AI Will Scale Whatever Process You Already Have

Written By Vanessa Coulomb

Regular AI use on corporate devices tripled in a single year, from 15 percent of employees to 45 percent, according to Verizon's 2026 Data Breach Investigations Report. Two-thirds of those users sign in with personal accounts, outside company control. This is what security teams call shadow AI. Most leaders read these numbers as a security problem. They are an operations problem first.

Employees are not going around their organization to cause harm. They are going around it because the tool saves them an hour, and nobody has decided how the work should be done with AI. In most growing companies, nobody has decided how the work should be done at all.

That is the part the security framing misses. Every one of those unapproved tools is running on a process someone improvised: pricing that depends on who writes the proposal, onboarding that differs by manager, answers drawn from whichever version of a document was closest. The tool does exactly what it is asked to do. The problem is what it is asked to do.

David Turk put it precisely in a Forbes Technology Council article in June 2026: "AI does not fix broken workflows. It scales them." Gartner expects 40 percent of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5 percent in 2025. That scaling is about to accelerate, including the parts of every process nobody wrote down.

Why tools come before process

This sequence is not carelessness. It follows the incentives. Buying a tool is quick and visible, and one person can approve it. It shows the team, and often the board, that the company is moving. Mapping a process is slow and invisible, and it forces an uncomfortable discovery: three people do the same job three different ways, and each believes theirs is the standard. In a growing company, much of the real process lives in the founder's head or in the habits of the first ten employees. The tool arrives before anyone has had to make that knowledge explicit.

Three responses that miss the cause

When results disappoint, or when the security team discovers how much AI is already in use, the reflex is to train people better, switch to a better tool, or write an AI policy. Each addresses something real, and none reaches the cause. Training teaches people to use the tool on a process that is still undefined. A new tool inherits the same inputs. A policy tells people what not to do with AI; it says nothing about how the work should flow, which is why use keeps growing around it.

What works: diagnose with the people closest to the work

Here the shadow AI numbers turn from a threat into an asset. The employees already using AI without permission have done the first round of discovery for you. They know which tasks consume their time, which steps are redundant, and where the tool helps. They are not the problem to contain. They are the people to design with.

The discipline I rely on is DMAIC, the Six Sigma improvement cycle: Define, Measure, Analyze, Improve, Control. It sounds heavier than it is. Applied to AI adoption, it comes down to five questions.

  1. Define. Which process will the tool touch, and where does it start and end? "Sales" is not a process. "From qualified lead to signed proposal" is.

  2. Measure. How does that process perform today? Without a baseline, you cannot tell whether AI improved anything or simply made it faster.

  3. Analyze. Where does it break, and why? Rework, handoffs, and waiting are usually where the time goes, not the task the tool automates.

  4. Improve. Fix the process first, then decide which steps the tool should take on.

  5. Control. Who owns the process after launch, and how will you know if it drifts?

None of this requires a large team or a long engagement. For a single process in a company of twenty to two hundred people, it is a matter of weeks.

I learned this long before AI, leading the rollout of a new accounting system across ten offices in the Democratic Republic of Congo. Over four months, I worked with the Finance, Accounting, and IT departments at headquarters. Every office had to apply the same procedures to meet US government compliance requirements in a complex operating environment. Our in-country Director of Finance was instrumental. We used the rollout to train staff, and cleared a three-month backlog of late vouchers in three weeks. The software was the easy part. Agreeing on how the work should be done, in every office, was the project.

The question to ask first

Richard Steele, a McKinsey partner, argues that leaders should treat AI as a way to extend what people can do, not only to automate their tasks, and should ask which activities can stop to free up capacity. It is the right question, and it can only be answered by an organization that knows where its capacity goes today.

So before the next tool, ask which process you are willing to hand it, and whether you could describe that process on one page. If you can, AI will make it better. If you cannot, AI will only make it faster.

VLC Advisory helps growing organizations put their operating system in place before they scale it. If you are not sure which process you would hand to AI first, I would welcome a conversation. That is exactly where a diagnostic starts.

Source links

Vanessa Coulomb
Next

The Strongest Operations I Have Seen Assumed Something Would Break