The moment happens in the fourth skills-gap interview, right after you promise it is not a test. The senior accounts payable (AP) clerk, the one whose exception queue somehow shrank fifteen percent this quarter, glances at the door, lowers her voice, and says: "Off the record? I paste the vendor emails into a chatbot on my phone. On my own account. Please don't put that in the report." There it is. The most valuable piece of readiness data in the building, and it arrives whispered, deniable, and attached to a plea for secrecy. Level 1 taught you that this whisper is a signal: employees quietly routing real work through personal AI accounts, often getting more done than the official initiative ever did. This lesson teaches you to build the instrument that converts that whisper into assessment data at scale: a survey that people like her will answer honestly. And honesty is the entire design problem, because you are asking employees to disclose behavior they suspect could get them fired.

The Design Problem Is Trust, Not Questions

Start with why this survey is worth the trouble. MIT's GenAI Divide research documented a strange inversion inside large organizations: while official, sanctioned AI pilots stalled at the 95 percent no-measurable-return rate you know from Level 1, a shadow economy of personal chatbot accounts was quietly outperforming them. Employees were not waiting for the steering committee. They had found tasks where AI genuinely helped, tested it on their own time and their own accounts, kept what worked, and told nobody. The official initiative had a budget, a vendor, and a logo. The shadow economy had results.

For you, the assessor, that shadow economy is not a compliance embarrassment. It is the single richest dataset in the organization, and it answers four questions your readiness assessment desperately needs answered. Which tasks do people already route to AI? Who are the natural experimenters? What tools are actually in use? And where is data quietly leaking into unmanaged systems? One instrument, run correctly, retrieves all four. Run incorrectly, it retrieves nothing and salts the ground for years.

Here is the trap in plain terms. A conventional survey assumes respondents have no reason to lie. This survey violates that assumption by design, because the honest answer to "have you used unapproved AI tools for work?" is, in the respondent's mind, a confession. Maybe the acceptable-use policy forbids it. Maybe no policy exists but the vibe is prohibition. Maybe they watched IT block a website once and drew conclusions. It does not matter whether punishment is actually likely; it matters whether the respondent can imagine it. Ask people to incriminate themselves on a form with their name attached and you will get what one illustrative pattern in this lesson's failure story gets: a 4 percent admission rate from a workforce where usage is closer to 70, plus a durable reputation as the person who ran the AI witch-hunt.

So the artifact this lesson builds is not really a questionnaire. It is a trust machine with a questionnaire inside it. We will call it the Shadow-AI Survey Kit, and it has four components: the amnesty framing, the question set, the anonymity architecture, and the synthesis playbook that turns raw responses into four named outputs. Every component exists to solve the same problem from a different angle: making honesty feel safe enough to be rational. This is the 70 in BCG's 10-20-70 rule (10 percent of AI success is algorithms, 20 percent technology and data, 70 percent people and process) showing up in miniature: the hard part of this instrument has nothing to do with technology.

People will map their own shadow economy for you, accurately and enthusiastically, on exactly one condition: that the map cannot be used against the mapmakers.

The Amnesty Framing: Written, Sponsored, and True

The first component comes before any question is drafted, and most failed shadow-AI surveys fail right here. The amnesty framing is a short written statement, issued with the survey, that says four things in language a nervous employee can rely on:

• We already know. "We know unofficial AI use is happening across the organization. This is normal; it is happening everywhere, in every industry." This sentence alone reprices the confession. Nobody is revealing a secret if leadership has already said the secret out loud.
• We want to learn, not punish. "The purpose of this survey is to learn what is working so we can support it properly, not to identify or discipline anyone."
• Responses are anonymous. Stated plainly, with a one-line description of how (no sign-in, no identifying metadata, aggregated reporting only).
• Nothing here feeds any disciplinary process. Explicit, in writing, from someone with the authority to make it stick.

Two design rules govern this statement, and both are non-negotiable. First, it must be sponsored above your pay grade. An amnesty signed by a process analyst is a wish; an amnesty signed by the chief operating officer or the division head is a policy. Respondents are being asked to bet their standing on a promise, and they will price the promise by the rank of the person making it. Get the sponsorship in writing before you send anything, and put the sponsor's name on the survey itself, not yours.

Second, and this is the rule that defines you professionally: the amnesty must be true. If any part of the organization intends to use survey responses to identify policy violators, tighten monitoring on specific teams, or build cases against individuals, then the survey is not an assessment instrument. It is a trap with a friendly font. If you discover that intent, you refuse to run the survey, in writing, and you explain why: an instrument built on a false amnesty produces one round of contaminated data and then destroys the possibility of ever measuring this again, because word travels at the speed of the first disciplinary meeting. Your credibility is the only currency an assessor holds. Spend it on nothing. A readiness assessor who burned the workforce once does not get a second dataset, and neither does their successor for about three years.

