Your staff are already using Artificial Intelligence. What leadership should ask first

Most organisations discover their Artificial Intelligence position by accident. Somebody mentions in a meeting that they have been using a tool to draft correspondence, and it becomes apparent that nobody knows who else is doing the same, with what information, or whether anyone approved it.

The instinct at that point is to write a policy. That is the right destination and the wrong first step. A policy written before you know what is actually happening governs an imagined organisation rather than yours, and it will be quietly ignored by the people it was written for.

Three questions establish the position. They can be answered in a fortnight, and none of them requires technical knowledge.

1. What are people actually using, including what nobody approved

Ask directly, and make it safe to answer honestly. The useful version of this question is not "are you using Artificial Intelligence", which invites a cautious no. It is closer to "what have you found that makes your work faster".

Expect the answer to include tools you have never heard of, free accounts opened with work email addresses, and features quietly added to software you already licence. That last category is the one most organisations miss. A tool you approved two years ago may have acquired an assistant since, enabled by default.

You are not looking for a complete inventory. You are looking for the shape of it: which teams, which tasks, and whether the pattern is one or two individuals or most of a department.

2. What information is going into them

This is where exposure actually sits. The question is not whether a tool is good, but what leaves your organisation when somebody uses it.

Work through the specific cases people described in the first question. A draft reply to a customer complaint contains that customer's name and their grievance. A summarised committee paper contains whatever was in the paper. A spreadsheet pasted in for analysis contains every row, including the ones the person was not thinking about at the time.

Then ask the follow-up that matters: where does that information go, and is it retained. Free consumer tiers of many tools retain input and may use it to improve the service. Paid business tiers of the same tools frequently do not. People rarely know which tier they are on, because it was never a decision anyone made deliberately.

3. Where is output being relied on without a person checking it

Governance attention tends to focus on what goes in. The larger risk is usually what comes out and is then acted on.

Find the cases where output reaches something consequential: a customer, a payment, a regulatory return, a decision about a person. Then establish whether a competent human reads it first, and whether that person has the standing to say no.

If the answer is that the output is trusted because it is usually right, you have found the thing to fix first. Usually right is a description of a system that will be wrong at some point, at a moment nobody has planned for.

What to do with the answers

Write down what you found. One page is enough. Which tools, which teams, what information, and where output is relied on.

That page is worth more than a policy, and it makes the policy that follows both shorter and enforceable, because it addresses the practice your organisation actually has. It also tends to resolve the question of urgency on its own. Some organisations find three people using one tool for low-consequence drafting. Others find client data in a free consumer account. Those are different problems and they do not deserve the same response.

The common mistake is to treat this as a technology exercise and delegate it to whoever runs your systems. It is a question about how work gets done, so the people to ask are the people doing the work.

What this is not

This is not an argument for restricting adoption. Staff finding tools that make their work faster is a good instinct, and organisations that respond by prohibition generally get the same usage with less visibility.

The purpose of establishing the position is to be able to say yes deliberately, on terms you have chosen, to the uses that are worth it.