EP 28 — National Bank's Andre Boucher on Managing AI without Shadow IT Friction

Jan 27, 2026

André Boucher, SVP Technology and Information Security at National Bank of Canada and former leader of Canadian Forces cyber operations, discusses governing AI through enablement not punishment. He talks about managing shadow AI with secure platforms and sandboxes. He highlights the unresolved challenge of data inventory and the risks of vendors embedding opaque AI features. He also covers scaling AI safely across large organizations.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

INSIGHT

Governance Trumps Pure Technical Depth

André Boucher found his governance and strategy skills more valuable than pure technical depth when moving from public sector to banking.
He credits consensus and alliance experience for navigating complex private-sector governance and regulation.

INSIGHT

Data Inventory Is The Unsolved Foundation

André says data inventory and classification remain immature across large organizations despite tools existing.
Lack of a common taxonomy and ecosystem maturity is the core unresolved problem for data governance.

INSIGHT

Human Limits Against Synthetic Actors

Synthetic actors and indistinguishable AI-generated media challenge awareness training as a defense.
Detection-only approaches may fail; regulatory, collaborative, and tech solutions should be considered.

Get the Snipd Podcast app to discover more snips from this episode

Get the app

André Boucher, SVP Technology and Information Security (CTO/CISO) at National Bank of Canada, managed the transition from commanding Canadian Forces Cyber Command to leading security at a systemically important financial institution by recognizing that governance expertise matters more than technical depth at scale. His approach to shadow AI involves enabling experimentation early with secure platforms that business teams actually prefer, reducing the appeal of unauthorized tools. Rather than aggressive detection that drives behavior underground, they created environments where innovation happens within guardrails. This shifts security from adversarial to collaborative, treating 31,000 employees as team participants rather than risks to manage.

Andre emphasizes that data inventory across structured and unstructured environments remains the hardest unsolved problem, not because organizations lack tools but because they haven't achieved ecosystem maturity around taxonomy and classification. He explains why third-party risk management is reaching crisis levels as major vendors embed AI features without notice or transparency, creating blind spots in supply chains that regulatory frameworks can't yet address.

Topics discussed:

The translation of military governance and strategy frameworks into private sector security at systemically important financial institutions.
Shadow AI management through platform enablement and secure experimentation rather than detection and prevention tactics.
Data inventory and classification as the foundational challenge most organizations underestimate despite its criticality for AI governance.
The board strategy mandate versus grassroots adoption pressure dynamic and how platform teams bridge the gap without creating friction.
Third-party risk amplification as vendors embed AI features without transparency, notice, or updated contractual language.
How awareness training reaches its limits when synthetic actors become indistinguishable from humans in video communications.
AI use cases in security tooling focused on modeling normal behavior and reducing triage burden rather than autonomous response.
Building high-performing security teams around ethics, mission, and non-linear career experience rather than purely technical credentials.
Treating employees as security team participants at scale and how that shifts organizational dynamics from adversarial to collaborative.