There is a subtler version of the trap worth naming: the org that genuinely intends no punishment but cannot resist "just flagging" one egregious case that surfaces. One case is all it takes. The amnesty is binary. Either every response is beyond disciplinary reach or none of them are believed to be, and belief is the thing you are engineering.

The Question Set and the Anonymity Architecture

With the amnesty in place, the questions themselves can be short, and they should be. Ten minutes, maximum. Every question is task-based and judgment-free: you ask what people did with AI, never whether they should have. The core set, adaptable to any organization:

1. Which of your work tasks have you tried AI on, even once? Offer a checklist of task categories drawn from your process inventory (drafting emails, summarizing documents, categorizing items, writing first drafts of reports, analyzing spreadsheets, and so on) plus a free-text "other." The checklist matters: recognition is easier and safer than recall, and category answers aggregate cleanly.
2. What worked well enough that you kept doing it? This is your gold question. A task someone tried once is curiosity; a task someone repeats weekly on a personal account, with zero support and mild personal risk, is validated demand. People do not keep sneaking tools that fail them.
3. What did you try and stop doing, and why? The abandonment reasons (too many errors, took longer than doing it myself, could not use the data I needed) are a free map of failure modes you would otherwise discover mid-pilot at ten times the cost.
4. What data did you need but could not safely use? Answered in categories only: customer records, pricing, employee data, contracts, financials. Never specifics. More on why in a moment.
5. If the company officially supported one AI capability tomorrow, what should it be? Free text. This is where the demand map gets its color.

Then come the two questions that produce the survey's most valuable byproducts, and they require the kit's structural trick: the anonymity architecture.

The champion question, on a separate channel

Question six asks: "Would you be willing to show your workflow to a colleague or join a pilot as a tester?" This is an invitation, not a question, and answering it requires identity, which the anonymous instrument must never collect. So the architecture separates them physically: the anonymous survey ends with a link to a second, clearly voluntary form where people can opt in by name. Two instruments, two databases, no join key. A respondent can be fully candid in form one and still raise their hand in form two, or do either alone. The people who opt in are self-selecting for exactly the traits you will need for the rest of this program: they use AI effectively, they are willing to be visible, and they like teaching. That list is your future pilot-tester bench, your trainers, and the seed of the champion network Level 4 will formalize. You could not buy this list; you can only be handed it, and only by people who trust the envelope it arrives in.

The exposure question, categories only, by design

The data-exposure question (number four above) has a hard boundary: never ask anyone to confess a specific incident in a survey. Not "did you ever paste customer PII (personally identifiable information) into a chatbot on March 12th," not "describe the most sensitive thing you shared." Two reasons, one practical and one legal. Practically, specific-incident questions read as evidence gathering and will collapse your response rate for every other question on the form. Legally, survey anonymity is a promise you may not be able to keep against legal process: if an incident becomes a regulatory matter or litigation, survey records can be demanded, and "we promised anonymity" is not a privilege that survives a subpoena. So you keep the instrument clean of specifics by design. Category-level answers ("some respondents in finance report needing customer financial data they could not safely use") give the privacy owner everything needed to prioritize controls, while giving a future discovery request nothing that identifies a person or an incident. Specific incidents belong in the privacy lane you built in the previous chapter, handled by counsel, under actual legal privilege, one conversation at a time. The survey's job is a weather map, not a police report.

Launch Craft: The Leader Confesses First

A perfect instrument distributed badly still fails, and there is one distribution move that outperforms everything else you can do: a senior leader publicly admits their own shadow use before the survey lands. The mechanics are almost embarrassingly simple. At the all-hands, or in the launch email itself, the chief financial officer says: "I'll go first. I paste board-memo drafts into a chatbot to tighten them up. I have done it for a year. It works, and we have never talked about it, which is exactly why we are running this survey." In organizations where this move is made, it is common to see response rates on sensitive surveys land at multiples of what the bare instrument achieves; in the worked example below we will use an illustrative tripling, and practitioners who have run both versions will tell you that is not an exaggerated shape.

Why does it work so well? Because a confession's price is set socially, like everything else in an organization. When the most senior finance person in the company casually discloses the exact behavior the survey asks about, every employee instantly reprices their own disclosure from "career risk" to "thing the CFO does." The amnesty statement makes honesty permitted. The leader confession makes it normal. You need both, and they are not interchangeable: a written amnesty without a human example reads as legal boilerplate, and a charming confession without the written amnesty is just an anecdote that protects no one.

