Your staff are already using AI. Now what?

Banning it doesn't work. I've yet to see an organisation where a policy stopped people pasting a contract into a chatbot to summarise it. What the ban does is move the behaviour out of sight, which is the worst of both worlds: the risk stays, the visibility goes.

Start by finding out

Before writing policy, I'd want data. Which tools are reaching the network? Which browser extensions are installed? What's in the expense reports? The answer is usually more varied and more sensible than people fear: a lot of summarising, drafting, and code help, and a smaller amount of genuinely risky uploading.

Then decide what you're actually protecting

Not all data is equal, and a rule that treats it all the same will be ignored. The useful question is which categories must never leave: client data under contract, regulated personal data, source code, anything privileged. Name them. Then provide an approved path for everything else, and make it good enough that people prefer it.

The controls that hold

• An approved tool with the right contract, so the default choice is a safe one.
• Data loss controls at the browser and the gateway, tuned to the named categories, not to everything.
• A short, plain rule people can remember: these things never go in; everything else, use the approved tool.
• A way to ask. The person who isn't sure should have somewhere to go that answers in hours, not weeks.

What I'd avoid

Lengthy acceptable-use policies nobody reads. Monitoring that reads as surveillance. And pretending the problem is the staff. The staff found a tool that makes them faster. The job is to let them keep it without handing the company's data to a third party on terms nobody read.

If you're trying to get ahead of this rather than react to it, I can help you set it up properly.

Explore: More on AI security · Work with me