At the board meeting of a housing association, two agenda items come one after the other. The IT manager presents the Copilot rollout: three hundred licences, 38 per cent in weekly use and a proposal for a campaign to push that up. Then the data protection officer presents the AI risks: six tools in use that nobody has ever made a decision about, and a proposal for stricter policy. Nobody at the table notices that both are talking about the same people.
More AI adoption and less risk are not opposing agendas. They start from the same question: which tools are actually used, and does that use run through the tools the organisation has decided on? A licence nobody uses and a tool nobody knows about are two sides of one problem. The decision and the practice are out of step.
Why do they look like two agendas?
Because they sit with different people, who speak different languages. The adoption side belongs to IT and the executive team: money has been spent, and the question is whether the work is changing because of it. The risk side is called shadow AI and belongs to the privacy officer and the CISO: customer data is going through tools whose terms nobody has read.
The first side wants the number up, the second wants it down. Or so it seems. But the number IT wants up is use of the allowed tools, and the number the DPO wants down is use outside them. That is one distribution, viewed from two ends. AI governance for everyday use starts with that single distribution: which tools are used, and what has been decided about them.
What do an unused licence and an unknown tool have in common?
Both show that the decision and the practice have drifted apart.
The unused licence says: we decided this is the tool to use, and half the organisation is not using it. Perhaps because the tool does not do what people need, perhaps because nobody knows it exists, perhaps because that department's work does not call for AI. The number does not say which of the three.
The unknown tool says the reverse: we decided nothing about this, and people use it anyway. That is rarely defiance. Someone needed a presentation, a translation or a summary of a long document, and picked the tool that did it fastest. Why employees use other tools alongside Copilot is usually a question about what Copilot does not do for that task.
Put them side by side and the difference disappears. In both cases there is work people want to do with AI, and a decision that does not match it. The adoption side calls that an adoption problem, the risk side a governance problem. It is the same gap.
| Observation | What the adoption side sees | What the risk side sees |
|---|---|---|
| 38 per cent use the purchased tool | Too little return on the licences | Where do the other 62 per cent do their AI work? |
| Six tools in use without a decision | People find what works on their own | Unknown terms, no data processing agreement |
| A translation tool opened daily | A need the preferred tool does not cover | Customer letters in a tool without a decision |
| Share of use through allowed tools rises | The campaign is working | The policy is taking hold |
The last row is the interesting one. When the share through allowed tools rises, both agendas are satisfied by a single number.
What does this look like at the housing association?
After the meeting, the IT manager and the DPO put their figures side by side. Of the six tools without a decision, two tell the story: a translation tool opened daily in the customer contact centre, and a tool that summarises long policy papers, used in three departments. Copilot can do both tasks, but nobody had ever said so, and the employees already had the other tools open before the licences arrived.
That is not an incident. It shows where people want to use AI in their work, and that the decision had not yet covered it. The association does three things at once. It decides on the translation tool, because letters with names and addresses go through it: not allowed, with Copilot named as the alternative. It decides on the summarising tool too: limited use, public policy papers only. And IT's campaign gets a different message. Not "use Copilot more", but "for translating and summarising, this is the tool to use", shown when someone opens one of those tools.
Three months later the share through allowed tools has risen from 54 to 71 per cent. The DPO and the IT manager present it as one agenda item.
Which figures serve both sides?
The same ones, and that is the point. The share of AI use through allowed tools, with its trend. The number of tools that are genuinely in use but still have no decision. How often a notice was shown for a tool that is not allowed, and how often someone then chose the alternative. And what AI is used for, because that tells you where training and clear AI rules pay off most. Which other figures mean something, and why prompt volume does not, is covered in measuring AI adoption.
None of those figures needs a name. That is not a side issue. The adoption side wants people not to retreat to their personal phones; the risk side wants the measurement not to turn into employee monitoring. The KPMG and University of Melbourne study (2025, covering 48,000 workers in 47 countries) found that 57 per cent of workers hide their AI use from their employer. Measure per person and you push that percentage up and make your own figures worse.
This is the register both sides look at: per tool, the observed use and the decision the organisation has recorded.
