Vernon Yai stands as a leading architect in the modern landscape of data protection and corporate governance, particularly as organizations move toward decentralized technology models. With a career dedicated to balancing the rigid requirements of risk management with the fluid needs of business innovation, Yai has become a pivotal voice for IT leaders navigating the “Citizen AI” movement. He specializes in creating frameworks that allow non-technical employees to harness the power of artificial intelligence without compromising the structural integrity or security of the enterprise. By viewing every employee as a potential builder rather than just a consumer, Yai advocates for a cultural shift that places technological agency directly into the hands of those facing daily operational challenges.
Our discussion centers on the practical realities of scaling AI across a global workforce, moving beyond the theoretical to examine how grassroots development fundamentally alters the traditional IT lifecycle. We explore the specific risks that disappear when business users build their own solutions and the new governance challenges that emerge in their place. Yai breaks down the “freedom first” approach to experimentation, the transition from complex coding to natural language prompting, and the precise moment a personal prototype must undergo professional hardening. Throughout the conversation, we look at real-world examples of how specialized agents are automating complex business cases—from marketing analytics to factory safety—and why the biggest threat to modern enterprises may not be “shadow AI,” but rather a lack of employee engagement with these transformative tools.
When business users bypass traditional IT queues to build their own tools, what specific “lost in translation” risks are mitigated, and how does this grassroots approach fundamentally change the way employees embrace technological change during a digital transformation?
The most significant “lost in translation” risk we mitigate is the disconnect between a nuanced business problem and a developer’s interpretation of that problem. Historically, when a business unit identifies a need, they have to funnel that creativity through a business analyst or a developer who may not have the domain expertise to understand the subtle complexities of the workflow. This creates a friction-filled queuing process where requests are prioritized based on budget or IT bandwidth, meaning many high-value, niche ideas never see the light of day. By turning employees into builders, we ensure that the person who feels the “pain” of a manual process is the one designing the digital “aspirin.” We saw this clearly at Hexion, where the head of environmental health and safety took it upon herself to build an application called Wingman to manage factory safety processes. Because she understood the sensory details of the factory floor—the noise, the safety protocols, and the specific reporting requirements—she could build a tool that was far more effective than anything a central IT department could have designed from a distance. This grassroots involvement is the ultimate engine for change management because when people see their own ideas come to life, they are far more receptive to adopting technology; it’s no longer something forced upon them from the top down, but a tool they helped forge.
Some organizations provide employees with a “freedom first” mandate for AI experimentation before implementing formal governance. What are the specific trade-offs of this sequence, and what criteria should determine when a personal prototype must transition into a hardened, production-ready system?
Adopting a “freedom first” mandate, much like the approach taken at eSky Group, allows an organization to prioritize innovation and speed over bureaucratic stalling. By late 2025, they had made AI a core objective, and by early 2026, they opened up AI provider tools to their entire global workforce of 650 people, rather than just the engineering teams. The trade-off is that you temporarily accept a higher degree of variance and “noise” in the system to find the signal—the truly transformative ideas. Currently, eSky sees about 80% regular usage among staff, with 60% of employees outside the contact center becoming AI fluent. However, the transition point to a hardened system must be clearly defined by the impact on transactional integrity. For instance, at Hexion, we distinguish between “vibe-coded” apps and those that touch critical systems like SAP. If an application remains a local reporting tool or a personal productivity assistant, it can stay in a lighter governance tier. But the moment an agent or app needs to write back to a master data lake or impact a transactional system that could potentially bring down a business-critical function, that is when IT must step in with enterprise-grade guardrails and “single-pane” governance tools like Microsoft Agent 365 to ensure observability and security.
Generative AI has shifted the barrier to entry from technical coding to natural language prompting. How do you assess whether an employee possesses the necessary judgment and domain expertise to build a functional agent, and what specific training ensures they understand the context behind the data they are manipulating?
The shift from coding nuances to natural language prompting is perhaps the most significant “unlock” for productivity we have seen in decades. In the past, tools like Power Apps still required a level of technical depth that scared away many business users, but now, a user can simply describe a problem in plain English and the backend generates the logic. To assess if an employee has the right judgment, we look for those who can clearly articulate a business problem and understand the specific data context required to solve it, rather than those who just want to play with the latest tech. At Harvey Nash, for example, a content manager built an agent to help recruitment consultants find and personalize social posts, which showed a deep understanding of the brand’s voice and the specific needs of the consultants. Training must move away from “how to click buttons” and toward “how to think like a data steward,” emphasizing that the quality of an agent is entirely dependent on the quality of the prompt and the reliability of the underlying data source. We have to teach our “citizen developers” that while they don’t need to write code, they do need to be able to judge whether the AI’s output is useful or a hallucination, which requires a high level of domain expertise. We even use gamification, tracking the number of posts or automations created, to encourage this kind of thoughtful engagement and to identify which employees are truly mastering the art of the prompt.
What is your forecast for the evolution of Citizen AI within the enterprise over the next few years?
I anticipate that the distinction between “business user” and “developer” will almost entirely disappear by 2028, as AI agents become the primary interface for most office work. We will likely see organizations running hundreds, if not thousands, of specialized agents, similar to how eSky already has 16 scheduled automations just for refunds and reconciliations. The real challenge for CIOs won’t be managing a “Wild West” of unauthorized apps, but rather overcoming the inertia of teams that are doing too little with the tools available. Success will be measured by the “fluency rate” of the workforce, where perhaps 90% of employees are not just using AI, but actively refining the agents that perform their repetitive tasks. However, this future relies on a “single-pane” governance layer that allows IT to start or stop any agent across the enterprise with a single click, maintaining security in the same breath as innovation. If we can successfully close the gap between freedom and safety, we will see an explosion of niche, high-value applications that were previously too expensive or too specific for traditional IT to ever build. This shift will fundamentally redefine the role of the IT department from a “builder of software” to a “curator of a vast, intelligent ecosystem” where the most innovative solutions come from the employees who are closest to the customer.