The remaining launch craft is standard but worth listing because each item quietly signals safety: the survey comes from the sponsor's office, not from compliance, legal, HR, or IT security (the return address is part of the message); it is open for two weeks with one reminder; it is genuinely short; it commits, in the launch note, to sharing aggregate results with everyone who was asked to respond, within a month. That last promise matters more than it looks: a workforce that confessed and then heard nothing learns that surveys are where honesty goes to die. A workforce that sees its own answers reflected back ("here is what we learned, here is what we are supporting first") will answer the next instrument faster and more candidly. You are not just collecting data; you are training the organization that telling the truth to an assessor produces visible good.

Synthesis: Four Outputs from One Instrument

Responses in hand, you now run the synthesis playbook, and this is where the AI-assisted methods of this chapter pay their rent. The free-text answers (what worked, what you stopped, what should we support) go through the same theme-extraction workflow you learned in the first lesson of this chapter for interview notes: batch the anonymized text, prompt for themes with supporting quote counts, verify against the raw responses, and never let a theme into the report that you cannot trace to actual respondent language. Ten minutes of AI clustering plus an hour of your verification replaces a week of sticky notes. The structured answers aggregate in a spreadsheet. Out the other end come four named outputs, each with a specific destination:

Dwell on the demand map for a moment, because it quietly solves a problem that wrecks a lot of readiness work: use-case-brainstorm theater. You have seen the workshop: a facilitator, a wall of sticky notes, forty speculative use cases ranked by people guessing what might work, most of which die on contact with reality. The demand map is the antidote, because every entry on it has already survived the harshest pilot conditions imaginable: no training, no integration, no support, personal risk, and the tool still earned repeat usage. A task that clears that bar is pre-validated demand. When the demand map's top item matches a pilot candidate from your process assessment, you are no longer proposing an experiment; you are proposing to officially support something the workforce has already proven, which is the strongest sentence a business case can contain.

The risk flags deserve one more sentence of discipline: they route to the privacy owner as categories needing controls, not cases needing culprits. The output is "customer financial data appears in the exposure answers of the finance cluster; prioritize a sanctioned tool with a data agreement for that team," never "find out who in finance did this." The moment synthesis drifts toward attribution, you have broken the amnesty retroactively, and word of that travels too.

Verify before it enters the scorecard

One last synthesis step, and it is this program's reflex by now: survey data is self-report, and self-report drifts, even when honest. People misremember frequency, flatter their own efficiency, and describe aspirations as habits. So before the demand map's top claims enter the people readiness scorecard next lesson, triangulate the top three against observable traces. If "summarizing long ticket threads" ranks first, do the interview themes from earlier in this chapter mention it? Do ticket-system patterns show the pause-and-resume signature of someone working the thread elsewhere? Does the team lead recognize the behavior? You are not auditing individuals; you are checking that the aggregate story matches at least one independent source per claim. A demand-map entry corroborated by two sources goes into the scorecard as evidence. An entry corroborated by nothing gets a flag and a follow-up conversation, not a promotion into the business case.

Two Companies, One Survey: A Worked Example and a Cautionary Tale

All numbers in both stories are hypothetical illustrations, built to show the shape of success and failure. First, the version done right, continuing the invoice-exception storyline you have carried since Level 1, now widened from one AP team to the whole 180-person operations division.

The assessor drafts the amnesty statement and walks it up to the COO, who not only signs it but volunteers the confession: at the division all-hands, she tells the room she has been pasting her Monday operations summary into a chatbot for months to make it readable. The survey goes out the next morning under her name, anonymous, ten minutes, with the separate opt-in form linked at the end. Two weeks later: 112 of 180 respond, a 62 percent response rate, roughly triple what the assessor had privately forecast for a bare-instrument launch. The answers redraw the org's picture of itself: 71 percent of respondents report having tried AI on real work tasks, and 44 percent use it weekly. The official adoption program, for reference, believed adoption stood near 15 percent.

The demand map's top three, by repeated-use frequency: drafting vendor emails, summarizing long ticket threads, and first-pass categorization of invoice exceptions. Read that third one again. The division's pilot candidate, chosen months earlier through process assessment, is invoice-exception handling, and here is the workforce independently reporting that they already sneak AI onto exactly that task because it works. The business case now contains pre-validated demand, and the steering committee hears a very different sentence: not "we believe this could work" but "44 people are already doing a version of this on personal phones; we propose to support it properly."

