There’s a common phrase you might hear in any discussion on artificial intelligence: “shadow AI”. It was a recurring theme at the Microsoft AI Tour, an event held recently in Dublin bringing together customers of Microsoft and organisations curious about how they can deploy AI.

AI tools have become so pervasive that many employees in organisations are using them anyway, whether they are company-mandated or not.

Understanding shadow AI is one part of understanding how organisations can safely and securely use AI. This has been the case at Musgrave, the family-owned retail company that has deployed Microsoft Copilot AI tool with its staff.

“That’s not to say that it wasn’t bumpy along the way,” according to Allan Russell, Head of IT at the retail group. “One of the reasons that we decided to go after Copilot was we were probably operating under the fallacy that there wasn’t a lot of AI being used internally.”

Russell and his team ran a series of checks on their systems to see what kind of applications employees were using at work and the results were clear. 

“We saw in a 30-day period 300,000 hits to one web-based free AI tool alone and we fairly quickly had our eyes opened to what was going on and that that was just a basic internet check.” he said.

This is a textbook example of shadow AI. People want to use AI to improve their work processes and better manage their time but potentially allowing a free-for-all with company data can be a security, privacy and regulatory disaster.

Russell oversees the rollout of Microsoft AI tools within the organisation, including Copilot, both to boost productivity but also to ensure greater security.

“From a data security side, knowing that we could roll out this capability and would reduce our risk profile in terms of what people could be using the third-party tools for was one side of it,” he said.

Russell described how Musgrave ran an “amnesty” programme for staff to come forward to show what AI tools they had been using to do their work but also to introduce employees to Copilot. He said it wasn’t about “reprimanding people”. Instead, it was about dialogue between the company and employees to understand AI, the risks and opportunities.

AI journey

These are types of journeys organisations are on with a technology that’s moving at a breakneck pace.

“Over the course of the last few months, I’ve met many organisations, and we’ve had lots of discussion in relation to their AI journey,” said Catherine Doyle, General Manager at Microsoft Ireland, speaking at the opening of the AI Tour in Dublin.

“Most of you are in the exploratory phase and that’s why today is so important because events like this are all about really leaning in and figuring out what’s going on with this technology and how you can adapt it for your organisation.

“AI is expected to increase Ireland’s GDP by at least €250 billion over the next ten years, according to our recent research published in partnership with Trinity College Dublin. AI is being increasingly viewed as a general-purpose technology, much like electricity or the internet. The deployment of electricity in the late 19th and early 20th centuries transformed economies and societies, leading to significant productivity gains and economic growth. In all industrial revolutions, a key technology advancement made it possible, but it was the adoption of general-purpose technology that drove the change.”

Doyle continued: “AI will touch every business and every consumer but the technology needs to be used across the whole economy to make it effective. AI will be the catalyst to drive innovation and growth for businesses and the public sector, putting intelligent assistance in the hands of individuals.”

2025 marks Microsoft’s 40th anniversary in Ireland – and its 50^th anniversary as a company. The multinational has been through countless cycles of new technology coming on the scene and shaking up the way people do business. 

The company has made substantial investments in AI, both internally and with investments in OpenAI, to put it at the forefront of a technology likely to shape the next 50 years. Ireland is a significant cog in that effort.

“A third of the people based in Leopardstown are engineering and are working to support the next generation of AI, so we’re developing this product and this technology right here in the Irish market,” Doyle said.

“It will be revolutionary, but how we use it needs to be responsible. We need to ensure that ethical considerations and societal trust are at the forefront of everything we do with AI,” she said. 

“Microsoft is incredibly committed to responsible AI, it’s a core value within the company, so how we design, develop and deploy AI will always be done with this in mind to make sure that everybody gets to use this technology in a safe and secure environment.”

Microsoft launched the Secure Futures Initiative last year, which Doyle said is the largest cyber security engineering project of its kind.

“There are 34,000 dedicated engineers in this project and security is our number one priority as a company. It represents a multiyear commitment to advancing the way Microsoft designs, builds, tests, and operates its technology to ensure the highest possible standards for security,” she said.

