The friction-shadow paradox: how legitimacy-seeking governance drives structural decoupling of genai in personally identifiable information contexts

The adoption of Generative Artificial Intelligence (GenAI) in contexts involving Personally Identifiable Information (PII) creates a counterintuitive governance challenge: arrangements designed to strengthen formal control may weaken governance in use. This article explains that contradiction by theorizing the Friction-Shadow Paradox, a cross-level mechanism through which legitimacy-seeking governance becomes self-undermining under conditions of high bureaucratic friction and absent sanctioned alternatives. Drawing on a qualitative, multisectoral study based on 20 interviews with C-level executives, Data Protection Officers, and senior leaders in data, AI, and privacy functions, the analysis integrates Data Governance, Contingency Theory, and Institutional Theory to explain how organizations govern GenAI in highly regulated environments. The findings show that rigid controls adopted to secure legitimacy may degrade operational fit and activate structural decoupling through Shadow AI. At the same time, the results indicate that this outcome is not universal: organizations achieve comparable levels of PII protection through contextually distinct governance pathways, including professional anchoring, structural segregation, and preemptive provisioning. The article contributes to the Information Systems governance literature by theorizing the FrictionShadow Paradox, specifying contextual equifinality in GenAI governance, and showing how the practical object of Data Governance shifts from stable data-at-rest toward interaction-level exposure pathways.