The director of a marketing agency tells the management meeting that AI is not a theme for them yet: "We hardly use it, so that risk is limited." That same afternoon an account manager finishes a client briefing with ChatGPT on her phone, client names and budget included. She has been doing this for a year, and the work has got better for it.
Both sentences are true, and the first one is the problem. Safe AI adoption is not as little AI as possible. It is AI use the organisation knows about, through an account that fits the data, with sensitive data kept out of the prompt, with a decision that is known at the moment someone opens the tool, and with figures that show whether that is happening.
Why is "as little AI as possible" not safe?
Because the use does not disappear; it moves. KPMG and the University of Melbourne asked 48,000 workers in 47 countries in 2025: 58 percent deliberately use AI for work, 57 percent hide that from their employer, and 48 percent have put sensitive company data into public AI tools. An organisation that "hardly uses AI" has usually just not seen the 57 percent.
Slowing it down makes that worse. Close off access and you get personal accounts and the phone, and with them goes exactly the visibility you needed to decide anything. Blocking makes the risk invisible, not smaller. People use AI because it makes their work easier, and the account manager from the opening was right that her briefing got better. The agency's question is not how to stop that, but how to handle it like an adult.
What does safe AI adoption look like?
| Characteristic | What it means | What it does not mean |
|---|---|---|
| The tools are known | The organisation knows which AI tools are in use, including the ones nobody ever requested | That only procured tools are allowed |
| The account fits the data | Work data goes through a business environment with a data processing agreement | That a free account is never allowed; for public information it can be |
| Sensitive data stays out of the prompt | Personal data, client files and confidential documents do not go along, not even in a business environment | That the task is off limits; the task stays, the identifying details come out |
| The decision is known at the moment of work | Whoever opens a tool sees what the organisation decided about it and which alternative exists | That the tool is blocked; continuing is always possible |
| There are figures | At organisation level: which tools, what share through allowed tools, what happens after a notice | That someone sees who did what |
The order is no accident. You cannot prescribe an account for a tool you do not know about, and you cannot show a decision that has not been taken. The figures come last and lead back to the start: a tool that shows up in the figures without a decision is the next one to decide on.
What does this look like in practice?
An insurer has allowed Microsoft 365 Copilot and has a two-page AI policy. An inventory of what is opened in the browser shows that next to Copilot, Perplexity, ChatGPT and three specialised tools are in use, including one that summarises claim forms. Two of the three are not yet in the register.
That is not an incident. It shows that the policy was about Copilot and the use was wider, and that a one-off inventory is already behind on the day it is delivered. What the insurer does: decide on the summarising tool, because it sees policyholders' personal data; give ChatGPT limited use with the condition "business account only"; allow Perplexity for public research; and replace the inventory with continuous observation, so that the next new tool does not go unnoticed for a year.
