Your people already use AI. Start the policy there

The board approves an AI strategy: a working group, a vendor selection, a pilot planned for next spring. Meanwhile, in the same building, a sales manager pastes a customer’s contract into a free chatbot to get a summary, an analyst uses another one to write spreadsheet formulas, and somebody in HR drafts job adverts with a third. None of it is in the strategy, and none of it is waiting for spring.

This is the normal starting point now. The question is not whether people in the company use AI. It is whether anybody knows how, with which data, and with what results.

Why it happens

Not because people are careless. Because the tools are free or cheap, sit in a browser, and are genuinely useful for tedious tasks. People adopt what saves them time, and they do not ask permission for things nobody forbade — or explained.

The official programme moves at the speed of procurement. Individual adoption moves at the speed of a sign-up page. The gap between those two speeds is where unmanaged use grows.

The wrong answers

A blanket ban. Easy to write, close to impossible to enforce. Use moves to personal phones and personal accounts, where the company sees even less, and the people who followed the rule fall behind the ones who did not.

Pretending it is not happening. The strategy is written as though adoption begins with the pilot, so the risks already present are never assessed and the experience already gained is never used.

A policy written only by lawyers. It lists prohibitions, cites regulation, and gives nobody an approved way to do the thing they were doing. People read it, conclude that everything is forbidden, and carry on quietly.

Buying a platform and calling it the answer. A company-wide licence for one tool settles the data question for that tool. It does not tell anybody which tasks it is good for, what to check in its output, or what must never go into it.

What to do instead

Ask first, without consequences. A short anonymous survey or a handful of conversations: which tools, for which tasks, with what kind of data. Say explicitly that the aim is to learn, not to discipline. You cannot write a sensible policy about behaviour you have not seen.

Classify the data, not the tools. Most of the risk sits in what goes in: customer data, personal data, contracts, unpublished financials, source code. A simple rule about which kinds of information may go into which kind of tool is more useful than a list of approved brand names that is out of date within a quarter.

Give people an approved route. If staff need to summarise documents, give them a tool where the company controls the terms and the data, and say clearly what it is for. A permitted path removes most of the reason to use an unpermitted one. Which tool that is depends on what the company already runs; there is rarely one right answer, and we have nothing to sell either way.

Keep a person responsible for the output. Whoever sends the email, signs off the contract summary or publishes the number is accountable for it, whatever drafted it. That one rule covers more risk than most technical controls.

Treat the early users as a resource. The people already using AI know which tasks it handles well and where it fails. They are your first pilot group and your best trainers — provided they are not afraid to say what they have been doing.

This is change work more than technology work. The tools are already there; what is missing is shared rules, a safe channel and somebody who owns the question. That is why VUCALE starts, as the homepage puts it, with diagnosis of what is actually happening rather than with a product. It also gives an official pilot a better starting point than a vendor shortlist: real tasks, real users, real evidence of value. The mechanism is the one in the article on change capacity — a change that is already under way is cheaper to shape than a new one is to start.

A test you can run this week

Ask five people from different departments, informally and with a promise that nothing will follow from the answer: have you used an AI tool for work in the last month, for what, and what did you put into it?

Then ask whoever is responsible for IT or data protection what the company’s rule is. If the five answers surprise them, the policy you have does not describe the company you have. Start from the five answers.