The opt-in form yields 19 champions, including two AP clerks, one of them the whisperer from the skills-gap interviews, now on the record and visibly relieved to be. Both join the pilot as testers, which also converts two of the heat map's anxious middle into invested participants. The tool census finds 9 distinct AI tools in active use, of which 3 are sanctioned; the list goes straight into the sanctioned-tool conversation the privacy lesson set up. And the exposure question surfaces two category-level risk flags (customer account data in the service cluster, vendor pricing in procurement), which route to the privacy owner as two control priorities. No names, no cases, no hunt. One instrument, four outputs, about three weeks end to end, at a cost of roughly one assessor-week plus an afternoon of the COO's sponsorship.

The same survey, run as surveillance

Now the cautionary tale. A company of similar size runs what looks like the same survey, with three fatal edits. It goes out from the compliance office. It requires employees to sign in, "for data quality." And the amnesty paragraph is replaced by a link to the acceptable-use policy. The workforce reads the instrument correctly in about four seconds: this is an audit wearing a survey costume. Response rate: 8 percent. Admissions of unofficial AI use: effectively zero. The handful of responses are pristine fictions: nobody uses anything, everyone follows policy, no support is needed.

Three weeks later, IT quietly blocks the top consumer chatbot domains on the corporate network. And here is the ending every surveillance instinct refuses to predict: usage does not stop; it moves. To personal phones on cellular data, to home laptops, to the tools one hop down the quality list that nobody thought to block. The shadow economy is now invisible AND ungoverned: no census, no risk flags, no champion roster, no demand map, and materially worse data hygiene than before, because the blocked mainstream tools at least had known data policies, and their replacements do not. The org spent real money to know less and risk more. This is the Level 1 warning about punishing shadow AI, now with a body count: the surveillance instinct produced less safety, not more, and the company lost the one map of real demand it will ever be offered at this price. When someone in your steering committee proposes "let's just make them sign in, for data quality," this story is the two minutes you spend before saying no.

What to Do Monday Morning

The Shadow-AI Survey Kit becomes yours the week you draft it for your own organization. The sequence:

1. Draft the amnesty statement, four sentences: we know it is happening, we want to learn not punish, responses are anonymous, nothing feeds discipline. Then book fifteen minutes with the most senior sponsor you can reach and do not send anything until the statement carries their name in writing. If you detect intent to punish, stop the project and say why in writing.
2. Adapt the question set: build the task checklist from your own process inventory language, keep every question judgment-free and category-based, and cap the whole thing at ten minutes.
3. Separate the identity channel. Build two forms: the anonymous instrument and the voluntary opt-in for champions, linked but never joined. Verify yourself that the anonymous form collects no sign-in and no identifying metadata before you promise anyone it does not.
4. Line up the leader confession for launch week. Ask your sponsor directly: "Would you be willing to tell people one way you already use AI yourself?" Most leaders have an answer and have simply never been asked to say it in public.
5. Pre-book the synthesis afternoon and the results-back date. Put the theme-extraction session in your calendar for the day the survey closes, and commit in the launch note to sharing aggregate findings with all respondents within a month. Then, before anything enters the scorecard, triangulate the top three demand claims against your interview themes and system traces.

Key Takeaways

• Treat shadow AI as the richest readiness dataset in the organization: MIT's GenAI Divide work found the unofficial, personal-account economy outperforming official initiatives, which makes it demand evidence, not a compliance embarrassment.
• Design the survey as a trust machine, because you are asking people to disclose behavior they believe is punishable; the instrument's questions matter less than whether honesty feels safe, which is BCG's 70 percent (people and process) in miniature.
• Secure the amnesty framing first: written, sponsored above your pay grade, and true; if the organization intends to punish, refuse to run the survey, because a false amnesty is a trap and your credibility is the only currency you hold.
• Keep every question task-based and judgment-free, and enforce the anonymity architecture: champion opt-in on a separate voluntary identity channel, and data exposure asked in categories only, never as specific incidents, since survey anonymity cannot be promised against legal process.
• Launch behind a leader's public confession of their own shadow use; the written amnesty makes honesty permitted, the CFO's "I paste board memos into a chatbot" makes it normal, and together they can multiply response rates.
• Synthesize with the chapter's theme-extraction workflow into four outputs with four destinations: the demand map, the champion roster, the tool census, and the risk flags, routed as categories needing controls rather than cases needing culprits.
• Verify before you promote: survey data is self-report, so triangulate the top three demand-map claims against interview themes and observable system traces before they enter next lesson's people readiness scorecard.
• Remember the failure story's arithmetic: a sign-in survey from compliance got 8 percent response and zero admissions, and the domain blocks that followed pushed usage to personal phones, invisible and ungoverned; surveillance bought less safety and lost the map.