Your staff are already using AI. Now what?

Somebody in your business pasted work into a chatbot this week. Banning it won't stop it — but three practical moves turn a quiet risk into your automation roadmap.

Here is a prediction we are comfortable making about a business we have never seen: someone on your team used an AI chatbot for work this week. Probably several people. Probably on personal accounts, probably pasting in real work — a client email to soften, a contract clause to decode, a spreadsheet formula that wouldn't behave. They didn't ask permission, because there was nobody obvious to ask and the tool solved their problem in forty seconds.

This isn't misconduct. It's what sensible people do when a genuinely useful tool exists and the official process is silence. But it does create a real problem, and "we don't allow that here" is not a plan.

Why the ban fails

Block the websites and people use their phones. Announce a policy of no-AI and people stop mentioning it — the usage continues, minus the visibility. Every company that has tried prohibition has bought itself the same outcome: identical risk, zero insight. The choice was never "AI or no AI". It's visible or invisible.

What the actual risk is

Not that the technology is dangerous — that your business's use of it is unmanaged. Concretely, three things. Work data flowing through personal accounts on consumer tools, where the protections a business-grade account would give you — contractual commitments that your content isn't used for training, admin visibility, the ability to switch access off when someone leaves — don't apply. No record: if a client asks how their information was handled, "we're not sure, possibly through someone's free chatbot account" is not an answer you want to give, and in regulated industries it may be an answer you're obliged to give. And uneven quality: ten people using ten tools ten different ways produces work of ten different standards, with nobody checking any of it.

The three moves

First, find out — as an amnesty, not an audit. Ask the team what they're using and for what, having said out loud that the answer costs nobody anything and that you assume the answer isn't "nothing". You'll learn more in one honest conversation than any monitoring tool will show you. Expect surprises; the person using it most is rarely the person you'd guess.

Second, give them a sanctioned version that's better than sneaking. A business account on one of the major AI tools costs about the same per person as their coffee habit and comes with the protections the free versions don't. People weren't attached to the workaround — they were attached to the forty seconds it saved. Make the official route the easy route and the shadow usage mostly evaporates on its own.

Third, write the policy in two paragraphs, not twenty pages. What's always fine (drafting, summarising, anything without client data on the approved tool). What's never fine (client-identifying information on personal accounts, anywhere). Who to ask when it's unclear. A policy people can hold in their head gets followed; a document nobody reads is a ban wearing a longer costume.

The part nobody tells you

That amnesty conversation produces something more valuable than reassurance: a map. Every unofficial use of AI in your business is an employee telling you, precisely and for free, where the repetitive work lives — the retyping, the summarising, the same question answered forty times. That's your automation shortlist, researched by the people who know the work best. The businesses getting real value from AI mostly didn't start with a strategy document. They started by noticing what their own people had already found worth automating — and then built the proper, logged, supervised version of it.