At the board meeting of a housing association, two agenda items follow each other. The IT manager presents the Copilot rollout: three hundred licences, 38 percent in weekly use, and a proposal for a campaign to push that up. Then the data protection officer presents the AI risks: six tools in use that nobody ever decided on, and a proposal for stricter policy. Nobody at the table notices that both are talking about the same people.
More AI adoption and less risk are not opposing agendas. They look at the same observation: which tools are actually used, and does that use run through the tools the organisation has decided on. A licence nobody uses and a tool nobody knows about are two sides of one problem. The decision and the practice are out of step.
Why do they look like two agendas?
Because they sit with different people and speak a different language. The adoption side belongs to IT and the executive team: money has been spent, and the question is whether the work is changing because of it. The risk side is called shadow AI and belongs to the privacy officer and the CISO: customer data is going through tools whose terms nobody has read.
The first side wants the number up, the second wants it down. Or so it seems. But the number IT wants up is use of the allowed route, and the number the DPO wants down is use outside that route. That is one distribution, viewed from two ends. What AI governance is for everyday use starts with that single distribution: which tools are used, and what has been decided about them.
What do an unused licence and an unknown tool have in common?
Both show that the decision and the practice have drifted apart.
The unused licence says: we decided this is the route, and half the organisation is not taking it. Perhaps because the tool does not do what people need, perhaps because nobody knows it exists, perhaps because that department's work does not call for AI. The number does not say which of the three.
The unknown tool says the reverse: we decided nothing about this, and people use it anyway. That is rarely defiance. Someone needed a presentation, a translation, a summary of a long document, and picked the tool that did it fastest. Why employees use other tools next to Copilot is usually a question about what Copilot does not do for that task.
Put them side by side and the difference disappears. In both cases there is work people want to do with AI, and a decision that does not match it. The adoption side calls that an adoption problem, the risk side a governance problem. It is the same distance.
| Observation | What the adoption side sees | What the risk side sees |
|---|---|---|
| 38 percent use the purchased tool | Too little return on the licences | Where do the other 62 percent do their AI work? |
| Six tools in use without a decision | People find what works on their own | Unknown terms, no data processing agreement |
| A translation tool opened daily | A need the preferred route does not cover | Customer letters in a tool without a decision |
| Share of use through allowed tools rises | The campaign is working | The policy is landing |
The last row is the interesting one. When the share through allowed tools rises, both agendas are satisfied, and it is one number.
What does this look like at the housing association?
After the meeting, the IT manager and the DPO put their figures next to each other. Of the six tools without a decision, two tell the story: a translation tool opened daily in the customer contact centre, and a tool that summarises long policy papers, used in three departments. Copilot can do both tasks, but nobody ever said so, and the employees had the other tools open before the licences arrived.
That is not an incident. It shows where the work is that people want to do with AI, and that the decision did not yet cover it. The association does three things at once. It decides on the translation tool, because letters with names and addresses go through it: not allowed, with Copilot named as the alternative. It decides on the summarising tool too: limited use, public policy papers only. And IT's campaign gets different content. Not "use Copilot more", but "for translating and summarising, this is the route", shown at the moment someone opens one of those tools.
Three months later the share through allowed tools has risen from 54 to 71 percent. The DPO and the IT manager present it as one agenda item.
Which figures serve both sides?
The same ones, and that is the point. The share of AI use through allowed tools, with its trend. The number of tools with real use that still have no decision. How often a notice was shown at a tool that is not allowed, and how often someone then chose the alternative. And what AI is used for, because that says where training and agreements pay off most. Which other figures mean something, and why prompt volume does not, is in measuring AI adoption.
None of those figures needs a name. That is not a side issue. The adoption side has an interest in people not retreating to their private phone, and the risk side has an interest in the measurement not becoming employee monitoring. The KPMG and University of Melbourne study (2025, among 48,000 workers in 47 countries) found that 57 percent of workers hide their AI use from their employer. Whoever measures per person makes that percentage larger and their own figures worse.
This is the register both sides look at: per tool, the observed use and the decision the organisation has recorded.
