𝐘𝐨𝐮𝐫 𝐭𝐞𝐚𝐦 𝐡𝐚𝐬 𝐚𝐧 𝐀𝐈 𝐬𝐭𝐫𝐚𝐭𝐞𝐠𝐲 – do 𝐲𝐨𝐮? 𝐏𝐚𝐫𝐭 𝟏 – 𝐒𝐭𝐨𝐩 𝐒𝐡𝐚𝐝𝐨𝐰 𝐀𝐈

If you haven’t approved and implemented an AI tool for your organisation, you almost certainly already have people using AI anyway.

Not because they’re reckless, because they’re busy. Someone is copying a chunk of a client email thread into a free tool to summarise it. Someone is turning meeting notes into actions. Someone is rewriting a tricky message, so it lands better.

I have personally seen someone paste customer personal data into a free AI tool just to reformat it, completely unaware they were one step away from a serious data breach.

The catch is this: it’s not actually just about which tool. It’s the licence, the tenant, where data is processed, what’s retained, and what happens to content behind the scenes. That’s where the real risk sits – especially when dealing with client and staff information.

Your first move should not be “ban it” or ignore it. It should be to “make it safe”.

Start with a clear policy that answers three things in plain English:

• What tools are approved

• What must never be pasted into an AI tool (be specific – for example, even an approved tool may still be off-limits for identifiable health data)

• What people should do when they’re unsure (who do they ask, and how quickly will they respond?)

The first question to ask yourself:

At your organisation is AI:

1. Approved

2. Ignored

3. Officially banned but happening