What should you do when employees are already using AI but no policy exists?

What is happening

Employees adopted capable tools faster than the organization produced a position on them. Usage is real, largely well-intentioned, and invisible. The risk is not that people are using AI; it is that no one can say what data has gone where.

Why it happens

• The tools are free or low-cost and need no IT involvement.
• AI features appeared inside software already approved.
• Managers rewarded the productivity without asking how it was achieved.
• Policy work was scheduled behind other priorities.

What to do first

• Ask, without blame. A short, anonymous survey plus a review of expense claims, browser or network telemetry where permitted, and vendor release notes for existing products will tell you most of what you need.
• Issue interim guidance within days, not months: what must never be entered into an external tool (credentials, personal data, protected health or financial information, client-confidential material, unreleased financials, evidence), and the rule that a person remains accountable for anything they act on.
• Provide a sanctioned option with acceptable contractual terms so the guidance offers a route to yes.
• Start the inventory immediately, even if it is a spreadsheet.
• Communicate what happens next and when, so people are not left guessing.

What not to do

• Do not open with enforcement action against employees who used tools in the absence of guidance.
• Do not issue a prohibition with no approved alternative.
• Do not wait for a complete framework before publishing basic data rules.
• Do not assume the risk is limited to a single well-known chatbot.

Questions to ask

• What are people using AI for, and what problem does it solve for them?
• What data has plausibly been entered into external tools, and what are our notification obligations if any of it was regulated?
• Which of our existing vendors have enabled AI features by default?
• What is the fastest legitimate option we can offer this month?

Warning signs

• AI-generated content is appearing in client deliverables with no review step.
• Teams describe tools by name that IT has never evaluated.
• Personal accounts are being used for work tasks.

When internal teams can handle it

When security, legal, and HR can convene quickly and agree interim guidance, this is very achievable internally within a few weeks.

When outside help may be appropriate

When regulated data may already have been exposed, when the organization has client contractual commitments about AI use, or when a governance position is needed quickly across a large, decentralized environment.