Why bans underperform
A prohibition changes visibility, not behaviour. The work that drove someone to an unsanctioned tool still exists tomorrow, and now you have no record of where the data went.
The productive posture is to inventory without a verdict, classify by data sensitivity and business necessity, and then close the gap with a sanctioned route that is genuinely faster.
Running the inventory
State in writing, from the CEO, that disclosure is safe. Then ask function by function what is in use, on what data, for what task. Do not shut anything down during the inventory window.
Expect the results to be uncomfortable, and expect them to be the most useful use-case list your organisation has produced, because it reflects real demand.
The exception path
Every workable policy has a route for the case it did not anticipate. Without one, the first genuine exception teaches everyone that the policy is optional.
Next step
Start with the shadow-AI inventory inside an AI policy engagement, or run it yourself in week one of the ninety-day plan.