One of the biggest challenges companies face right now, and I'm including my own, is a balance almost nobody has figured out.
Anyone on the team can now build a product with AI. That's a superpower. And it comes with three bills: security, incentives and real productivity.
Shopify is the best example of how you pay the second one.
In April 2025 Tobi Lütke sent the memo we all read: using AI became a baseline expectation, it went into performance reviews, and nobody could ask for a new hire without first proving AI couldn't do the job.
Not long ago I was talking to an international insider at the company and they told me the second half, the part that never made it into any memo. The incentives worked too well. Lots of people doing the same thing. Teams copying ideas and mini-products from other teams. Not to solve anything, but to have it on record that they were using AI.
In September Lütke said it out loud: inside Shopify they now call them "slop grenades". AI-generated stuff someone throws without reading, that the person next to them has to review, fix and summarize.
It's Goodhart's law, same as always. Reward the input (using the tool) and the input explodes. The output (problems solved) doesn't have to move. Sometimes it gets worse.
The other two bills come with numbers too:
43% of companies that suffered a security breach in 2026 had unapproved AI somewhere in the chain. A year earlier it was 20%.
40% of workers say they've received AI-made work with no substance in the past month, and cleaning it up takes almost two hours each time.
The easy move is the wrong conclusion: hit the brakes. But the company that bans AI doesn't have less of it. It has the same AI on personal accounts where nobody can see it. That 43% comes from there.
I don't have a finished answer. I have three things I'm trying to apply:
Build the highway, don't police the cars. One shared infrastructure, data connected, security solved once, where building inside is easier than building outside.
Reward the problem solved, never the tool. If nobody can explain what changed for a customer or for the P&L, it doesn't count.
And a register of everything that gets built, with an expiry date. According to Gartner, 59% of AI prototypes never reach production. That's not a failure. Nobody knowing which ones died is.
When everyone can build, the leader's job is no longer deciding what gets built. It's deciding what counts.
What are you measuring: usage or results?