Pillars and approaches

Organisations are at different stages of experimenting or rolling out their AI programmes. 

Annie Pearl is Corporate Vice President and General Manager of the Azure Experience and Ecosystems team at Microsoft. She has seen all of these different stages at play and how organisations can become overwhelmed with managing it all. 

“Here at Microsoft, we believe AI is not just a set of interesting science fair projects, but a powerful tool to empower all of you and to create tangible value and so, to ensure your AI investments are truly impactful, we’ve developed a checklist based on four key pillars of AI transformation,” Pearl said.

Microsoft’s vision for how organisations can get the most out of AI has been split into a set of four key pillars with three approaches to help plan a strategy.

Pearl said organisations should set these four key pillars in their AI strategy: enrich employee experiences, reinvent customer engagement, reshape business processes, and bend the curve on innovation.

To achieve that, there are three approaches that encompass accessible-but-secure AI: Copilot empowerment, differentiated AI solutions and a cybersecurity foundation.

Each pillar is vital on its own but they coalesce into a cohesive strategy. On the first point, an AI strategy must be employee-centric so people feel involved with the strategy and that no one is left behind.

“AI can really help create a more dynamic and fulfilling work environment, making your company more competitive in the talent market,” Pearl said.

Meanwhile, the second pillar must bring an organisation’s customer along a similar journey, using AI to build personalised experiences for the customer.

To do all of this, a company must think about the third pillar, reshaping business processes with AI. Businesses can’t be stuck in their traditional way of doing things with such a new technology.

“Traditional business processes are often artefacts of human workflows, and so by reimagining these processes with an AI-first approach, you can really streamline operations and increase efficiency, so imagine having AI agents and Copilots working alongside your team, amplifying human ambition and getting more work done,” Pearl said.

“Finally, ask yourself, are you bending the curve on innovation?” she said of the fourth and final pillar. “Are you using AI to develop faster and get to market more efficiently? AI can really accelerate your innovation cycle, helping you stay ahead of the competition and drive business growth.”

But just how does a company build up those four pillars and where do they start? This is where the three approaches come into play.

The first, Copilot empowerment, is all about integrating Copilot and AI agent technology smartly with an organisation’s human capital. 

“Your employees are your greatest assets. Combining their expertise with AI capabilities can drive significant differentiation,” Pearl said.

“You can use commercially available assets, whether from Microsoft or other providers, to maximise the impact of AI and these tools are powerful and they can be really pushed to their limits long before you need to involve your highly paid developers in fine tuning large language models.”

The second approach is about understanding differentiated AI solutions. There are a variety of tools on the market. Not all are the same and each presents their own challenges in understanding the opportunities and risks.

“You need to ensure you have a scalable platform that allows you to choose the models that best fit your business needs, and it’s crucial to perform the necessary groundwork, including content safety,” Pearl said.

“Are they connected to the right data sources? Are they delivering the expected outcomes? These are the important questions to consider.”

The last approach returns to the ever-recurring theme of security. Organisations must have a strong cybersecurity foundation when deploying any kind of technology, Pearl explained, but it couldn’t be more important than with AI.

“The reality is an AI-driven business cannot thrive without a robust cyber foundation and the threat landscape has evolved, and it’s now easier than ever for bad actors to exploit vulnerabilities,” she said.

This involves investing in all the tools for that robust foundation like endpoint protection, identity management and incident response capabilities – and the strong human personnel to do it.

“No organisation, not even Microsoft, can hire enough cyber professionals to meet the demand,” she said.

Copilot or agent

It can be easy to get lost in the flurry of terms and lingo with AI. It speaks to the rapid pace of change afoot.

Copilot is one of Microsoft’s flagship AI products for businesses but the whole area of agents, which act with much greater autonomy, has gathered increasing steam in recent months. 

“I think it’s important to clarify this distinction between Copilots and agents. We believe every employee will have a Copilot working as your personal assistant. It’s grounded in work content like e-mail, meetings and documents. Think of Copilot being aligned to an individual or an employee,” Pearl explained. 

“We also believe that every business process is going to be transformed by agents, and agents will come in all levels of complexity, and they will orchestrate and work together to transform business processes,” she said.

