AI Governance in Manufacturing: How to Manage Shadow AI Without Killing Innovation
An apprentice builds a working AI application in 24 hours. The IT department announces 6 months to bring it to production. This anecdote, shared during a panel at Tech For Industry Show 2026 at Paris Expo Porte de Versailles, sums up every manufacturer's dilemma: after Shadow IT comes Shadow AI. Three speakers — two manufacturers, including Michelin, and a software provider [names to be confirmed] — delivered a candid, no-spin discussion on enterprise AI governance.
Shadow AI: The New Challenge for Industrial Leadership
Web-based tools now deliver, within hours and from a simple description of the need, the infrastructure, data model, backend and interface of a full application. As a result, data scientists, process teams and operations teams build their own solutions — without cyber validation, without knowing where the data is hosted.
The "24 Hours vs 6 Months" Frustration
Moving to production means going through the full standards pipeline: IT department, cybersecurity, data localization. Faced with a genuine business need, saying no is extremely difficult — especially as everyone already uses AI daily, at work and at home. The emerging answer is twofold: define a framework of what is and isn't allowed, in a context of heightened cyber risk driven by the geopolitical environment; and retool internal IT to deliver solutions fast, building on structured data, coding agents and low-code.
The Michelin Case: "Digital Rules" for a Framework of Autonomy
Michelin has formalized digital rules that define the autonomy granted to its plants, backed by a catalog of group-standard solutions.
Citizen Development, Yes — But Governed
The citizen developer approach is encouraged, under two conditions: only on group-standard solutions, and only after validating a set of skills. The reason is very concrete: an application built on a Friday evening on a standard solution cost €50,000 in a single weekend. Because it ran on a group-monitored solution, the drift was identified and fixed within two days — a textbook illustration of the value of a framework.
Cybersecurity and Cost: The Two Reasons for a Stronger Framework
First stake: cybersecurity. The assessment is blunt: startups and small vendors almost never reach the expected security level — "penetration tests, we break through systematically" — a real challenge when solutions run on proprietary hosted clouds. Second stake: costs, which can spiral fast and will keep rising. The chosen direction: strengthen the framework while dynamically expanding the catalog of standard solutions (web apps being the current top demand), and consider regional teams to support local practices.
The Hidden Stake: Talent Attraction
Twenty-five to thirty years ago, technology reached the shop floor before it reached the home. Today it's the reverse — and the gap is widening ever faster. For a young recruit, facing tools that lag behind their smartphone breeds frustration and hurts the attractiveness of manufacturing careers. Team performance requires a "playing field" that respects cybersecurity and governance while granting real freedom.
On the Vendor Side: Integrating New Technologies Fast
For solution providers, the answer is speed of integration: one speaker cites a natural-language data exploration assistant, released in beta in late 2025 and now being deployed, enabling users to build use cases quickly with generative AI.
The Best Advice for Scaling AI Deployment
Asked for their single best piece of advice to an industrial director starting a large-scale AI rollout, all three speakers converge — and none answers "technology":
- Start with governance, skills and culture: the technology is there; this is a cultural transition as much as a technical one, requiring all stakeholders at the table (including IT convergence).
- Combine citizen and top-down approaches: empower the field to build, while keeping overall steering — the most impactful combination for efficiency.
- Lead with change management: technical expertise, methodological skills and management/engagement form the three pillars; "the technical solutions exist — the human side is what makes projects succeed."
The panel's closing line: "The technology is ready. Now it's up to us to be."
FAQ — AI Governance in Industrial Companies
What is Shadow AI? Shadow AI refers to AI applications and uses developed by employees outside the IT-validated framework — the heir to Shadow IT, amplified by tools that generate a complete application in a few hours.
Should citizen development be banned? No: the Michelin example shows it can be allowed under conditions — group-standard solutions only, validated skills — with monitoring that limits drift (a poorly designed app can cost tens of thousands of euros in a weekend).
Where should a large-scale AI deployment start? With governance, skills and culture — not technology. That was the unanimous answer of the three panelists.
Watch the Full Panel
This panel was recorded at Tech For Industry Show 2026, the B2B trade show for industrial transformation (Smart Manufacturing, AI, Supply Chain) at Paris Expo Porte de Versailles. Watch the full discussion above, and join us on May 19–20, 2027, Hall 7, for the next edition.
