Your Team Is Already Using AI — With or Without Your Policy

A quiet finding from every organisation we've worked with: staff adopted AI tools months before anyone wrote a policy about it. Not maliciously. They had a deadline and a tool that helped.

That gap — between what people do and what the organisation has sanctioned — is where the risk lives.

What usually happens first

Someone pastes a client document into a free chatbot to summarise it. Nothing visibly bad occurs. They do it again. They tell a colleague. Within a month it's normal practice on the team, and nobody has asked where that document went.

The fix isn't a ban

Bans move usage from tools you can see to personal phones you can't. Every organisation that tried a hard ban in 2024 quietly reversed it.

What works is narrower and duller: name the tools people may use, name the data categories that must never be pasted anywhere, and train everyone on the difference in under an hour. The training matters more than the policy document, because the policy document is not what people consult at 4:45pm on a deadline.

A reasonable first step

Ask your team, without blame, which AI tools they already use. You'll get an honest answer if the question is genuinely blameless — and that list is the real starting point for any policy worth writing.