like assuming a smoke alarm works simply because one is fitted to the ceiling.
Why Shadow AI Breaks the Digital Asset Supply Chain
To understand why this is a critical enterprise issue, it is necessary to look past the generative hype and examine the mechanics of the Digital Asset Supply Chain. A digital asset is not merely a collection of pixels. It is an information package consisting of intrinsic data – the binary media itself – and extrinsic metadata, its identity, version history, rights, model releases, territorial usage limits and commercial status, to name just a few elements.
The risk with Shadow AI is that it destroys the visibility and traceability of the Digital Asset Supply Chain. To explain this, point, consider what happens if somebody takes an asset out of the DAM, processes it through an external AI service and returns a derivative, e.g. a modification like changing the background of an image from a grey to a blue sky. In doing so, they potentially risk losing part of the asset’s identity and provenance. The organisation may no longer be able to establish what happened, which constitutes a governance risk – even when nothing malicious occurs.
This single action could potentially remove critical metadata such as rights, usage limits and embargo status, without anyone realising.
Once the asset breaches the controlled enterprise environment, the audit trail is lost. Visibility over data retention, model-training usage and secondary distribution rights is now gone. When the modified derivative is eventually re-imported into the production pipeline, it arrives as a ‘file zero’ – a piece of untracked media with no recorded provenance, no version history and no linked permissions.
This illustrates a dangerous misunderstanding about what AI can and cannot do. Generative models operate entirely on visual probability – governance requires deterministic rules. An AI vision model can recognise that an image contains a specific product, but it cannot know if that product is under embargo, whether the subject has signed a model release for commercial use or if the distribution rights are restricted to specific regions.
The resulting metadata vacuum explains some of the anxieties captured in the Santa Cruz Software survey, where 73% of respondents flagged copyright issues and 66% cited data privacy and security risks. The issue is rarely that an employee is acting maliciously, it’s the fact they don’t know what happened – and now, neither does anyone else. The organisation can no longer prove compliance.
Engineering Governance at the Endpoint
The traditional model has governance hovering vaguely alongside the workflow. A written policy exists on an intranet somewhere, approval is theoretically sought and if something goes wrong, an audit trail (which is generally inadequate) may or may not establish whether the rules were actually broken.
Building a higher wall around the central DAM offers no practical protection; true governance requires embedding controls directly into the applications where the work actually takes place.
For decades, the DAM industry has struggled with user adoption because systems required creatives to leave their primary workspace (such as Adobe Creative Cloud) to interact with a browser-based repository. In an era of instantaneous generative AI, that friction is no longer just an annoyance; it is the driver of Shadow IT. Whenever a sanctioned route proves slower than a shadow alternative, productivity priorities will typically defeat compliance ones.
Rather than trying to prevent creatives from using AI tools, governance teams should make the sanctioned route easier to use. This requires shifting the DAM from a passive, centralised repository to an active, connected engine. By utilising endpoint connector software, organisations can integrate their DAM directly into the native interfaces of creative applications via its API.
When a designer can access approved assets, leverage sanctioned AI tools and have the resulting derivatives automatically checked back into the DAM with full provenance and metadata intact (all without ever leaving Photoshop or Illustrator), compliance ceases to be a separate task. The audit trail is maintained, rights information is preserved and the ‘file zero’ vulnerability is eliminated.
Organisations must move beyond an over-reliance on written documents. The only sustainable solution is to engineer governance directly into the creative supply chain, putting systemic control precisely where the work happens.
About Ralph Windsor
Ralph Windsor, a seasoned professional in the Digital Asset Management (DAM) industry since 1995, has served as the Project Director at Daydream, and he now oversees the editorial and commercial operations of DAM News. His extensive experience encompasses all facets of DAM implementation, including metadata schema design, vendor selection and change management. Windsor has contributed to over 120 DAM projects, offering expertise in areas ranging from data migration to ongoing governance. Based in the United Kingdom, he specializes in areas such as metadata, legal rights management and technical aspects of DAM.