Everyone’s using AI. No one agreed on how.

• →Employees paste customer or company data into personal AI accounts.
• →Different teams use different tools, with no shared standard.
• →Nobody could give a straight answer for which AI tools are actually in use.
• →Leadership has been told to "figure out AI" with no plan for what that means.

AI tools are free, fast, and available to anyone with a browser. Employees adopt them individually to solve their own immediate problems, long before leadership has decided on a policy, a vendor, or a use case worth building on.

The risk is invisible until it isn’t: sensitive data pasted into a tool with no data agreement, unchecked output making its way into real work, and a dozen ad hoc habits that would each break differently if the company tried to standardize later.

• →A memo asking people to "be careful" with AI.
• →Blocking specific tools, which mostly pushes usage to personal devices.
• →Waiting for a bigger AI strategy before addressing anything.

Find out what employees are actually already doing with AI before writing a policy. A policy built without that picture usually either blocks the useful parts or misses the risky ones.

• →Approved AI use cases with defined data-handling rules.
• →Standardized tools for the tasks that already have a clear, low-risk use case.

• →Judgment calls on what should never touch an AI tool.
• →Review of AI-assisted output on anything customer-facing or high-risk.

We inventory what AI tools are already in use and why, then build a plan that keeps the useful parts, closes the actual risks, and sets a standard the company can defend, not a memo nobody follows.