“We Don’t Really Use AI Here.”
I hear some version of that from business owners all the time.
Then we dig a little deeper.
- Someone in sales uses ChatGPT to improve emails
- An employee uploads meeting notes to an AI summarizer
- Marketing found a browser extension that creates content faster
- Someone else discovered an AI tool that helps analyze spreadsheets
Suddenly the answer changes.
Your company may not have officially adopted AI. But your employees probably have.
That’s where the risk begins.
Your Employees Aren’t Trying to Create a Security Problem
This is important.
Imagine an employee receives a long email from a client. They copy it into a free AI tool and ask:
“Summarize this and draft a professional response.”
Thirty seconds later, they have a great reply. They just saved 15 minutes.
So tomorrow they do it again. Next week they upload a proposal.
Eventually someone uploads a spreadsheet because they want AI to analyze the numbers.
Nobody thinks they’re doing anything wrong.
They’re trying to be productive.
And you can’t protect information if you don’t know where it’s going.
AI Doesn’t Arrive Like Normal Business Software
Think about how you buy accounting software.
- There’s a discussion
- Someone evaluates products
- Pricing gets reviewed
- IT may look at security
- Management approves the purchase
AI often skips all of that.
An employee hears about a tool on LinkedIn at 10:15.
Creates a free account at 10:17.
And by lunch they’re using it with company information.
That’s shadow AI—AI use happening outside your organization’s visibility or control.
Banning Everything Usually Isn’t the Answer
The instinctive response might be:
“Fine. Block all AI.”
That may reduce one risk while creating another.
Employees are using these tools because they solve real problems.
If you simply tell them no without giving them an approved alternative, some employees may find another workaround.
A better conversation is:
“Use AI. We just need some rules.”
- Decide which AI platforms are approved
- Require company-managed accounts where possible
- Explain what information employees can and cannot share
- Determine which AI use cases require human review
And most importantly, explain why.
NIST’s AI Risk Management Framework is a useful resource for organizations developing a structured approach to AI risk and governance.
NIST AI Risk Management Framework
Ask Your Employees One Question Tomorrow
You don’t need to begin with a 30-page AI policy.
Start with:
“What AI tools are you currently using for work?”
And don’t ask it like an interrogation.
You’re trying to discover what’s already happening.
- What are they using?
- Why are they using it?
- What problem does it solve?
- Are they using personal or company accounts?
- What information are they putting into it?
You might discover some great opportunities.
You may also discover risks you had no idea existed.
AI Governance Doesn’t Have to Mean Slowing Everyone Down
For New Jersey business owners, the objective shouldn’t be stopping employees from finding better ways to work.
It’s giving them safe lanes to work within.
- Approved AI tools
- Business-managed accounts
- Clear rules around company data
- Human review where it matters
- Visibility into what’s actually being used
At ONE2ONE Tech Solutions, we help Northern New Jersey businesses approach AI as both a productivity opportunity and a business risk that needs to be managed.
Because your biggest AI risk may not be the technology itself.
It may be believing your company isn’t using it.