“Some [organisations] are advanced in building the next generation of agents with autonomous capabilities, while others are still building out their AI agents to focus on retrieval.”

Declan Faller, AI at Work solutions group lead, spoke to the “absolutely extraordinary” amount of change that has happened in the field of AI agents in just the last six months.

“Every business process will have an agent, so think of it almost like Copilot is your mobile phone and agents are like the apps on that phone to really deliver business value,” Faller said.

A segment where AI agents can make a notable impact is in HR. It is a function rife with admin and red tape, and one such example is how it can really simplify the onboarding experience for new employees. 

While Copilot can help a HR manager to automate some rudimentary tasks like retrieving data and drafting documents, by building an AI agent, more complex tasks can be automated to handle recurring questions and queries, in-depth and frequently. 

HR was singled out as one area where agents can be transformative, but these applications can be mirrored across multiple functions in organisations.

A vital take-away for any business in trying to understand how to build these pillars and utilise these approaches is “don’t boil the ocean”.

That’s according to Russell Banks, Microsoft Azure infrastructure go-to-market lead for Ireland, who said companies can sometimes think too big initially about AI and their projects can become too unwieldy and unmanageable and they don’t get the desired results.

“What we’re seeing is if you’re trying to figure it all out in advance of adopting, it doesn’t work,” he said.

“Pick something very small, manageable, controllable, test it out, figure it out, is this going to add value? And go from there.”

Inclusive AI

The conversation around AI is often defined by the debate about what the technology will mean for the workforce with employees – depending on their role – anxious about the future and their part in it.

AI brings with it great promise in boosting productivity but perhaps its greatest promise is, when utilised smartly, safely and securely, that it brings more employees into the fold.

“I’m neurodivergent, so it makes a huge difference to my quality of life in work now, because it takes some of that pressure off me. I just need to remember an aspect of something I need to get and that helps to steer the direction I want to go in,” Banks said.

In a customer panel, Musgrave’s Russell was joined by David Lines, Director of IT at software maintenance company Origina; Niamh Chaney, Senior Director of AI and Service Intelligence at clinical research group ICON; and Peter Fitzsimons, Senior Manager of Innovation and Data at Irish Life. 

The panel cut across a wide swathe of different industries, bringing retail, life sciences, software and insurance into one discussion about AI.

ICON’s Chaney said that education and training for employees is vital.

“The ways in which we’re approaching AI, with the tools that we’re about to launch, heavily focuses on AI literacy and training and educating our users, while leaning into the governance aspects like safety and privacy. They need to use AI as a first pass but do the necessary checks, and this is built into the processes,” she said. 

Much like ICON, Fitzsimons of Irish Life is working with AI in a highly sensitive and highly regulated field. This time with insurance. 

Irish Life had to consider some tough questions before using any data for AI, he said.

“From day one we’re really clear, what’s the objective here? Who’s the beneficiary and what are we doing with the data? Our goal is to pay out claims faster, to make it better and more seamless for the customer and if you ground it in that, often you can work through it easily and wisely.”

Similar to cybersecurity preparedness, new regulations and compliance must factor into any deployment. Again, this will be different from sector to sector but the EU’s AI Act, the extensive regulation governing safe and ethical AI use, looms over all sectors. 

A company, whether it’s an insurer or a retail chain, must have a clear understanding of how AI is being used right now and how it will be managed going forward.   

Origina’s Lines stressed that there is no-one-size-fits-all model but the pillars and approaches laid out by Microsoft give companies the guardrails to build around.

He repeated the mantra that one should start small and build out while leaders within the organisation should act as “ambassadors” to help bring along more employees, to demystify the tech and make it more equitable.

Musgrave’s Russell echoed those sentiments and has seen the difference that the smart rollout of AI has made with his colleagues.

“I had some colleagues with dyslexia come to me and say Copilot is a game changer for them, it empowers them, they’re a lot more confident and coming to work happier,” he said. “It’s not often in IT that we get to roll out applications that make people happy.”

This is partner content and has been produced in association with Microsoft.